Osaurus is a native macOS harness for AI agents, written in Swift for Apple Silicon. It sits between the user and any model, local or cloud, and keeps the layer around the model on the Mac: agents with their own prompts, memory and themes, tools, skills and a cryptographic identity. It works fully offline with local models, and nothing leaves the machine unless the user connects a cloud provider.
Custom agents run an agent loop: given a working folder they get file, search and git tools, and with the sandbox on they get shell access in an isolated Linux VM built on Apple's Containerization framework (or a macOS Seatbelt sandbox on older systems). The model writes a todo list, works through it, and closes with a verified summary. A built-in Orchestrator answers questions from live app state, applies setting changes after approval, and delegates bounded tasks to custom agents or other local and cloud models as subagents within set budgets. Tools and skills are selected per task by RAG search rather than manual configuration.
Memory has three layers (identity, pinned facts and per-session episodes) plus a transcript fallback. Conversations are distilled once at session end, scored by salience, and surfaced as at most one compact slice per request, while a background consolidator decays, merges and evicts entries. When a message goes to a cloud model, an on-device privacy filter detects names, emails, addresses, account numbers and secrets, swaps approved entities for placeholders, and blocks the send if anything leaks past the scrub.
Local inference runs Gemma, Qwen, GPT-OSS, Llama, Liquid foundation models and Apple's on-device foundation model through MLX. Cloud providers include OpenAI, Anthropic, Gemini, xAI, Venice AI, OpenRouter, Ollama, LM Studio and the hosted Osaurus Router. Osaurus also serves OpenAI-, Anthropic- and Ollama-compatible endpoints with streaming tool calls, acts as an MCP server for other clients, and aggregates tools from remote MCP providers as a client.
Features
- Agent loop: per-agent working folders with file, search and git tools, a todo list the model executes against, and a verified closing summary
- Sandbox: an isolated Alpine Linux VM per agent through Apple's Containerization framework, with its own Linux user and a bridge back to inference, memory and secrets
- Orchestrator and subagents: a default agent that answers from live app state, applies approved setting changes, and spawns custom agents or other models in parallel within budgets
- Memory: identity, pinned facts and per-session episodes, distilled at session end and consolidated in the background, with most turns injecting few or no tokens
- Privacy filter: an on-device classifier plus regex rules scrub personal data before a cloud send, with a review sheet and fail-closed blocking
- Cryptographic identity: secp256k1 addresses for humans, agents and devices, a chain of trust from a master key, and scoped, revocable access keys
- Relay and secure channel: per-agent public URLs over WebSocket tunnels and end-to-end encrypted agent-to-agent conversations
- Browser use: a per-agent WebKit session that navigates, reads, clicks and types, with approval before consequential actions
- MCP server and client: exposes Osaurus tools to MCP clients and connects to about 25 remote MCP providers such as Linear, Notion, GitHub, Supabase and Stripe
- Apple apps and plugins: native Calendar, Reminders, Contacts, Notes, Mail, Messages, Maps, Music and Shortcuts tools, plus plugins for Vision, XLSX, PPTX, Telegram and more
- Skills, methods and automation: Agent Skills and Claude plugin import, learned reusable workflows, scheduled tasks, folder watchers and on-device voice input
- Compatible APIs: OpenAI, Anthropic and Ollama-compatible chat endpoints with streaming tool call deltas, plus an agent-run endpoint for server-side loops
