Install the webQsee helper

Pick the right download

Every release lives on the helper download page, which reads the same release manifest wqs-helper update does and always offers the current version. Pick the file for your machine; each archive contains the binary, the installer scripts, the documentation and a SHA256SUMS file.

The file names carry their version, so an older download keeps working and its link never breaks. release-manifest.json in the same directory is what wqs-helper update reads; you never need to open it by hand.

Not sure which processor you have?

• Windows: Settings, System, About, "System type".
• macOS: Apple menu, About This Mac. "Apple M..." is arm64, "Intel" is x64.
• Linux: uname -m. x86_64 is x64, aarch64 is arm64.

Unpack and run the installer

1. Windows

   Right-click the .zip, Extract All, then double-click install.cmd in the extracted folder. A console window opens, does the work and waits for a key.

   Windows will stop you first with Windows protected your PC, and macOS with cannot be opened because it is from an unidentified developer. That is expected, it is not a sign that something is wrong with the download, and When the system refuses to run the download further down says what to click.

2. macOS and Linux

   tar -xzf wqs-helper-<version>-<target>.tar.gz
   cd wqs-helper-<version>-<target>
   ./install.sh

3. What the installer does, and it prints each step

   • copies the binary into your user account (%LOCALAPPDATA%\webQsee\bin on Windows, ~/.local/bin elsewhere);
   • puts that directory on your PATH if it is not there already;
   • registers the helper with Chrome and Edge so the extension can reach it;
   • prints the token that web mode uses. Copy it now if you plan to use view.webqsee.com, or read it back at any time with wqs-helper token.
   Sanity check: the installer ends without an error and names the directory it copied the binary into.

4. Restart the browser

   This one is not optional and it is the step people skip. The browser reads the registration when it starts, so until you restart it, the extension will keep saying the helper is not running even though it is.

   Sanity check: fully quit the browser, including any background instance, and open it again.

Check it

Open a new terminal, so it picks up the changed PATH:

wqs-helper doctor

It reports what it found: which browsers it is registered with, whether an agent is on the PATH, whether ffmpeg is available, where the cache lives and how big it is. Anything it is unhappy about it says in one line, with what to do about it.

Connect it to webQsee in a browser tab

Skip this if you only use the extension: there, Chrome vouches for webQsee through the registration the installer wrote, and there is no token to paste. In view.webqsee.com there is, because a web page cannot be registered with your operating system and has no way to discover a program running on your machine. It authenticates with the helper's token instead, and you paste that once.

1. Start the helper

   wqs-helper start

   The extension starts the helper by itself whenever it needs it; a web page cannot start a program on your computer, so here you do it once. It keeps running in the background until wqs-helper stop or the next reboot, and starting it again when one is already running does nothing.

2. Read the token

   wqs-helper token

   One line. The installer printed the same value when it ran, so if that window is still open you already have it. wqs-helper token --rotate issues a new one and invalidates the old, which is what to do if it ever ends up somewhere it should not.

3. Paste it into webQsee web

   Open view.webqsee.com, go to your user area and open the AI Analysis tab. Its first sub-tab, Overview, has a section Connecting to the helper with a Token field and an Address field. Paste the token; leave the address empty.

   Leave the address empty unless you moved the helper. Empty means "look on the usual ports", and that is what you want on the machine the helper is running on.

4. Save and connect

   The panel reports what it found: the helper's version, which agents are configured and whether each one is ready. That report is the confirmation: there is no separate "connected" light to look for.

   Your browser then asks whether the site may access other apps and services on this device. Allow it. The helper runs on this computer, and that permission is how the page reaches it; the page asks nothing before you press Save and connect, and it only contacts the helper's own ports on 127.0.0.1. Clicked Block by mistake? No page can bring the question back by itself: click the icon left of the address, switch on Apps on device (older Chrome versions: Local network access), and the panel connects by itself.
   Sanity check: the panel lists your agent profiles. If it says it cannot reach the helper, run wqs-helper status in a terminal: it answers whether a helper is listening, and on which port. If none is, run wqs-helper start.

The token stays on that device and is never synced to your browser account. It is also not a licence to run anything: a web connection may only use an executable the machine already has — a configured profile, a vendor built-in or a template — so it can rename, re-model and re-budget an agent, and cannot invent a command. The Command and Arguments fields are read-only outside the extension for exactly that reason.

Point it at an agent

The helper does not ship a model. Deep Inspection runs an agent CLI that is already on your machine and signed in, and the helper starts it against the recording. Six are supported and were measured side by side: Claude Code, Codex, Antigravity, Cursor, Cline and opencode — what each one does well.

Ask the helper what it can already see:

wqs-helper doctor

It lists every profile it knows, whether the command exists on the PATH and whether that agent is signed in. An agent you do not use can be switched off in the AI Analysis panel under Account: a disabled profile is not probed, so it costs neither a process nor a wait.

Nothing listed? Then no agent CLI is installed yet. Install one, sign in, and run wqs-helper doctor again — the profile appears by itself, there is nothing to register. The two most common:

npm i -g @anthropic-ai/claude-code   # then: claude
npm i -g @openai/codex               # then: codex

Each one signs in its own way, once, in its own terminal. The helper never handles those credentials: it starts a CLI that is already signed in on this machine. All six, side by side.

How the pieces connect

Three kinds of link, all on your own computer. Only the first one depends on whether you use webQsee in a browser tab or the extension. The second, the one your agent uses, is the same for everybody, which is why the registration line an agent needs never differs between the two.

• Recordings travel back the same way. When an agent asks for one (list_recordings, fetch_recording, await_new_recording), the helper asks the open webQsee windows over their own link, and the recording comes back along it. A cloud recording the helper downloads itself, from a signed link, with no window needed.
• It has to be running. The extension starts the helper whenever it needs it, and a helper started that way ends itself 15 minutes after the last window closes with nothing running. A browser tab cannot start it at all. If your agent should reach it with no webQsee window open, run wqs-helper start once: that one stays until wqs-helper stop or a reboot.
• The quick analysis needs none of this. The browser sends it to webQsee AI in the EU, or with your own key straight to your provider. No helper, no agent CLI.

Ports, and what stays local

Everything the helper opens listens on 127.0.0.1 only: MCP for agents at http://127.0.0.1:48620/mcp (if something else holds 48620, the next free port after the WebSocket's four; wqs-helper status says which), and the WebSocket for a browser tab on the first free of 48621 to 48624, which are exactly the ports a page looks on. The extension needs no port of its own: the browser starts the helper through its native-messaging registration, and that process relays to the running helper on the MCP port. Nothing here is reachable from another machine, so no firewall rule and no port forward is needed. If a corporate policy blocks loopback ports, that is the thing to have unblocked.

When the system refuses to run the download

The binaries are not code-signed yet, so each operating system will want a confirmation the first time. This is expected, and here is exactly what each one does.

• The browser, before anything runs. Chrome and Edge can flag a new, unsigned download as suspicious or "not commonly downloaded" and hold it back. Open the browser's download list, pick the file and choose to keep it (the button is called Keep or Download suspicious file, depending on the version). The warning is about how new and unsigned the file is, not about what is in it; the SHA-256 shown next to each download on the download page confirms it is the file we published.
• Windows. SmartScreen shows "Windows protected your PC". Choose More info, then Run anyway.
• macOS. Gatekeeper refuses an unsigned binary. Open System Settings, Privacy & Security, and press Open Anyway next to the message about wqs-helper, or clear the quarantine flag with xattr -d com.apple.quarantine ./wqs-helper.
• Linux. Nothing refuses it, but the file may not be executable after unpacking: chmod +x wqs-helper.

Troubleshooting

Updating and uninstalling

wqs-helper update checks for a newer release, verifies its checksum before installing it, and refuses a download whose version or hash does not match what the release promised. wqs-helper uninstall takes the registrations back out; deleting the binary and the ~/.wqs directory removes the rest.

Next