Is SteamCMD official? Where's a safe download link?

[Define Brackish Water]

I'm interested in using a program called SteamCMD, also known as Steam Console Client. It purports to be an official Valve tool to function in place of the Steam client but through command line arguments exclusively. It's very useful for hosting dedicated servers or getting crystal clear copies of Steam Workshop files.

But if it's an official tool, why is the only link available from the Valve Developer Community wiki? Anyone with an account there can switch the link to a dangerous one without getting prior approval.

If it's not an official Valve tool, then who made it? I can't find much concrete information about it beyond that it exists, how to use it, and that it's very useful for specific technical needs.

https://developer.valvesoftware.com/wiki/SteamCMD

I trust this thing and I know that it does not violate Steam's terms of service, but I'm really surprised that I can't independently verify that it's legit.

[cSg|mc-Hotsauce]

Valve made it, yes. It is as safe as you need it to be.

[lightwo]

If you read the wiki page (wiki is hosted by Valve), you'd notice that the files linked to in the article are using CDNs used by Steam elsewhere. It's official and Valve maintains it in about the same pace as the Steam desktop client.

If you looked deeper into it, it pulls the manifest and package files from the same CDNs that the Steam desktop client uses for updates.

[[N]ebsun]

Define Brackish Water a écrit :

But if it's an official tool, why is the only link available from the Valve Developer Community wiki? Anyone with an account there can switch the link to a dangerous one without getting prior approval.

Mostly because it was mostly aimed at people with more technical background, rather than the general population like the Steam client itself.
Agreed on the link being kind of obscure, and not very well placed - they could easily create a redirect with a more official url

[lightwo]

Nebsun a écrit :

Define Brackish Water a écrit :

But if it's an official tool, why is the only link available from the Valve Developer Community wiki? Anyone with an account there can switch the link to a dangerous one without getting prior approval.

Mostly because it was mostly aimed at people with more technical background, rather than the general population like the Steam client itself.
Agreed on the link being kind of obscure, and not very well placed - they could easily create a redirect with a more official url

Yeah, it seems like the only other ways SteamCMD has been distributed are through Steamworks SDK and Steam PC Café Server. For server administrators, command line experts and hobbyists alike, there's Valve Developer Wiki. It's true that anyone can edit, but the community is dedicated and is probably able to spot malicious edits in a timely matter.

[metamec]

You can download it without even opening a browser if you have winget (installed by default on Windows 11). Just open a terminal and type:

winget install Valve.SteamCMD

Beauty of this is if you keep your system up to date with the `winget upgrade --all` command, it keeps SteamCMD up to date as well.

[Spawn of Totoro]

Define Brackish Water a écrit :

I'm interested in using a program called SteamCMD, also known as Steam Console Client. It purports to be an official Valve tool to function in place of the Steam client but through command line arguments exclusively. It's very useful for hosting dedicated servers or getting crystal clear copies of Steam Workshop files.

But if it's an official tool, why is the only link available from the Valve Developer Community wiki? Anyone with an account there can switch the link to a dangerous one without getting prior approval.

If it's not an official Valve tool, then who made it? I can't find much concrete information about it beyond that it exists, how to use it, and that it's very useful for specific technical needs.

https://developer.valvesoftware.com/wiki/SteamCMD

I trust this thing and I know that it does not violate Steam's terms of service, but I'm really surprised that I can't independently verify that it's legit.

It is an official tool.

It DOES NOT replace the client. It will not allow you to run games, unless they are DRM free games, as it does not contain the DRM needed to do so.

It is mainly used by to obtain dedicated servers files, so the average users would have no use for it.

[туасопп]

By default, all windows executables must be signed to execute. If you downloaded steamcmd.exe for windows, click right mouse button on it and select Properties. Go to "Digital Signatures" tab. Select "Valve", click on Details.

It states "This signature is OK", well this does not mean it's safe. View certificate, check issuer. For instance, my executable is signed by Valve certificate issued by VeriSign. That means file SHA1 sum is legit, in some way.

If installing for linux, well... that means you trust some guy who maintains this package.

If it is not enough - go to virustotal... it got plenty of information for file.

HAHAHAHAH Virustotal automatic comments say that it is malware dropper. Welp. It is not. Yes, Steam uses hacks to make some magic.

I assume you have spare PC to play games. If you are so concerned if your PC safe with running steam client, riot client and epic games client... not, is's not safe, but you trust these vendors do things right.

[Steven]

This thread was quite old before the recent post, so we're locking it to prevent confusion.