Credential access
Reads netrc files, headers, cookies, tokens, and files used as request bodies.
brew / rank 78
Install curl with Homebrew
Get a file from an HTTP, HTTPS or FTP server. Version 8.21.0 via Homebrew; verified 2026-06-27.
agent safety
Agent safety answer
curl can fetch remote scripts, call APIs, and exfiltrate data from files an agent can read.
Remote mutation
Can call arbitrary HTTP APIs that mutate remote systems.
Publish/artifact risk
Can upload artifacts or run installer pipelines when paired with a shell.
Recommended control
Gate credentialed requests, file uploads, and pipe-to-shell installer patterns.
Agent-use guidance
Allow simple public fetches; require approval for authenticated requests, uploads, and shell execution.
install
Additional install commands
macOS
Homebrewverified · 100%
brew install curlprovider-native install command
overview
Package summary
Get a file from an HTTP, HTTPS or FTP server
Project links
Commands and aliases
- curl
- curl-config
- wcurl
history
Project history and usage
curl is a command-line transfer tool and libcurl is its underlying URL transfer library. Together they became one of the default pieces of Internet plumbing in Unix-like systems, Windows, language runtimes, build systems, containers, and scripts.
Project history
curl traces back to late 1996, when Daniel Stenberg extended Rafael Sagula's HttpGet utility while building an IRC bot feature for currency exchange lookups. The project moved from HttpGet to urlget as protocols beyond HTTP were added, then became curl in March 1998 after upload support made the older name misleading.
Adoption history
The project history records early Linux RPM packaging in 1998, the first Debian package in 1999, a non-beta libcurl interface in 2000, PHP adopting libcurl the same year, and Mac OS X bundling curl in 2001. By 2018, curl's history page described it as shipped in Windows 10 and estimated curl and libcurl at five billion installed instances; by 2020 that estimate reached ten billion instances.
How it is used
curl is used interactively and in scripts to transfer data over URL-addressed protocols, especially HTTP(S), FTP(S), SMTP, IMAP, SFTP, WebSocket, and related network protocols. libcurl is embedded by applications that need the same transfer features through a stable C API.
Why package nerds care
curl matters to package managers because it is often both a package and a bootstrap tool: build scripts fetch with it, test suites depend on it, and other packages link against libcurl. Packaging has to track TLS backends, protocol feature flags, CA certificate behavior, ABI stability, and the split between the curl executable, libcurl, headers, and curl-config.
Timeline
- 1996: HttpGet 0.1 released; Daniel Stenberg soon becomes maintainer.
- 1998: curl 4 released under the curl name.
- 1999: First Debian package recorded in upstream history.
- 2000: libcurl non-beta interface arrives and PHP adopts libcurl.
- 2001: curl bundled in Mac OS X 10.1.
- 2010: Project switches from CVS to git hosted by GitHub.
- 2018: Windows 10 starts shipping curl.
- 2020: Upstream estimates 10 billion curl and libcurl installations worldwide.
- 2024: wcurl adopted into the curl organization.
Related projects
- libcurl, wcurl, trurl, HTTPie, Curlie, and cURLpp are adjacent projects in the curl ecosystem.
Sources
security posture
Risk level: blue
doc example: network transfer tool.
Risk classifier
blue risk · high confidence · tool
Why
- doc example: network transfer tool
Signals
- override:curl
Install behavior
- No Homebrew bottle metadata was recorded.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
~/.curlrc
Credential files
Credential-bearing paths to review before unattended agent runs.
- Unix
~/.netrc~/.curlrc
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
curl | executable | indexed executable | Discovered from the local executable index. |
curl-config | executable | indexed executable | Discovered from the local executable index. |
wcurl | executable | indexed executable | Discovered from the local executable index. |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-08-03
manager version8.21.0
manager updated2026-06-27
local dataunknown
upstreamnot available
latest detectednot detected
- okNo freshness warnings were generated.
install metadata
Package metadata
| Package key | brew:curl |
|---|---|
| Version | 8.21.0 |
| Package manager | Homebrew |
| Homepage | https://curl.se |
| Repository | https://github.com/curl/curl |
| Last updated | 2026-06-27T15:50:29Z |
| Pulse | updated |
| Bottle | not recorded |
| Service | none declared |
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- curated agent safety answer
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation