Platform support

kovra 0.12.1 ships for macOS. Most of kovra is cross-platform Rust; the OS-specific pieces — attended confirmation, the secret store, file permissions, the ssh-agent transport — sit behind traits with a native implementation per platform.

Windows: coming soon

Windows returns when its approvals go through Windows Hello with no file-based path an agent could use to approve its own request. Linux is on the roadmap.

Feature support

Capability	macOS
👆 Attended confirmation	Touch ID, or your login password on a Mac without Touch ID
🔑 Secret store backend	Keychain
📁 Default vault location	~/.vaults
📦 Packaging	Native installer (.dmg)
🌐 Dashboard (loopback web)	✅
🪟 Native dashboard window	✅ WKWebView
📍 Menu-bar app (kovra-menulet)	✅
🔏 Governed ssh-agent	Unix socket
🛡️ File permissions	POSIX 0600
💉 Wrapper injection	✅
🔢 TOTP · keypairs · cloud providers	✅

Every approval is read and approved in kovra’s review window, with the Touch ID sensor inside it; the macOS dialog opens only when you click the fingerprint, or after the window shows a code on a Mac without Touch ID. Over SSH, or anywhere without a graphical session, the window can’t be shown: what needs an approval goes to the paired phone, in kovra’s approval app (kovra Mobile, coming soon), and with no paired phone it is refused — see Headless & CI.

See Installation for how to install.