Would love to be able to use this with my Claude Max Plan subscription ($100/month)... not going to pay with an API Key which burns through tokens way faster. Might try it for the local Apple Intelligence and accessibility to drive local apps tho.
Latest version of Agent supports OAuth bearer tokens with Claude Code, via "claude setup-token", command from Claude.
And there are over 17+ LLM Providers within Agent including local and cloud based solutions offered by Zai, HuggingFace, Ollama, etc.
I agree on the token part. Until I incorporated Oauth for CC, I used mostly Zai GLM5-1 and used Ollama and Huggingface as fallback which is a new feature called "Fallback chains".
> Our Founder! of this project is battling cancer. Your Stars and Forks are appreciated.
I'm sorry to hear this, but I'm also surprised that this is the first thing I learnt about this project, and that it is written in the third person. It detracts from the project.
A little of both. System prompt guidance with programming structured flow undearneath the hood. May add more guardrails but the more you put in place the more the AI/LLM will find another way.
I've locked down Agent! from one of its processes and run it in a VM and it tried everything it could to break out. It couldn't but it was fun watching it trying to resign compiled Dylibs, the Launch Agents / Daemons and itself. Because of SMAppService, it lost connection with its background process and once it basically hosed itself, I ended the experiment.
Off topic, but I sincerely ask: am I the only one that is disturbed by the use of the term "Mac OS X" to refer to modern versions of the OS that is currently called "macOS"? (and not MacOS either)
I don't think Mac from Mac OS X, was officially dropped, I think was like Xerox, we just stopped Mac from it an called it "OS X" even thought X stood for 10 from 10.0 to 10.15. This is also why Microsoft also tried the Windows 10 game and alluded to never having Windows 11 which obviously changed.
Personally, I wish Apple would stop creating a new OS yearly. Most features users use were born in System 7/8/9 days.
A while loop, some prompts basically amounting to "this is how you format a system call" and "make no mistakes", there's also a regex + executor for detecting and executing system calls.
AI models on their own are raw, undirected, and inherently probabilistic. A "harness" acts as a control layer wrapped around the model, designed to steer it toward deterministic outcomes. It achieves this by equipping the model with actionable tools like web search or file I/O, and by orchestrating an evaluation loop that runs until an acceptable result is produced. (various analogies work here - an astronaut and a space suit, a rocket and the launch pad/mission control, okay I'm out of analogies that aren't car engines)
You can see this in practice by looking at the leaked Claude Code source code. It is a harness around Anthropic's model built for writing code. It relies on heavily engineered (and sometimes brittle) steering mechanisms. These range from highly specific situational prompts to deterministic, hard-coded logic that executes based on the model's output.
Getting a harness right is incredibly hard and feels like whack-a-mole at times.
I can totally agree on the harness part. When I first set out to create a Cursor killer nearly 3 years ago, I built LLM tools, but when I didn't know then has I tried to wrap the LLM's brain around the tools when it needed to be the other way around.
Looks me off an on three years to realize I was doing it backwards. Agent was originally born after I re-wrote CloneTool, a more generic Disk Cloning too with an SMAppService Launch Daemon.
After I completed CloneTool, I was like mmmmm what is I connected an LLM to the Daemon? It rattled of 50 things it could do and it had no knowledge of this anywhere in the harness, system prompt or tools. It simply had figured out its environment on its own.
I never ran Agent under that scenario it definitely has a hardness now. And yes getting the hardness right is a number one challenge and once you do get it working good with most LLMs out of the box, you try not to change it because that sweet spot is hard to come by. Not to say it never gets tweaked but the further in you go, the more you chringe on a change that may break it.
The Launch Daemon is 100% optional and can better turned off along with its tools. It's there to help users install things like software updates or disk commands that required elevated access.
It operates under least priv. And the user must approve the Launch Agent (runs under use space, same as running locally within the App), and the Launch Daemon. There are 4 levels involved and the Daemon is last on the list and is rarely used. The user can just disable it and its tools get disabled as well. The LLM won't be able to use it in that state.
What gets used:
1. AppleScript/Osascript TCC, runs within the app, user approve each app being automated
2. AgentScript/Swift Dylibs/ScriptingBridge, same TCC runs within the app
3. Local shell scripting - backup if the user's Launch Agent (user space is down
4. Launch Agent (runs in the user space), primary for running shell commands.
5. Launch Daemon, software updates, etc. Anything the previous 4 layers can't handle. Rarely ever used. can be turned off by the user. I have used it to access the security of the Mac itself and it was surprisingly accurate and thorough.
Recently I tried a similar project: Fazm. It's also implemented in Swift, just like Agent here. The Fazm feature set is similar with with main differences are it's focused more on Claude exclusively. https://github.com/mediar-ai/fazm
I am the creator of Agent! macOS26.4+, and many won't know this but I have been coding AI apps and related tools from scratch for the past 3 years. I wanted to build something specifically for Mac but at an Agentic level.
I'll remove the stars and forks from the banners. The ribbons are emojois. To raise awareness, I have stage 2 (T2) bladder Cancer. I have been extremely sick the past two weeks. Agent was created a month ago. But most of the work that was done in the past 3 years has been applied to Agent.
If you want to be completely save, Agent does run on a macOS VM, but without any help from Apple Intelligence which runs various things locally. Some parts of Apple AI like Triage/Mediator are experimental.
I chose macOS26 because no one else claimed it and wanted to make it clear what version of macOS the user needed. You'd be surprised how many people still asked if it ran on 10.14 Mojave.
For those wondering about Priv. Agent is built on least priv. It will Run TCC related tasks locally and each app that is being automated required consent from the user. same with automating Safari + user must check a few boxes in Developer tools for Safari. Then there's shell scripting which the preferred route is the Launch Agent which the user approves along with the Launch Daemon.
If the Launch Agent is not available, shell scripts run locally. AgentScripts within in swift also run locally in the app.
Anything priv. runs through the Launch Daemon. This is mostly used for software updates. Lately when creating a dmg using hdiutil, I have seen Agent securely ask for the the password and not use the launch daemon.
The Daemon was created first as a test to see what would happen if an LLM had access to one. And under that mode it knew about 50 things it could run as an administrator of the computer. It was never ran in that state. and its 3-4 layers of access were created.
The user can turn of the Launch Daemon and when this happens not only us the Daemon turned off, so are is access to the Launch Daemon tool. This model is used all over Agent! The user can turn off anything. I do plan to harden the Launch Agent and Launch Daemon on off access with Local Authentication and later a Pass-Key to prevent Agent! from turning it back on via things like Accessibility.
32 comments
[ 2.9 ms ] story [ 70.6 ms ] thread'claude setup-token'
And there are over 17+ LLM Providers within Agent including local and cloud based solutions offered by Zai, HuggingFace, Ollama, etc.
I agree on the token part. Until I incorporated Oauth for CC, I used mostly Zai GLM5-1 and used Ollama and Huggingface as fallback which is a new feature called "Fallback chains".
I'm sorry to hear this, but I'm also surprised that this is the first thing I learnt about this project, and that it is written in the third person. It detracts from the project.
I've locked down Agent! from one of its processes and run it in a VM and it tried everything it could to break out. It couldn't but it was fun watching it trying to resign compiled Dylibs, the Launch Agents / Daemons and itself. Because of SMAppService, it lost connection with its background process and once it basically hosed itself, I ended the experiment.
I mean, the name was changed ten years ago...
Personally, I wish Apple would stop creating a new OS yearly. Most features users use were born in System 7/8/9 days.
What is a harness? People have been talking about it and couldn’t glean what it is
You can see this in practice by looking at the leaked Claude Code source code. It is a harness around Anthropic's model built for writing code. It relies on heavily engineered (and sometimes brittle) steering mechanisms. These range from highly specific situational prompts to deterministic, hard-coded logic that executes based on the model's output.
Getting a harness right is incredibly hard and feels like whack-a-mole at times.
Looks me off an on three years to realize I was doing it backwards. Agent was originally born after I re-wrote CloneTool, a more generic Disk Cloning too with an SMAppService Launch Daemon.
After I completed CloneTool, I was like mmmmm what is I connected an LLM to the Daemon? It rattled of 50 things it could do and it had no knowledge of this anywhere in the harness, system prompt or tools. It simply had figured out its environment on its own.
I never ran Agent under that scenario it definitely has a hardness now. And yes getting the hardness right is a number one challenge and once you do get it working good with most LLMs out of the box, you try not to change it because that sweet spot is hard to come by. Not to say it never gets tweaked but the further in you go, the more you chringe on a change that may break it.
Or a lawsuit, given macOS is a trademark.
lovely.
It operates under least priv. And the user must approve the Launch Agent (runs under use space, same as running locally within the App), and the Launch Daemon. There are 4 levels involved and the Daemon is last on the list and is rarely used. The user can just disable it and its tools get disabled as well. The LLM won't be able to use it in that state.
What gets used: 1. AppleScript/Osascript TCC, runs within the app, user approve each app being automated 2. AgentScript/Swift Dylibs/ScriptingBridge, same TCC runs within the app 3. Local shell scripting - backup if the user's Launch Agent (user space is down 4. Launch Agent (runs in the user space), primary for running shell commands. 5. Launch Daemon, software updates, etc. Anything the previous 4 layers can't handle. Rarely ever used. can be turned off by the user. I have used it to access the security of the Mac itself and it was surprisingly accurate and thorough.
If had a concern they had months ahead of time reserve
I'm also the creator of BigMac, that supported unsupported macOS installs on old Mac Pro 2008-2012 hardware. Neither Apple nor McD's chimed in.
I am the creator of Agent! macOS26.4+, and many won't know this but I have been coding AI apps and related tools from scratch for the past 3 years. I wanted to build something specifically for Mac but at an Agentic level.
I'll remove the stars and forks from the banners. The ribbons are emojois. To raise awareness, I have stage 2 (T2) bladder Cancer. I have been extremely sick the past two weeks. Agent was created a month ago. But most of the work that was done in the past 3 years has been applied to Agent.
If you want to be completely save, Agent does run on a macOS VM, but without any help from Apple Intelligence which runs various things locally. Some parts of Apple AI like Triage/Mediator are experimental.
I chose macOS26 because no one else claimed it and wanted to make it clear what version of macOS the user needed. You'd be surprised how many people still asked if it ran on 10.14 Mojave.
Anything priv. runs through the Launch Daemon. This is mostly used for software updates. Lately when creating a dmg using hdiutil, I have seen Agent securely ask for the the password and not use the launch daemon.
The Daemon was created first as a test to see what would happen if an LLM had access to one. And under that mode it knew about 50 things it could run as an administrator of the computer. It was never ran in that state. and its 3-4 layers of access were created.
The user can turn of the Launch Daemon and when this happens not only us the Daemon turned off, so are is access to the Launch Daemon tool. This model is used all over Agent! The user can turn off anything. I do plan to harden the Launch Agent and Launch Daemon on off access with Local Authentication and later a Pass-Key to prevent Agent! from turning it back on via things like Accessibility.
Been using Macs since 1984. Mac OS X since 2000, beta 1.
I really didn't think about humanizing the name. I just felt this flowed really well https://agent.macOS26.app and https://github.com/macOS26/agent
I do want to thank those who have taken the time to look at the app and who have left feedback!