One binary per platform. Free on every plan, including Free — the client itself costs nothing, and only the scripts you run against it spend queries.
| Platform | File | ||
|---|---|---|---|
Windows |
ocaltql-client.exe | ||
|
3f0dd30479a1a6ae046e0fa6e949467851db24eaac5a76279798a02bb7271f78
| |||
macOS |
|||
Linux (Debian/Ubuntu) |
ocaltql-client.deb | ||
|
344fdee5c944109152b9741ab99304b1ee7acf58a3c50c3982a61ca8ff9e8bd5
| |||
Linux (Fedora/RHEL) |
ocaltql-client.rpm | ||
|
7748467fe08534be87cf049f91909b00274b21c7dc683b6776849927618776bf
| |||
Linux (portable) |
ocaltql-client.AppImage | ||
|
b549d52c341448faf6d0adf3ab13e5057700edd27937092d2e5574045ce6e8f6
| |||
FreeBSD |
|||
Android |
ocaltql-client.apk | ||
|
06281cbe7684a15fb152bb93070758931282b7549727ece1cafff795c92e8c90
| |||
ChromeOS |
ocaltql-client.deb | ||
|
344fdee5c944109152b9741ab99304b1ee7acf58a3c50c3982a61ca8ff9e8bd5
| |||
The client is shipped unsigned. Code-signing certificates are issued per vendor and tie a binary to a commercial identity; the agent is deliberately distributed without one, so every operating system warns you the first time you run it. The warnings are about the absence of a certificate, not about the file. Each is cleared in a few seconds.
Windows Defender SmartScreen blocks unrecognised applications with a blue dialog reading “Windows protected your PC”. There is no Run button visible — it is behind a link.
In the blue dialog. The text expands to name the application.
The button only appears once More info has been expanded.
If the browser blocked the download rather than the launch, open the browser’s downloads list and choose Keep on the file. Where the file is already saved, right-click it, choose Properties, tick Unblock at the bottom of the General tab, and click OK — that clears the mark-of-the-web and SmartScreen will not ask again.
Downloading a file does not make it runnable. The .deb and .rpm packages set their own permissions when installed, but the universal AppImage and the raw binaries have to be marked executable first.
chmod +x adds the execute bit to a file you own. Without it the shell reports Permission denied even though the file downloaded correctly. The same applies to the FreeBSD binary: chmod +x ocaltql-client-freebsd before running it.
Enable the Linux environment in ChromeOS settings, then install the .deb exactly as on Debian.
Allow installation from unknown sources for your browser, then open the APK. Android will warn that the app was not installed from the Play Store — that is the same unsigned-build warning in another form.
The Android build runs the agent as a foreground service and opens the console alongside it, so a phone or tablet is both a machine you can address and a place to drive your namespace from you reach with DIRECTIVE. EXEC, DOWNLOAD, UPLOAD and SERVE all work — a compute node with no static IP and no open ports.
The Android build is the whole client, not a lesser one. It registers as a machine, runs commands, serves files, tunnels, captures the screen and drives input — everything the desktop builds do.
The current build ships arm64-v8a. A 32-bit armeabi-v7a device reports “App not installed” part-way through. Almost every phone from 2018 onward is arm64.
Compare against the SHA-256 published in the table above.
The agent opens its own interface at localhost:12345. Enter four things and it is live.
Your Ocalt username, email or phone.
From your account dashboard. Rotatable at any time without touching your password.
Whatever you want to call this machine. This is the name scripts use: DIRECTIVE "alias" ...
The folder the agent may read and write, and the document root if you turn on the local server.