# Install osctrl-cli with Homebrew Fast and efficient osquery management. Version 0.5.4 via Homebrew; verified 2026-07-07. ## Install ```sh sudo av install brew:osctrl-cli ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install osctrl-cli ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:osctrl-cli - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.5.4 - **Source summary:** Fast and efficient osquery management - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** MIT - **Source archive:** - **Last updated:** 2026-07-07T16:38:23Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - osctrl-cli (cli) - osctrl-cli (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.5.4 - Package-manager updated: 2026-07-07 - Local data: ok - Upstream repository: https://github.com/jmpsec/osctrl - Upstream latest detected: v0.5.4 (current) ## Project history and usage osctrl-cli is the operator CLI for osctrl, a Go-based osquery management platform. osctrl implements osquery's remote API as a TLS endpoint and includes services for enrollment, configuration distribution, log collection, on-demand queries, file carving, an API, web UI, and CLI automation. ### Project history GitHub records jmpsec/osctrl as created on 2018-12-17. The project grew as a fleet-management layer for osquery, with osctrl-cli living alongside osctrl-tls, osctrl-admin, and osctrl-api as one of the built components. Release notes show continued operational hardening: v0.4.9 introduced a breaking move to a single YAML configuration file, v0.5.0 included osctrl-cli and API fixes plus security policy work, and v0.5.3 shipped osctrl-cli binary packages among its release assets. The README also labels the old server-rendered osctrl-admin interface as legacy and presents the newer frontend as the primary operator UI. ### Adoption history The README says osctrl is used in production environments while still under active development, and claims scalability from hundreds to hundreds of thousands of nodes. Public evidence points to a specialized endpoint-security audience rather than mass-market adoption: osquery operators, incident-response teams, and security engineers who need fleet visibility and remote querying. ### How it is used The osctrl-cli documentation says its purpose is to execute actions in osctrl without directly accessing the backend or using the admin interface, making it useful for scripts and automation. In the repository architecture, operators and automation can talk through osctrl-cli to the API, while some modes can work directly with the database. Operators use the broader osctrl system to enroll osquery agents, distribute configuration, collect status and result logs, run on-demand queries, and carve files. osctrl-cli is the package-friendly command-line entry point for those actions. ### Why package nerds care osctrl-cli matters because it packages a security-operations control plane into installable binaries and Debian packages. For package nerds, it is a reminder that some CLIs are not standalone products; they are automation handles for a larger service suite with databases, TLS endpoints, log sinks, and web frontends. ### Timeline - 2018-12-17: GitHub repository created. - 2025-12-24: v0.4.9 release introduced a breaking single-YAML configuration change. - 2026-02-24: v0.5.0 release included osctrl-cli/API fixes and security policy work. - 2026-06-12: v0.5.3 release published osctrl-cli Debian package assets for Linux amd64 and arm64. ### Related projects - osquery is the endpoint agent and query engine that osctrl manages. osctrl-tls implements the remote API endpoint, osctrl-api exposes REST automation, osctrl-admin and the frontend provide UI surfaces, and osctrl-cli is the command-line automation surface. ### Sources - - - - - - - - ## Security Notes No matching local secret-handling manifest was found for osctrl-cli. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: osctrl-api.json ## Credential files - Unix: osctrl-api.json ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** osctrl-cli - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [aide](https://www.automicvault.com/pkg/brew/aide/) - Shares av.db curated category or tags: cli, monitoring, security. - [bettercap](https://www.automicvault.com/pkg/brew/bettercap/) - Shares av.db curated category or tags: cli, monitoring, security. - [kekkai](https://www.automicvault.com/pkg/brew/kekkai/) - Shares av.db curated category or tags: cli, monitoring, security. - [logcheck](https://www.automicvault.com/pkg/brew/logcheck/) - Shares av.db curated category or tags: cli, monitoring, security. - [acme.sh](https://www.automicvault.com/pkg/brew/acme-sh/) - Shares av.db curated category or tags: cli, security. - [aescrypt](https://www.automicvault.com/pkg/brew/aescrypt/) - Shares av.db curated category or tags: cli, security. - [aespipe](https://www.automicvault.com/pkg/brew/aespipe/) - Shares av.db curated category or tags: cli, security. - [afflib](https://www.automicvault.com/pkg/brew/afflib/) - Shares av.db curated category or tags: cli, security. ## Combined YAML source View the package source record on GitHub. [combined/osctrl-cli.yml](https://github.com/automic-vault/db/blob/main/combined/osctrl-cli.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph