Skip to content
Kutrion

Get Kutrion

Web app, Kutrion API, Browser extension, macOS and Linux are available from this site today. Every other client is still in development — each one appears here with a real download once it clears store review and signing, and not before.

Available

Web app

Full vault + terminal in your browser

Open app
Available Unsigned build

Kutrion API

Desktop API client that borrows credentials from your vault instead of storing them, so a token never lands in a client config file. Version 1.1.0 for macOS.

Signing:
Unsigned. macOS refuses it on first launch until you clear the quarantine flag.
Runs on:
Apple silicon (arm64) only. It will not run on an Intel Mac.
Updates:
No updater at all. An installed copy never checks for a new version and cannot be corrected remotely — come back here to upgrade.
Download for macOS (Apple silicon)
Opening an unsigned build

This beta is not signed with an Apple Developer ID, so macOS stops it the first time you open it. That is normal for a beta build and takes one extra step.

  1. Drag VaultTerm Relay to your Applications folder.
  2. Clear the download quarantine with the command below, then open VaultTerm Relay normally.
  3. If you would rather not use Terminal: open System Settings, go to Privacy and Security, choose Open Anyway, and confirm.
xattr -d -r com.apple.quarantine "/Applications/VaultTerm Relay.app"

Control-clicking the app and choosing Open will not work. Apple removed that bypass in macOS 15.

Coming soon

Kutrion Transfer

Standalone file transfer client for macOS — dual-pane browsing over SFTP, FTP/FTPS, WebDAV, S3, Azure Blob and Swift, with the credential staying in your vault instead of the client. Built and verified, not yet published.

Notify me when this ships
Available Unsigned build

Browser extension

Autofill and capture for Chrome, Edge and Firefox, version 1.1.0. Neither store carries it, so you load the files below yourself — a developer route rather than a one-click install.

Signing:
Not signed by a browser store. AMO has not signed the .xpi and there is no signed .crx for Chrome, so neither browser takes these as an ordinary add-on.
Runs on:
Any desktop Chrome, Edge or Firefox 128 or newer — the build is not platform-specific. There is no mobile browser build.
Updates:
No auto-update on either browser: the packaged manifest carries no update_url, so a loaded copy stays on this version until you load it again from here.
Download for Chrome and Edge (.zip) Download for Firefox (.xpi, temporary install)
Opening an unsigned build

Neither build is signed by a browser store, so both load as unsigned extensions. Chrome and Edge take the .zip in developer mode and keep it; Firefox takes the .xpi only as a temporary add-on.

  1. Chrome or Edge — the route that lasts: download the .zip, unzip it, open chrome://extensions, turn on Developer mode, choose Load unpacked and select the unzipped folder. It stays installed across restarts.
  2. Firefox — testing only: open about:debugging#/runtime/this-firefox, choose Load Temporary Add-on and select the .xpi. It works immediately and is gone the next time Firefox starts.
  3. Either build talks to this site and no other, so sign in through the extension once it is loaded.
unzip vaultterm-extension.zip -d vaultterm-extension

Release Firefox will not install the .xpi permanently: Gecko refuses an add-on AMO has not signed, and AMO signing is not available to this project. The temporary add-on lasts until Firefox restarts, so Chrome's unpacked load is the durable one.

Available Unsigned build

macOS

Native desktop app, version 1.1.0, for Apple silicon and Intel Macs.

Signing:
Unsigned. macOS refuses it on first launch until you clear the quarantine flag.
Runs on:
Separate Apple silicon (arm64) and Intel (x64) builds — take the one that matches your Mac.
Updates:
No auto-update: macOS will not apply an update to an unsigned app, so an installed copy stays on this version until you come back here.
Download for macOS (Apple silicon) Download for macOS (Intel)
Opening an unsigned build

This beta is not signed with an Apple Developer ID, so macOS stops it the first time you open it. That is normal for a beta build and takes one extra step.

  1. Drag VaultTerm to your Applications folder.
  2. Clear the download quarantine with the command below, then open VaultTerm normally.
  3. If you would rather not use Terminal: open System Settings, go to Privacy and Security, choose Open Anyway, and confirm.
xattr -d -r com.apple.quarantine "/Applications/VaultTerm.app"

Control-clicking the app and choosing Open will not work. Apple removed that bypass in macOS 15.

Coming soon

Windows

Native desktop app. The Windows installer is not built or published yet — there is no latest.yml on the update feed for it.

Notify me when this ships
Available Unsigned build

Linux

Native desktop app, version 1.1.0, as an AppImage or a .deb package.

Signing:
Unsigned, and the .deb is not served from an apt repository — apt will not verify or upgrade it.
Runs on:
x86_64 (amd64) only. There is no 32-bit or ARM Linux build.
Updates:
The AppImage updates itself from this site's feed when it is run as an AppImage. The .deb does not update at all — reinstall from this page.
Download AppImage (x86_64) Download .deb (x86_64)
Opening an unsigned build

Both Linux builds are unsigned, and the .deb is a standalone file rather than an apt repository. Nothing will block you from installing, but apt cannot verify or upgrade it for you.

  1. AppImage: make it executable with the command below, then run it. Without the executable bit a double-click does nothing and reports no error.
  2. Debian or Ubuntu: install the .deb with `sudo apt install ./VaultTerm-1.1.0-amd64.deb` — apt resolves its dependencies, `dpkg -i` alone does not.
chmod +x VaultTerm-1.1.0-x86_64.AppImage
Coming soon

iOS

iPhone & iPad

Notify me when this ships
Coming soon

Android

Phone & tablet

Notify me when this ships
Coming soon

CLI

Scriptable access from the shell: `kt`, version 1.1.0, installed with npm from a tarball rather than a registry. It bakes in no server address, so one build works against any Kutrion deployment. Not released yet — this card becomes a download the day the artifact is published.

Notify me when this ships
Before you install

Installs with npm from the downloaded file. It needs Node 18 or newer, and it has no default server — you tell it which Kutrion deployment to talk to, which is why the same build works against any deployment.

  1. Check your Node version first: `node -v` must report 18 or newer.
  2. Download the tarball, then install it from the folder you saved it in with the command below. The leading ./ is required — without it npm reads the name as a git repository, not a file.
  3. Point it at a server the first time: `kt --base <url> login` remembers that server, or export VT_API_BASE, or pass --base on a single command.
npm i -g ./kutrion-cli-1.1.0.tgz

`npm i -g @kutrion/cli` does not work — the package is not on the public npm registry. The tarball needs no account and pulls in no dependencies.

Coming soon

MCP for AI assistants

Not a separate download. Your AI assistant connects to Kutrion's hosted MCP endpoint, and the local bridge that brokers it ships inside the CLI as `kt mcp` — so it arrives with the CLI. Needs a plan that includes agent access.

Notify me when this ships

Want to see what's shipped lately? Read the changelog.