Osaurus is a macOS harness for AI agents, written in Swift for Apple Silicon (macOS 15.5 or later). It sits between you and a model, local or cloud, and keeps the layer around the model on your machine: agents, memory, tools, and identity. It works fully offline with local models and can connect to cloud providers when you choose.
Agents are the core unit. Each custom agent has its own prompts, memory, and theme, and tools and skills are selected per task by RAG search. A custom agent runs an agent loop: given a working folder it gets file, search, and git tools, and with the sandbox enabled it gets shell access in an isolated Linux VM built on Apple's Containerization framework (macOS 26 or later; earlier versions fall back to a Seatbelt sandbox under sandbox-exec). The built-in Orchestrator answers questions about the app, applies settings changes after you approve them, and delegates bounded tasks to custom agents and models as subagents, but has no working folder, sandbox, browser, or computer use of its own.
Memory has three layers (identity, pinned facts, and per-session episodes) plus a transcript fallback. Conversations are distilled once at session end and scored by salience, and a background consolidator decays, merges, and evicts entries; most turns inject about 800 tokens or fewer. Every human, agent, and device gets a secp256k1 address, authority derives from a master key in iCloud Keychain, and scoped osk-v1 access keys can be revoked at any time. Agent-to-agent conversations over LAN or the relay are end-to-end encrypted with an X25519 handshake and ChaCha20-Poly1305.
Local inference runs on MLX (Gemma, Qwen, GPT-OSS, Llama, and others, with a curated quantization library on Hugging Face), alongside Liquid AI LFM models and Apple Foundation Models on macOS 26 or later. Cloud providers include OpenAI, Anthropic, Gemini, xAI, Venice AI, OpenRouter, Ollama, LM Studio, and the hosted Osaurus Router. Context and memory persist across providers.
Features
- Compatible APIs: OpenAI (/v1/chat/completions), Anthropic (/anthropic/v1/messages), and Ollama (/api/chat) endpoints on port 1337, with streaming tool-call deltas; POST /agents/{id}/run drives server-side autonomous loops
- MCP server and client: osaurus mcp exposes local tools to any MCP client over stdio, and the app aggregates tools from about 25 remote HTTP/SSE MCP providers with OAuth 2.1 and dynamic client registration
- Privacy filter: an on-device classifier plus regex rules detect names, emails, secrets, and custom patterns before a cloud send, swap them for stable placeholders, and block the send if the post-scrub scan still finds a leak
- Relay: agents are reachable through secure WebSocket tunnels at agent.osaurus.ai with a URL derived from their crypto address, without port forwarding
- Browser use: a per-agent WebKit session that navigates, reads, clicks, and types, pausing for approval on consequential actions; sign-ins happen in a window the agent cannot see
- Image generation: local image models (z-image-turbo, FLUX, Qwen-Image, Ideogram) generate or edit images from a prompt, including inline from chat
- Plugins and skills: native plugins (Mail, Calendar, Vision, XLSX, PPTX, Git, and more) with a v3 host API, plus skills compatible with Agent Skills and importable Claude plugins
- Automation and voice: scheduled tasks, folder watchers, on-device transcription with wake-word activation, and system-wide App Intents for Shortcuts, Spotlight, and Siri
- Developer tools: server explorer, MCP tool inspector, inference monitoring, and plugin debugging
