Platform support

kovra runs on macOS (the reference platform) and Windows (Beta). Most of kovra is cross-platform Rust; the OS-specific pieces — biometric confirmation, the secret store, file permissions, the ssh-agent transport — sit behind traits with a native implementation per platform. A few surfaces are macOS-only today.

Windows is in Beta

Windows is built and tested behind the same traits as macOS, with full hardware validation ongoing. macOS on Apple Silicon remains the reference platform. Linux is on the roadmap.

Feature support

Capability	macOS (reference)	Windows (Beta)
👆 Attended confirmation	Touch ID	Windows Hello
🔑 Secret store backend	Keychain	Credential Manager
📁 Default vault location	~/.vaults	%LOCALAPPDATA%\kovra\vaults
📦 Packaging	Native installer (.dmg)	MSI installer
🌐 Dashboard (loopback web)	✅	✅
🪟 Native dashboard window	✅ WKWebView	🌐 Browser (no native window)
📍 Menu-bar app (kovra-menulet)	✅	❌ (use kovra ui or the CLI)
🔏 Governed ssh-agent	Unix socket	Named pipe
🛡️ File permissions	POSIX 0600	Owner-only DACL
💉 Wrapper injection	✅	✅
🔢 TOTP · keypairs · cloud providers	✅	✅

macOS-only surfaces

Two surfaces have no Windows equivalent today:

• The menu-bar app (kovra-menulet) — the macOS status-bar app that surfaces pending agent intake requests. On Windows there is no menu-bar app; fulfil requests from the Dashboard or with kovra intake at the terminal instead.
• The native dashboard window — kovra ui --window opens a WKWebView on macOS; on Windows it falls back to your default browser. The loopback Dashboard itself works the same.

Everything else — the vault, sensitivity policy, injection, typed credentials, cloud references, the Dashboard, and the MCP server — behaves the same on both platforms.

See Installation for how to install on each platform.