Osaurus：在 Mac 上运行智能体

Own your AI. The native macOS harness for AI agents -- any model, persistent memory, autonomous execution, cryptographic identity. Built …

Osaurus Own your AI. Agents, memory, tools, and identity that live on your Mac. Built purely in Swift. Fully offline. Open source. Download for Mac · Download with Raptor 0.6 bundled (~4 GB) · Docs · Models · Discord · Twitter · Plugin Registry Inference is all you need. Everything else can be owned by you. Models are getting cheaper and more interchangeable by the day. What's irreplaceable is the layer around them -- your context, your memory, your tools, your identity. Others keep that layer on their servers. Osaurus keeps it on your machine. Osaurus is the AI harness for macOS. It sits between you and any model -- local or cloud -- and provides the continuity that makes AI personal: agents that remember, execute autonomously, run real code, and stay reachable from anywhere. The models are interchangeable. The harness is what compounds. Works fully offline with local models. Connect to any cloud provider when you want more power. Nothing leaves your Mac unless you choose. Native Swift on Apple Silicon. No Electron. No compromises. MIT licensed. Install brew install --cask osaurus Or download the latest .dmg from Releases. Two builds ship per release: Osaurus-<version>.dmg (~70 MB) — the standard build. Pick and download a model during onboarding. This is what Homebrew and in-app updates use. Osaurus-<version>-full.dmg (~4 GB, linked from each release's notes and hosted on Hugging Face) — the same app with Raptor 0.6 bundled. First launch installs the model into ~/MLXModels and onboarding skips the download, so you can chat offline immediately. Updates afterwards are the small build. After installing, launch from Spotlight (⌘ Space → "Osaurus") or the CLI: osaurus ui # Open the chat UI osaurus serve # Start the server osaurus status # Check status Requires macOS 15.5+ and Apple Silicon. Agents Agents are the core of Osaurus. Each one gets its own prompts, memory, and visual theme -- a research assistant, a coding partner, a file organizer, whatever you need. Tools and skills are automatically selected via RAG search based on the task at hand -- no manual configuration needed. Everything else in the harness exists to make agents smarter, faster, and more capable over time. Agents can also opt into a private local database and a single self-scheduled next run -- see Agent DB & Self-Scheduling. Local storage is plaintext by default (protected by FileVault) with opt-in SQLCipher encryption -- see Storage. Agent Loop Custom agents run an agent loop. Pick a working folder and the agent gets file, search, and git tools. Toggle the sandbox and it gets shell access in an isolated sandbox. The model writes a markdown todo list, executes against it, and closes out with a verified summary -- all in the same chat window. The built-in Orchestrator is the exception: it has no working folder, sandbox, browser, or computer use. For filesystem work, create or switch to a custom agent, then pick the folder there. See the Agent Loop Guide and Orchestrator Guide. Sandbox Agents execute code in an isolated Linux VM powered by Apple's Containerization framework. Full dev environment -- shell, Python, Node.js, compilers, package managers -- with zero risk to your Mac. Each agent gets its own Linux user and home directory. The VM connects back to Osaurus (inference, memory, secrets) via a vsock bridge -- sandboxed but not disconnected. Extend with simple JSON plugin recipes, no Xcode or code signing required. ┌────────────────┐ ┌────────────────────────────┐ │ Osaurus │ │ Linux VM (Alpine) │ │ │ │ │ │ Sandbox Mgr ──┼───────┤→ /workspace (VirtioFS) │ │ Host API ←──┼─vsock─┤→ osaurus-host bridge │ │ │ │ │ │ │ │ agent-alice (Linux user) │ │ │ │ agent-bob (Linux user) │ └────────────────┘ └────────────────────────────┘ The Linux VM requires macOS 26+ (Tahoe). On earlier versions Osaurus falls back to a native macOS Seatbelt sandbox: commands run on your Mac under sandbox-exec confinement, with writes limited to the sandbox workspace, pip/npm installs (no apk), and all-or-nothing network access instead of per-domain allowlists. See the Sandbox Guide for configuration, built-in tools, and plugin authoring. Memory Three layers -- identity, pinned facts, and per-session episodes -- plus a transcript fallback. Agents distill conversations once at session end (not on every turn), score what matters by salience, and surface at most one compact slice per request based on what you're actually asking. A background consolidator decays, merges, and evicts so memory stays sharp instead of bloating. Most turns inject ~800 tokens or less; many inject zero. See the Memory Guide. Privacy Filter When you send to a cloud model, an on-device classifier — OpenAI's openai/privacy-filter (Apache-2.0, 1.5B params / 50M active sparse-MoE), served via the MLX conversion mlx-community/openai-privacy-filter-bf16 (~2.8 GB) — detects names, emails, phones, URLs, addresses, dates, account numbers, and free-form secrets, alongside deterministic regex for SSN, credit cards, IBAN, AWS keys, GitHub tokens, and your own custom patterns. Each detection is shown in a review sheet with a scrubbed preview before sending; approved entities are swapped for stable [PERSON_1] / [EMAIL_2] placeholders, and streaming replies are unscrubbed back on the fly so the chat reads naturally. Fail-closed: if the post-scrub scan finds anything that leaked, the send is blocked. Verify wire-level redaction in the Insights panel — it captures the exact bytes the cloud saw. See the Privacy Filter Guide. Identity Every participant -- human, agent, device -- gets a secp256k1 cryptographic address. Authority flows from your master key (iCloud Keychain) down to each agent in a verifiable chain of trust. Create portable access keys (osk-v1), scope per-agent, revoke anytime. See Identity docs. Relay Expose agents to the internet via secure WebSocket tunnels through agent.osaurus.ai. Unique URL per agent based on its crypto address. No port forwarding, no ngrok, no configuration.