Install the webQsee helper

Install it

Two ways, with the same result. The command is quicker, and it is the one no browser holds back; the archive is there for whoever wants the file in hand first.

The quick way: one command

Paste one line into a terminal. It reads the same release manifest as the download page and wqs-helper update, downloads the build for your machine, checks it against the release's SHA-256 (and on Windows its signature by PAGU.at EDV-Management GmbH), and installs nothing if a check fails. Then it does everything the installer in the archive does.

• Windows, in PowerShell

  irm https://www.webqsee.com/helper/install.ps1 | iex

• macOS and Linux, in Terminal

  curl -fsSL https://www.webqsee.com/helper/install.sh | sh

Want to read it before you run it? install.ps1 and install.sh open as plain text in the browser. Running the same command again later updates the helper, as wqs-helper update does.

Or: download the archive

Every release lives on the helper download page, which reads the same release manifest wqs-helper update does and always offers the current version. Pick the file for your machine; each archive contains the binary, the installer scripts, the documentation and a SHA256SUMS file.

Not sure which processor you have?

• Windows: Settings, System, About, "System type".
• macOS: Apple menu, About This Mac. "Apple M..." is arm64, "Intel" is x64.
• Linux: uname -m. x86_64 is x64, aarch64 is arm64.

• Windows

  Right-click the .zip, Extract All, then double-click install.cmd in the extracted folder. A console window opens, does the work and waits for a key.

  Windows may stop you first with Windows protected your PC. That is expected, it is not a sign that something is wrong with the download, and When the system refuses to run the download further down says what to click.

• macOS and Linux

  tar -xzf wqs-helper-<version>-<target>.tar.gz
  cd wqs-helper-<version>-<target>
  ./install.sh

What either way does, and it prints each step

• copies the binary into your user account (%LOCALAPPDATA%\webQsee\bin on Windows, ~/.local/bin elsewhere);
• puts that directory on your PATH on Windows; on macOS and Linux it prints the line to add if it is not there yet;
• registers the helper with Chrome and Edge so the extension can reach it;
• prints the token that web mode uses. Copy it now if you plan to use view.webqsee.com, or read it back at any time with wqs-helper token.

Restart the browser, with the extension

With the extension this one is not optional, and it is the step people skip. The browser reads the registration when it starts, so until you restart it, the extension will keep saying the helper is not running even though it is. In webQsee in a browser tab there is nothing to restart: go on to Connect it to webQsee in a browser tab after the check below.

Check it

Open a new terminal, so it picks up the changed PATH:

wqs-helper doctor

It reports what it found: which browsers it is registered with, whether an agent is on the PATH, whether ffmpeg is available, where the cache lives and how big it is. Anything it is unhappy about it says in one line, with what to do about it.

Connect it to webQsee in a browser tab

Skip this if you only use the extension: there, Chrome vouches for webQsee through the registration the installer wrote, and there is no token to paste. In view.webqsee.com there is, because a web page cannot be registered with your operating system and has no way to discover a program running on your machine. It authenticates with the helper's token instead, and you paste that once.

1. Start the helper

   wqs-helper start

   The extension starts the helper by itself whenever it needs it; a web page cannot start a program on your computer, so here you do it once. It keeps running in the background until wqs-helper stop or the next reboot, and starting it again when one is already running does nothing.

2. Read the token

   wqs-helper token

   One line. The installer printed the same value when it ran, so if that window is still open you already have it. wqs-helper token --rotate issues a new one and invalidates the old, which is what to do if it ever ends up somewhere it should not.

3. Paste it into webQsee web

   Open view.webqsee.com, go to your user area and open the AI Analysis tab. Under Deep Inspection, open Setup & status (in the rail on the left, or in the Section menu on a narrow window): step 3, Connect this page, has a Token field and an Address field. Paste the token; leave the address empty.

   Leave the address empty unless you moved the helper. Empty means "look on the usual ports", and that is what you want on the machine the helper is running on.

4. Save and connect

   The panel says Deep Inspection is ready with the helper's version, and the rail shows Connected beside Setup & status. Agents then lists which agents are configured on this computer and whether each one is ready.

   Your browser then asks whether the site may access other apps and services on this device. Allow it. The helper runs on this computer, and that permission is how the page reaches it; the page asks nothing before you press Save and connect, and it only contacts the helper's own ports on 127.0.0.1. Clicked Block by mistake? No page can bring the question back by itself: click the icon left of the address, switch on Apps on device (older Chrome versions: Local network access), and the panel connects by itself.
   Sanity check: Setup & status says how many agents are ready. If it says it cannot reach the helper, run wqs-helper status in a terminal: it answers whether a helper is listening, and on which port. If none is, run wqs-helper start.

The token stays on that device and is never synced to your browser account. It is also not a licence to run anything: a web connection may only use an executable the machine already has (a configured profile, a vendor built-in or a template), so it can rename, re-model and re-budget an agent, and cannot invent a command. The Command and Arguments fields are read-only outside the extension for exactly that reason.

Point it at an agent

The helper does not ship a model. Deep Inspection runs an agent CLI that is already on your machine and signed in, and the helper starts it against the recording. Six are supported and were measured side by side: Claude Code, Codex, Antigravity, Cursor, Cline and opencode: what each one does well.

Ask the helper what it can already see:

wqs-helper doctor

It lists every profile it knows, whether the command exists on the PATH and whether that agent is signed in. An agent you do not use can be switched off in the AI Analysis panel under Account: a disabled profile is not probed, so it costs neither a process nor a wait.

Nothing listed? Then no agent CLI is installed yet. Install one, sign in, and run wqs-helper doctor again; the profile appears by itself, there is nothing to register. The two most common:

npm i -g @anthropic-ai/claude-code   # then: claude
npm i -g @openai/codex               # then: codex

Each one signs in its own way, once, in its own terminal. The helper never handles those credentials: it starts a CLI that is already signed in on this machine. All six, side by side.

How the pieces connect

Three kinds of link, all on your own computer. Only the first one depends on whether you use webQsee in a browser tab or the extension. The second, the one your agent uses, is the same for everybody, which is why the registration line an agent needs never differs between the two.

• Recordings travel back the same way. When an agent asks for one (list_recordings, fetch_recording, await_new_recording), the helper asks the open webQsee windows over their own link, and the recording comes back along it. A cloud recording the helper downloads itself, from a signed link, with no window needed.
• It has to be running. The extension starts the helper whenever it needs it, and a helper started that way ends itself 15 minutes after the last window closes with nothing running. A browser tab cannot start it at all. If your agent should reach it with no webQsee window open, run wqs-helper start once: that one stays until wqs-helper stop or a reboot.
• The quick analysis needs none of this. The browser sends it to webQsee AI in the EU, or with your own key straight to your provider. No helper, no agent CLI.

Ports, and what stays local

Everything the helper opens listens on 127.0.0.1 only: MCP for agents at http://127.0.0.1:48620/mcp (if something else holds 48620, the next free port after the WebSocket's four; wqs-helper status says which), and the WebSocket for a browser tab on the first free of 48621 to 48624, which are exactly the ports a page looks on. The extension needs no port of its own: the browser starts the helper through its native-messaging registration, and that process relays to the running helper on the MCP port. Nothing here is reachable from another machine, so no firewall rule and no port forward is needed. If a corporate policy blocks loopback ports, that is the thing to have unblocked.

When the system refuses to run the download

From version 1.0.1 on, the Windows builds are code-signed by PAGU.at EDV-Management GmbH; the macOS and Linux builds are not. A brand-new release can still be asked about the first time, until enough people have downloaded it. This is expected, and here is exactly what each system does. None of it applies to the one-command install: no browser downloads anything there, and a file fetched by PowerShell or curl is not marked for SmartScreen or Gatekeeper.

• The browser, before anything runs. Chrome and Edge can flag a new download as suspicious or "not commonly downloaded" and hold it back. Open the browser's download list, pick the file and choose to keep it (the button is called Keep or Download suspicious file, depending on the version). The warning is about how new the file is, not about what is in it; the SHA-256 shown next to each download on the download page confirms it is the file we published.
• Windows. SmartScreen may show "Windows protected your PC" for a release that is still new; a signed build names PAGU.at EDV-Management GmbH as its publisher there. Choose More info, then Run anyway.
• macOS. The installer takes care of it: install.sh removes the quarantine flag the browser put on the download from the copy it installs, so the installed helper and its later updates start without asking. Only the unpacked binary run on its own (say, ./wqs-helper doctor before installing) is stopped with Apple could not verify "wqs-helper" is free of malware. Then open System Settings, Privacy & Security, and press Open Anyway, or clear the flag with xattr -d com.apple.quarantine ./wqs-helper. Right-click, Open no longer gets past it since macOS 15. If ./install.sh says permission denied, run sh install.sh.
• Linux. Nothing refuses it, but the file may not be executable after unpacking: chmod +x wqs-helper.

Troubleshooting

Updating and uninstalling

wqs-helper update checks for a newer release, verifies its checksum before installing it, and refuses a download whose version or hash does not match what the release promised. Running the one-command install again does the same. To remove it, run wqs-helper uninstall first (so no browser starts it again), then wqs-helper stop, and delete its folder (%LOCALAPPDATA%\webQsee\bin on Windows, the file ~/.local/bin/wqs-helper elsewhere) and ~/.wqs. On Windows either installer also put that folder on your user PATH, which you can remove under Settings, System, About, Advanced system settings, Environment Variables.

Next