Command line
Sign in once. Keep your secrets out of the chat.
ottoctl is a small command-line tool that signs you in to any Otto service with your browser. When a service has a secret for you, such as an Otto Flags server key, it goes straight to your terminal and never passes through an AI model’s context.
Why a command-line tool
One sign-in, every service
ottoctl login opens your browser on the usual Otto consent screen and remembers the grant on your machine. Every Otto service uses the same flow.
Secrets stay out of the chat
Your AI assistant can set things up, but it should never read a server key. ottoctl prints a secret only to a real terminal, or writes it to a file only you can read, and refuses piped output.
One command, many tools
ottoctl followed by a service name runs that service’s own tool from your PATH, so a service can add commands without a new install.
Download
Prebuilt binaries are attached to every release, at an address that always points to the latest one.
- Linux x86_64 ottoctl-x86_64-unknown-linux-musl.tar.gz
- Linux arm64 ottoctl-aarch64-unknown-linux-musl.tar.gz
- macOS Apple silicon ottoctl-aarch64-apple-darwin.tar.gz
- macOS Intel ottoctl-x86_64-apple-darwin.tar.gz
- Windows x86_64 ottoctl-x86_64-pc-windows-msvc.zip
Checksums file (SHA256SUMS) All releases on GitHub
Prefer to build it yourself? With Rust 1.89 or later:
cargo install --locked --git https://github.com/savvagent/otto-platform ottoctl otto-flags-cli Install
Linux and macOS
Set target to your platform’s name: the part of its archive name between ottoctl- and .tar.gz. The snippet checks the download against SHA256SUMS before it installs anything.
target=aarch64-apple-darwin
base=https://github.com/savvagent/otto-platform/releases/latest/download
curl -fsSLO "$base/ottoctl-$target.tar.gz"
curl -fsSLO "$base/SHA256SUMS"
grep " ottoctl-$target.tar.gz\$" SHA256SUMS | shasum -a 256 -c
tar xzf "ottoctl-$target.tar.gz"
install -m 0755 "ottoctl-$target/ottoctl" "ottoctl-$target/otto-flags" ~/.local/bin/ Windows (PowerShell)
Compare the hash it prints with the ottoctl-x86_64-pc-windows-msvc.zip line in SHA256SUMS, then move ottoctl.exe and otto-flags.exe to a directory on your PATH.
$base = "https://github.com/savvagent/otto-platform/releases/latest/download"
Invoke-WebRequest "$base/ottoctl-x86_64-pc-windows-msvc.zip" -OutFile ottoctl.zip
Invoke-WebRequest "$base/SHA256SUMS" -OutFile SHA256SUMS
(Get-FileHash ottoctl.zip -Algorithm SHA256).Hash
Expand-Archive ottoctl.zip -DestinationPath . The binaries are not code-signed
The checksum shows that an archive is the one the release published, but your operating system may still ask before it runs the tool for the first time.
macOS: a file fetched with curl is not quarantined. If you downloaded it in a browser instead, Gatekeeper blocks it. Clear the flag once:
xattr -d com.apple.quarantine ottoctl Windows: SmartScreen may warn you the first time. Choose “More info”, then “Run anyway”.
First use
Sign in to a service by giving ottoctl its MCP address. Your browser opens the consent screen, and the grant is saved for that service only.
ottoctl login --resource <service MCP URL> Or copy the command for one of ours:
ottoctl login --resource https://otto-tower.savvagent.com/mcp ottoctl login --resource https://otto-flags.savvagent.com/mcp ottoctl login --resource https://otto-cxp.savvagent.com/mcp Read the full documentation
Where credentials are stored, how subcommands work and how secrets are delivered. ottoctl.md on GitHub