Desktop App Guide

The Nocarta Desktop app runs the work that must happen on your machine: browser automations and document interpretation on your own local or vault-protected LLMs.

Why Desktop?

Automation uses Playwright to control a real browser, and local-LLM interpretation needs to reach endpoints only your machine can see. These must run on your desktop for:

Security: Tier 2 credentials stay on your device; Tier 1 credentials are fetched securely for automation
Visibility: Watch automation in real-time
Reliability: No server timeout limits
Access: Automate sites that block server IPs; call localhost LLMs (Ollama, local vLLM) the server can never reach

Installation

macOS

Download the DMG from /downloads
Open the DMG file
Drag Nocarta to Applications
First launch: Right-click → Open (to bypass Gatekeeper)

Windows

Download the installer from /downloads
Run the NSIS installer
Follow the installation wizard
Launch from Start Menu

Linux

Download AppImage or .deb from /downloads
For AppImage: chmod +x nocarta-linux-<version>.AppImage && ./nocarta-linux-<version>.AppImage
For .deb: sudo dpkg -i nocarta.deb

First Launch

Open Nocarta Desktop
The app connects to your Nocarta web account
Sign in with your existing credentials (passkey or magic link)
Your automations and secrets sync automatically

Features

Automation Execution

Run automations with live browser view
See each step execute in real-time
Automatic screenshot capture
Pause/resume/retry capabilities

Secret Injection

Tier 1 and Tier 2 secrets work seamlessly
Credentials injected locally, never sent to server during execution
Master password prompt for Tier 2 secrets

Mobile Dispatch

Start automations from your phone
Execution happens on your desktop
Notifications when complete

LLM Worker — run document interpretation on your own LLM

When a scan area or bulk fill is bound to one of your own LLM configurations — a local Ollama/vLLM or a cloud provider, whatever the key tier — the interpretation is queued and the desktop app executes it. Nocarta's servers never call your endpoint:

Trigger work from any browser; jobs wait durably until the desktop is open
Consent first: jobs queued while the desktop was offline never run silently — at app open a dialog details each waiting job (template, scan area, instance, dispatch source, target LLM, queue time) before anything executes
Jobs drain in parallel (2 at a time); results land back on the instances with provenance ("interpreted by your LLM, on your desktop")
Watch and cancel jobs in Settings → Preferences → LLM Configuration — the queue panel works from any device
Vault-protected (Tier 2) keys are decrypted only on this machine; if the vault is locked, jobs wait without penalty
Crash-safe: interrupted jobs are re-queued and retried; navigating around the app never loses work

See AI Assistant & LLM Configuration for the routing rules and privacy options.

Running the desktop app as a service on your own machine

Remote runs — scripts and automations started from a browser, an assistant or the API — land, by default, on your connected desktop app, and on a Nocarta Runner (a temporary machine Nocarta starts for you) only when none is connected. If you would rather have them land on a machine you control — with the tools you choose, no 30-minute limit, and your vault available — run the desktop app there as a service:

Install the desktop app on a machine you control — a spare computer or a VM — and install anything your scripts need (Python packages, other runtimes, …).
Get a login token. Request a sign-in link by email; the email shows the token. It is valid for 30 minutes and used once.
Start the app in service mode with that token. It signs in, stays signed in and ready, and needs nobody at the keyboard:

NOCARTA_LOGIN_TOKEN=<token> nocartaclient --service --enable-desktop-execution --enable-browser-dispatch

--service — unattended mode: the app keeps running, reconnects on its own and never quits by itself.
--enable-desktop-execution and --enable-browser-dispatch — turn on the two remote-execution settings of your account at start, since nobody is there to tick them. Both must be on for remote runs to reach this machine; you can leave them out if they are already on in your Settings.
NOCARTA_VAULT_PASSWORD — optional. Set it to your master password to unlock the vault at start, so scripts and automations that use Tier 2 (master-password) secrets can run here. It is read once and removed from the environment. Without it the vault stays locked and Tier 2 secrets cannot be used on this machine.

nocartaclient is the executable name on Linux; on another system use the app's executable. While a script runs there, nothing else is dispatched to your account.

Once the app has connected, this machine appears under Settings → Profile and Connections → Where my automations and scripts run, in the list of your machines, marked Service mode. There you can rename it and choose This machine: name, so your remote runs go to this machine only — even while the desktop app is open on another computer, and never to a Nocarta Runner. You can also choose it for a single script, or for one run in the Run dialog. If the machine is chosen but not connected, runs aimed at it are refused with a message that names it. With Automatic (the default), whichever desktop app of yours is connected takes the run. See the Scripts Guide for time limits and what a Nocarta Runner offers.

Keeping the App Updated

The desktop app never updates itself. To get a newer version:

Open the Advanced menu and choose Check for Updates…
If a newer version exists, the download page opens in your browser
Download and install it, then restart the app

A machine running the app in service mode is updated the same way, by installing the new version there.

Troubleshooting

Issue	Solution
App won't connect	Check internet connection, try logout/login
Automations don't appear	Ensure you're logged into the same account
Browser doesn't launch	Reinstall app to restore bundled browser
Execution hangs	Check if site requires manual CAPTCHA