osaurus
Own your AI. The native macOS harness for AI agents -- any model, persistent memory, autonomous execution, cryptographic identity. Built in Swift. Fully offline. Open source.
Install / Use
claude mcp add osaurus-ai -- npx -y github:osaurus-ai/osaurusIf the server publishes to npm under a different name, use that package instead — check the repo README.
MCP Server
Model Context Protocol server
Quality Score
Category
AI & Machine LearningSupported Platforms
Tags
Skill content
View source on GitHubInference is all you need. Everything else can be owned by you.
Models are getting cheaper and more interchangeable by the day. What's irreplaceable is the layer around them -- your context, your memory, your tools, your identity. Others keep that layer on their servers. Osaurus keeps it on your machine.
Osaurus is the AI harness for macOS. It sits between you and any model -- local or cloud -- and provides the continuity that makes AI personal: agents that remember, execute autonomously, run real code, and stay reachable from anywhere. The models are interchangeable. The harness is what compounds.
Works fully offline with local models. Connect to any cloud provider when you want more power. Nothing leaves your Mac unless you choose.
Native Swift on Apple Silicon. No Electron. No compromises. MIT licensed.
Install
brew install --cask osaurus
Or download the latest .dmg from Releases. After installing, launch from Spotlight (⌘ Space → "Osaurus") or the CLI:
osaurus ui # Open the chat UI
osaurus serve # Start the server
osaurus status # Check status
Requires macOS 15.5+ and Apple Silicon.
Agents
Agents are the core of Osaurus. Each one gets its own prompts, memory, and visual theme -- a research assistant, a coding partner, a file organizer, whatever you need. Tools and skills are automatically selected via RAG search based on the task at hand -- no manual configuration needed. Everything else in the harness exists to make agents smarter, faster, and more capable over time.
Agents can also opt into a private local database and a single self-scheduled next run -- see Agent DB & Self-Scheduling. Local storage is plaintext by default (protected by FileVault) with opt-in SQLCipher encryption -- see Storage.
Agent Loop
Every chat is an agent loop. Pick a working folder and the agent gets file, search, and git tools. Toggle the sandbox and it gets shell access in an isolated sandbox. The model writes a markdown todo list, executes against it, and closes out with a verified summary -- all in the same chat window. See the Agent Loop Guide.
Sandbox
Agents execute code in an isolated Linux VM powered by Apple's Containerization framework. Full dev environment -- shell, Python, Node.js, compilers, package managers -- with zero risk to your Mac.
Each agent gets its own Linux user and home directory. The VM connects back to Osaurus (inference, memory, secrets) via a vsock bridge -- sandboxed but not disconnected. Extend with simple JSON plugin recipes, no Xcode or code signing required.
┌────────────────┐ ┌────────────────────────────┐
│ Osaurus │ │ Linux VM (Alpine) │
│ │ │ │
│ Sandbox Mgr ──┼───────┤→ /workspace (VirtioFS) │
│ Host API ←──┼─vsock─┤→ osaurus-host bridge │
│ │ │ │
│ │ │ agent-alice (Linux user) │
│ │ │ agent-bob (Linux user) │
└────────────────┘ └────────────────────────────┘
The Linux VM requires macOS 26+ (Tahoe). On earlier versions Osaurus falls back to a native macOS Seatbelt sandbox: commands run on your Mac under
sandbox-execconfinement, with writes limited to the sandbox workspace,pip/npminstalls (noapk), and all-or-nothing network access instead of per-domain allowlists. See the Sandbox Guide for configuration, built-in tools, and plugin authoring.
Memory
Three layers -- identity, pinned facts, and per-session episodes -- plus a transcript fallback. Agents distill conversations once at session end (not on every turn), score what matters by salience, and surface at most one compact slice per request based on what you're actually asking. A background consolidator decays, merges, and evicts so memory stays sharp instead of bloating. Most turns inject ~800 tokens or less; many inject zero. See the Memory Guide.
Privacy Filter
When you send to a cloud model, an on-device classifier — OpenAI's openai/privacy-filter (Apache-2.0, 1.5B params / 50M active sparse-MoE), served via the MLX conversion mlx-community/openai-privacy-filter-bf16 (~2.8 GB) — detects names, emails, phones, URLs, addresses, dates, account numbers, and free-form secrets, alongside deterministic regex for SSN, credit cards, IBAN, AWS keys, GitHub tokens, and your own custom patterns. Each detection is shown in a review sheet with a scrubbed preview before sending; approved entities are swapped for stable [PERSON_1] / [EMAIL_2] placeholders, and streaming replies are unscrubbed back on the fly so the chat reads naturally. Fail-closed: if the post-scrub scan finds anything that leaked, the send is blocked. Verify wire-level redaction in the Insights panel — it captures the exact bytes the cloud saw. See the Privacy Filter Guide.
Identity
Every participant -- human, agent, device -- gets a secp256k1 cryptographic address. Authority flows from your master key (iCloud Keychain) down to each agent in a verifiable chain of trust. Create portable access keys (osk-v1), scope per-agent, revoke anytime. See Identity docs.
Relay
Expose agents to the internet via secure WebSocket tunnels through agent.osaurus.ai. Unique URL per agent based on its crypto address. No port forwarding, no ngrok, no configuration.
Secure Channel
When two Osaurus agents talk -- across your LAN or across the world through the relay -- the conversation is end-to-end encrypted: a forward-secret X25519 handshake authenticated by each agent's crypto identity, with every request, streamed token, and access key sealed in ChaCha20-Poly1305. The relay becomes a blind pipe that forwards ciphertext it cannot open; a man-in-the-middle cannot complete a handshake; replayed or truncated traffic is detected and refused; and there is no plaintext fallback an attacker can force. Zero configuration -- pairing is all it takes. See the Secure Channel docs.
Subagents (Spawn)
Let a chat delegate a bounded task to another model -- local or remote -- or to one of your saved agents, and get a compact result back without cluttering the conversation. Perfect for offloading research, coding, or analysis to a specialist mid-turn. When the subagent runs on a local model, Osaurus does a single-residency handoff: it unloads your chat model, runs the job, then reloads and continues, so two large models never fight for memory. Off by default, approved on first use, and configured per agent.
Browser Use
Give an agent its own browser. browser_use runs a self-contained subagent that navigates, reads pages, clicks, types, and verifies each step against a persistent per-agent WebKit session — cookies and sign-ins survive between chats, isolated from other agents and your regular browser. Reads and navigation run automatically; typing and anything consequential pause for your approval, and sign-ins happen in a secure window you type into directly (agents never see credentials). Off by default, enabled per agent, sessions managed in Settings → Browser. See the Browser Use Guide.
Image Generation
Create images on your Mac, fully offline. Install a local image model -- z-image-turbo, FLUX, Qwen-Image, or Ideogram -- and generate from a text prompt with control over size, seed, and negative prompts; hand it a source image to edit instead of starting from scratch. Your chat model can also call the built-in image tool to generate or edit a picture and render it inline in the conversation. Nothing is sent to a server.
Models
The harness is model-agnostic. Swap freely -- your agents, memory, and tools stay intact.
Local
Run Gemma 4, Qwen3.6, GPT-OSS, Llama, and more on Apple Silicon with optimized MLX inference. Osaurus maintains its own optimized model library on Hugging Face with curated quantizations for the best quality-to-size ratio on Apple Silicon. Models stored at ~/MLXModels (override with OSU_MODELS_DIR). Fully private, fully offline.
Liquid Foundation Models
Osaurus supports Liquid AI's LFM family -- on-device models built on a non-transformer architecture optimized for edge deployment. Fast decode, low memory footprint, and strong tool calling out of the box.
Apple Foundation Models
On macOS 26+, use Apple's on-device model as a first-class provider. Pass model: "foundation" in API requests. Tool calling maps through Apple's native interface automatically. Zero inference cost, fully private.
Cloud
Connect to OpenAI, Anthropic, Gemini, xAI/Grok, Venice AI, OpenRouter, Ollama, LM Studio, or Osaurus Router. Osaurus Router is the hosted path — pay-as-you-go with credits and no separate provider account; Osaurus doesn't store your prompt or response content (only the usage metadata needed for billing), and upstream providers process requests under their own policies. Context and m
Truncated for display — read the full file on GitHub.
Related Skills
caveman
107.1k🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.
claude-mem
94.4kPersistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
Agent-Reach
84.2kGive your AI agent eyes to see the entire internet. Read & search Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu — one CLI, zero API fees.
Understand-Anything
83.5kGraphs that teach > graphs that impress. Turn any code into an interactive knowledge graph you can explore, search, and ask questions about. Works with Claude Code, Codex, Cursor, Copilot, Gemini CLI, and more.
