Installation

kovra is one installer:

• kovra — the command line and the local vault (this is the core tool).
• kovra mcp — the MCP server that exposes kovra to AI agents over MCP, built into the same kovra command. You only need it to use kovra from Claude Code (or another MCP client).

Platform support

kovra 0.12.1 ships for macOS — native Touch ID and Keychain integration. Windows returns when its approvals go through Windows Hello with no file-based path an agent could use; Linux is on the roadmap. See Platform support for the feature matrix.

Install the CLI

macOS

Download kovra for macOS (.dmg), open it, and drag kovra.app into Applications. The app is signed by Kaeus and notarized by Apple, so it opens like any other app. It sets up its own vault on first run — no extra setup. The kovra CLI ships inside the app.

On first launch, kovra offers to install the command line tool: it creates /usr/local/bin/kovra, pointing into the app, and macOS asks for an administrator’s password. Claude Code and your terminal need kovra on the PATH — kovra setup, the MCP server and the credential gate’s hooks all run it. If you choose Not Now, install it later from the menu-bar icon: Install Command Line Tool….

Windows

A Windows build is coming soon — see Platform support.

Linux

A Linux build is coming soon.

The MCP server

The MCP server lets an AI agent see scoped metadata and run commands through kovra’s wrapper, without ever receiving the plaintext of your sensitive secrets. It is part of the kovra command: kovra mcp. Nothing else to install — no Python, no extra package.

You won’t run kovra mcp by hand — it’s an MCP stdio server that your agent launches. kovra setup registers it for your project.

Next

Head to the Quick start to initialize your vault, store your first secret, and inject it into a process.