Command line
Sign in once. Keep your secrets out of the chat.
savctl is a small command-line tool that signs you in to any Savvagent service with your browser. When a service has a secret for you, such as a Savvagent Flags server key, it goes straight to your terminal and never passes through an AI model’s context.
Why a command-line tool
One sign-in, every service
savctl login opens your browser on the usual Savvagent consent screen and remembers the grant on your machine. Every Savvagent service uses the same flow.
Secrets stay out of the chat
Your AI assistant can set things up, but it should never read a server key. savctl prints a secret only to a real terminal, or writes it to a file only you can read, and refuses piped output.
One command, many tools
savctl followed by a service name runs that service’s own tool from your PATH, so a service can add commands without a new install.
Download
Prebuilt binaries are attached to every release, at an address that always points to the latest one.
- Linux x86_64 savctl-x86_64-unknown-linux-musl.tar.gz
- Linux arm64 savctl-aarch64-unknown-linux-musl.tar.gz
- macOS Apple silicon savctl-aarch64-apple-darwin.tar.gz
- macOS Intel savctl-x86_64-apple-darwin.tar.gz
- Windows x86_64 savctl-x86_64-pc-windows-msvc.zip
Checksums file (SHA256SUMS) All releases on GitHub
Prefer to build it yourself? With Rust 1.89 or later:
cargo install --locked --git https://github.com/savvagent/otto-platform ottoctl otto-flags-cli Install
Linux and macOS
Set target to your platform’s name: the part of its archive name between savctl- and .tar.gz. The snippet checks the download against SHA256SUMS before it installs anything.
target=aarch64-apple-darwin
base=https://github.com/savvagent/otto-platform/releases/latest/download
curl -fsSLO "$base/savctl-$target.tar.gz"
curl -fsSLO "$base/SHA256SUMS"
grep " savctl-$target.tar.gz\$" SHA256SUMS | shasum -a 256 -c
tar xzf "savctl-$target.tar.gz"
install -m 0755 "savctl-$target/savctl" "savctl-$target/savctl-flags" ~/.local/bin/ Windows (PowerShell)
Compare the hash it prints with the savctl-x86_64-pc-windows-msvc.zip line in SHA256SUMS, then move savctl.exe and savctl-flags.exe to a directory on your PATH.
$base = "https://github.com/savvagent/otto-platform/releases/latest/download"
Invoke-WebRequest "$base/savctl-x86_64-pc-windows-msvc.zip" -OutFile savctl.zip
Invoke-WebRequest "$base/SHA256SUMS" -OutFile SHA256SUMS
(Get-FileHash savctl.zip -Algorithm SHA256).Hash
Expand-Archive savctl.zip -DestinationPath . The binaries are not code-signed
The checksum shows that an archive is the one the release published, but your operating system may still ask before it runs the tool for the first time.
macOS: a file fetched with curl is not quarantined. If you downloaded it in a browser instead, Gatekeeper blocks it. Clear the flag once:
xattr -d com.apple.quarantine savctl Windows: SmartScreen may warn you the first time. Choose “More info”, then “Run anyway”.
First use
Run savctl login. Your browser opens one consent screen that lists every Savvagent service, and you choose which ones to sign in to. Each grant is saved on your machine.
savctl login Or sign in to one service only:
savctl login --resource https://otto-tower.savvagent.com/mcp savctl login --resource https://otto-flags.savvagent.com/mcp savctl login --resource https://otto-cxp.savvagent.com/mcp Read the full documentation
Where credentials are stored, how subcommands work and how secrets are delivered. savctl.md on GitHub