Installation

macOS

brew install opaquevault-brew/tap/ov

Linux

curl -fsSL https://get.opaquevault.com | sh

The script installs to /usr/local/bin/ov if writable (root or sudo), otherwise to ~/.local/bin/ov. If ~/.local/bin is used, the installer adds the PATH export to ~/.bashrc, ~/.zshrc, or ~/.profile automatically.

After installing, run the command the installer prints:

source ~/.bashrc   # or ~/.zshrc / ~/.profile depending on your shell

Verify

ov --version

Shell completion

# bash
ov completion bash >> ~/.bashrc

# zsh
ov completion zsh >> ~/.zshrc

# fish
ov completion fish > ~/.config/fish/completions/ov.fish

Updating

brew upgrade ov        # macOS
ov update              # Linux self-update

Troubleshooting

PATH shadowing — ov --version reports the wrong version

If ov --version reports an older version than the one you just installed, another ov binary on your PATH is shadowing the new install. Common causes: a previous install at /usr/local/bin/ov (planted with sudo) shadows a fresh non-root install at ~/.local/bin/ov, or vice-versa.

The installer detects this and exits non-zero with a remediation hint, but if you missed the message, diagnose with:

type -a ov
# ov is /usr/local/bin/ov
# ov is /home/you/.local/bin/ov

The first line wins. Fix by removing or overwriting the shadowing binary — substitute the actual paths from your type -a ov output, do not blindly copy the example below:

# Replace /usr/local/bin/ov with the actual path from `type -a ov` line 1.
sudo rm /usr/local/bin/ov
# …then verify:
type -a ov
ov --version

hash -r does not fix this — it only clears bash’s command cache. Real PATH shadowing requires removing or replacing the shadowing binary.

Windows

The CLI (ov auth, ov secret, ov run, ov scan) runs natively on Windows 10 and Windows 11. For Claude Code and Cursor MCP integration, use WSL2 today — native Windows MCP support is in development (OV-59).

Install via PowerShell (recommended)

iwr -useb get.opaquevault.com/install.ps1 | iex

Installs to %LOCALAPPDATA%\Programs\ov\ov.exe and adds it to your user PATH. No admin required. SHA-256 verified.

Install via Scoop

scoop bucket add opaquevault https://github.com/opaquevault-scoop/scoop-bucket
scoop install ov

Verify

ov --version

Open a new terminal after install to pick up the updated PATH.

What works on Windows today

• ov auth login — authenticate
• ov app / ov env — app and environment management
• ov secret set / get / list / delete — secret management
• ov secret import — import from .env, 1Password exports, etc.
• ov run --secrets NAME -- command — inject secrets into a subprocess
• ov scan — scan files or git history for leaked secrets
• ov init — write AI-agent rules to config files

What’s in development

• ov agent — background daemon for non-interactive secret injection. Today this is Linux + macOS only. Windows port tracked in OV-59.
• ov mcp serve — MCP bridge for Claude Code / Cursor. Uses the agent; Windows port ships with OV-59.

Windows MCP support (interim: WSL2)

Until OV-59 lands, Claude Code and Cursor MCP integration on Windows works via WSL2:

1. Install WSL2 (one-time): wsl --install
2. Inside WSL2: curl -fsSL https://get.opaquevault.com | sh
3. Claude Code on Windows can connect to WSL2 MCP servers via localhost — no other config needed.

Uninstall

Remove-Item -Recurse -Force "$env:LOCALAPPDATA\Programs\ov"

Then open System Properties → Environment Variables and remove the %LOCALAPPDATA%\Programs\ov entry from your user PATH.