OcaltQL Client

Your machines,
addressable.

A small agent that registers a computer with your Ocalt account and gives it a name. From then on, any OcaltQL script can address it — run a command, move a file, open a tunnel, take a screenshot, serve a folder — whether it sits behind a home router, a phone network, or a corporate firewall.

Download Read the docs

Windows · Linux · Android · free on every plan

What it does

One agent, the whole verb set.

Nothing is installed beyond the agent itself. It holds an outbound connection to Ocalt and does what your scripts ask of it.

Remote shell

EXEC runs a command and hands back stdout, stderr and the exit code. KILL stops one that is still running.

Files both ways

UPLOAD, DOWNLOAD, READ, WRITE, and LIST FROM to browse the machine's folders and drives.

Tunnels

Expose a local port at a public HTTPS URL. No static IP, no port forwarding, no router configuration.

Serve a file

SERVE puts one file behind a public URL with its extension intact, straight off the machine's disk.

Screen and input

SCREENSHOT, VIEW, SCREEN for display geometry, and mouse, keyboard and pointer control.

A local server

Point it at a folder and a port, and the machine serves that folder as a site — .oql files still execute on Ocalt.

Setup

Three steps.

1

Install and run

One binary. It opens its own interface at localhost:12345.

2

Enter your identity and a machine alias

Your Ocalt identity and API key, plus whatever you want to call this machine. The alias is the name your scripts will use.

3

Address it from anywhere

Any OcaltQL script on your account can now reach it — from the console, a scheduled job, or a site you host.

DIRECTIVE "home-nas" EXEC "uptime" SET ?out AFTER EMIT ?out("stdout") AFTER DIRECTIVE "home-nas" TUNNEL PORT 3000 SET ?tunnel AFTER EMIT ?tunnel("url") AFTER DIRECTIVE "home-nas" LIST DRIVES SET ?drives AFTER EMIT ?drives
How it connects

Outbound only.

The agent dials out to Ocalt and holds the connection. Nothing listens on a public port, nothing needs forwarding, and no inbound firewall rule is required. A machine on a phone tether is as reachable as one in a rack.

Your account only

A machine is bound to the Ocalt account whose credentials it holds. No other account can address it.

4,096 machines

The same on every plan, including Free. Register as many as you have.

One second

Commands reach the machine within a second by default, adjustable per machine up to sixty minutes.