Osaurus

The evidence describes per-agent Linux users, workspace write restrictions, subagents and browser use disabled by default, first-use or consequential-action approval, pre-cloud review, fail-closed redaction, Keychain-held identity keys, revocable access keys, and explicit telemetry/cloud data boundaries. This supports strong sensitive-data handling and data-flow transparency. Deductions apply because agents may still execute code, use networks, connect remote MCP services, expose public relays, and run automations without evidence that every external effect receives per-action confirmation; the older sandbox has all-or-nothing networking; plaintext local storage is the default; and no general undo mechanism covers file changes or task side effects. Toolchains and dependency inputs receive some pinning and releases are CI-gated, but Actions use moving major-version tags and no vulnerability scan, SBOM, or dependency-update policy is shown. The license attributes Osaurus, Inc. and the repository names project channels and third-party components, but registry verification is absent, so publisher identity remains a repository assertion rather than verified provenance.

The README, platform requirements, architecture, and workflows form a largely coherent product account. CI pins Xcode and the runner, release publication requires named test and lint checks, and the workflow provides unusually detailed diagnostics for incomplete builds, launch hangs, empty test results, ordinary failures, and process crashes; failure messaging therefore earns full credit. Deductions apply because Package.resolved, the dependency graph, and actual CI outcomes are not supplied, so availability cannot be confirmed statically. Broad claims such as “fully offline,” “nothing leaves your Mac,” and “zero risk” require qualifications given optional cloud providers, production crash reporting enabled by default, and the sandbox's host bridge, reducing strict self-consistency.

The material addresses research, coding, file organization, browser work, image generation, voice, automation, APIs, MCP, and plugin development. It clearly states Apple Silicon and OS requirements, local/cloud model choices, the Linux VM and Seatbelt fallback, and the HTTP/SSE-only boundary for remote MCP providers, supporting full scores for scenarios, capability boundaries, and environment fit. Trigger precision is reduced because RAG automatically selects tools and skills, while watchers and schedules invoke agents, but the evidence does not specify selection thresholds, conflict resolution, false-trigger controls, or an auditable matching policy; approval behavior is documented only for selected capabilities.

The README has strong navigation across installation, agents, sandboxing, privacy, models, MCP, plugins, APIs, CLI, architecture, building, and contribution. Commands, system prerequisites, source-build steps, and usage examples are concrete. The supplied MIT text matches the metadata, and important limitations are expressly stated. Deductions apply because no actual FAQ, troubleshooting content, or release history is included; semantic tags, draft release notes, and Sparkle appcast generation establish a versioning path but not changelog quality. Plugin documentation refers to a v3 host API with v1/v2 compatibility while the architecture diagram labels only a v1/v2 ABI, creating minor version-language drift. Copyright ownership, contribution channels, Issues, Discord, and an update pipeline indicate responsibility, but no named maintainers or support commitment are shown and publisher identity is not registry-verified.

Outputs are consumable through a native UI, CLI, compatible OpenAI/Anthropic/Ollama APIs, MCP, system intents, and inline media. Persistent memory, tool execution, identity, sandboxing, and model portability provide substantial apparent value beyond a bare inference endpoint. Cost-benefit is reduced because the product requires Apple Silicon and a recent macOS release, VM isolation requires macOS 26, the privacy model is about 2.8 GB, cold builds may take tens of minutes, and cloud models or the hosted router may incur fees. No performance, resource, quality, or total-cost benchmarks are supplied to quantify those tradeoffs.

Many claims point to named documentation, and the README supplies concrete paths, commands, endpoints, version requirements, algorithms, and data flows. The license and two workflows independently support the MIT license, Swift/macOS build path, CI gating, signing, notarization, release mechanics, and crash-symbol handling. Deductions apply because the referenced feature guides, implementation code, test results, dependency lockfile, and release history are not part of the evidence bundle, leaving most security and feature claims supported only by the README. Absolute conclusions such as “zero risk,” “fully private,” and claims that a man-in-the-middle cannot complete a handshake are not clearly separated from observable facts, assumptions, and inference in the supplied sources.