Osaurus for Mac: A Practical Local AI Agent Setup and Privacy Guide

Want an AI agent to organize files and run tools on your Mac without immediately handing over real work data? Osaurus combines local models, agents, memory, and tools, but “local-first” is not an automatic privacy guarantee. Based on official documentation available on July 22, 2026, this guide uses five gates to create a test that is verifiable and reversible. We checked documentation and commands, but did not benchmark different Macs or perform boundary or penetration testing.

TL;DR:

• Osaurus is a macOS AI agent harness, not just a model runner. If you only need an inference endpoint, there is no urgency to replace Ollama or LM Studio.
• The baseline requirements are Apple Silicon, macOS 15.5 or later, and roughly 2–20 GB of storage per local model. Apple Foundation Models require macOS 26 or later; Sandbox uses an isolated Linux VM on macOS 26+ and automatically falls back to Seatbelt confinement on macOS 15.
• A local model does not make every feature offline. Before a sensitive task, separately check cloud models, relays, remote MCP servers and tools, Sandbox networking, and telemetry.
• For the first run, grant access only to an empty working folder and ask the agent to create one README. Review file changes, the selected model, and network connections before expanding permissions.

Start with a go/no-go check: which Macs should continue?

Osaurus app requirements are an Apple Silicon Mac, macOS 15.5 or later, and about 2–20 GB of additional storage for each local model. The official requirements do not list 16 GB or 24 GB of RAM as a universal minimum. Being able to install the app and running a particular model smoothly are different questions.

Gate	What to confirm	What to do if it fails
Chip	About This Mac shows an Apple M-series chip	Stop if you have an Intel Mac
System	macOS 15.5 or later	Update macOS first; stop if you cannot
Storage	Leave at least the required space before downloading a model	Choose a smaller model or an external drive
Required features	Decide whether Apple Foundation Models or the Linux VM Sandbox are essential	Below macOS 26, use a local model or the Seatbelt Sandbox, or choose another approach

The official installation page lists M1, M2, M3, or newer chips, but does not promise performance for every Mac. Its approximate memory formula for quantized models is a selection aid, not an app requirement. A practical start is a small model with only one model loaded, followed by a check of how much unified memory remains during normal work.

What is Osaurus, and why is it not simply an Ollama replacement?

Osaurus is a native Mac AI agent harness. It puts the model layer, agent identity, memory, tools, automation, and compatible APIs in one workspace. Ollama and LM Studio focus more on running, managing, or testing local models. All three can coexist.

What you need	Start with	Why
A local inference endpoint only	Keep Ollama or LM Studio	There is no need to add agent administration
Persistent agents, memory, tools, and automation	Test Osaurus alongside your current setup	These are central to Osaurus
No model downloads or RAM and SSD management	Cloud ChatGPT, Claude, or Gemini	Hosted products have less operational overhead

The current official entry points are osaurus.ai, docs.osaurus.ai, and osaurus-ai/osaurus. Older tutorials may point to dinoki-ai/osaurus, but that is not the current download source. Existing Ollama and LM Studio users do not need to remove their workflows: the Models documentation still explains how to connect an Ollama server or an LM Studio custom server.

This is also why “which is faster?” rankings are risky. Without the same hardware, model, quantization, and context, speed and quality claims are guesses. To understand the resources local models consume, read our framework for choosing private local AI tools before deciding whether you need the full agent layer.

Install from an official source and verify four signals

We checked each step against the official Installation documentation. Download the DMG from the website or current GitHub Releases, or install it with Homebrew:

brew install --cask osaurus

For the DMG route, drag the app into Applications. If macOS says it cannot open the app, the official guidance is to delete the file and download it again from the website or current GitHub Releases. Do not bypass a signature warning. The following verification commands come from the official documentation; we did not execute them on a physical Mac:

osaurus --version
osaurus serve
osaurus status
curl http://127.0.0.1:1337/health

Look for four signals: the download came from the right source, the app launches, the CLI returns a version, and the health endpoint at 127.0.0.1:1337 responds. If osaurus is missing after a DMG install, follow the official page to link the bundled CLI into the Homebrew bin directory or add its bundle path to PATH. Do not save a step by downloading from an unknown mirror.

MLX, Apple Foundation, or cloud: choose the data boundary first

Before comparing convenience or capability, ask whether the content may leave your Mac.

1. Data must stay offline, macOS 15.5 or later: choose a local MLX model. You manage its download, storage, and unified-memory use.
2. Data must stay offline, macOS 26 or later: Apple Foundation Model is an option. The official documentation says it needs no separate download or setup.
3. The task needs a cloud model: connect a provider, knowing that the prompt and conversation context for that request go to its servers and may incur a charge.

Selecting a chat model is not the final step. Quick Start specifically tells you to select a model under Settings → General → Core Model. The Core Model distills memory and chooses relevant tools and skills for each message. Without it, memory updates pause and tool selection falls back to the chat model. On macOS 26 or later, the documentation recommends foundation; elsewhere, select a small, fast model you have downloaded. Avoid copying a specific model name from an article because catalogs and availability change.

Check five possible network exits in a local-first setup

Evaluate Osaurus privacy one request at a time. An agent may use local MLX for one request and a cloud provider for the next, changing the data flow. “Local-first” does not automatically turn off relays, remote tools, networking, or telemetry.

Exit	What may leave the Mac	What to do before a sensitive task
Cloud model	The prompt and conversation context for that request	Switch to local or foundation, or redact the data
Relay	Inbound HTTPS for a selected agent	Confirm it is off under Server → Relays
Remote MCP or tool	Depends on the third-party tool	Enable only necessary tools and read their privacy terms
Sandbox network	Outbound HTTP from the Linux VM	Set network: "none"
Analytics or crash reports	The developer says these are anonymous aggregate metrics and diagnostics	Check the opt-out under Settings → Privacy

The official Security & Privacy page says Insights shows what each request sent and received when a remote provider is connected. This is a useful verification point, but an official design statement is not an independent audit. Before handling client data, unpublished contracts, or API keys, record which model the request uses, which capabilities are enabled, and whether network access is allowed.

Choose either a working folder or Sandbox for the task

These are not two protections you can stack. The Agents documentation states that a working folder and Sandbox are mutually exclusive in the same chat.

Task	Choose	Effective boundary
Organize documents, search files, or work with an existing Git repo	Working folder	File, search, and Git tools stay within the selected folder
Run an unknown script, Python, Node, or install packages	Sandbox	An isolated Linux VM on macOS 26+; Seatbelt confinement on macOS 15
Ask questions without touching data	Disable tools and memory	Keep the interaction text-in, text-out

Sandbox autonomous_exec determines whether the agent receives write, execution, installation, and secret tools; read-only tools are independent. In supported environments, the documentation even lists enabled: true as the default for a new custom agent, so “new” does not mean least privilege. Enable subagents, Computer Use, AppleScript, and Bonjour discovery only after you have a specific need.

Make one README in the first safe test

Starting with a real repository makes it hard to tell whether a failure came from the model, permissions, tools, or server. An empty folder removes those variables.

1. Create an empty folder with no real data or credentials.
2. Create a test agent and disable unnecessary memory, auto-discovery, subagents, Computer Use, and AppleScript.
3. Select that working folder in the chat and do not enable Sandbox at the same time.
4. Prompt: “Create README.md containing ‘This is an Osaurus permission test.’ Do not create or modify any other file.”
5. Inspect the folder and Git diff. Confirm that there is only one expected file.
6. Check the model, network connections, and telemetry in Insights and Privacy before granting more access.

This is a safety procedure derived from the documented capabilities, not the result of boundary testing. It is valuable because it is reversible: if it fails, delete the test folder without risking real work. Once the one-file task is stable, add one capability at a time and keep a diff for every step.

Data on your Mac still needs FileVault, SQLCipher, and backup checks

Local storage does not mean the database is encrypted by default. The documentation says local data uses plaintext SQLite by default as of version 0.21.0, with at-rest protection primarily relying on macOS FileVault. Optional SQLCipher encryption is available under Storage, with its key held in macOS Keychain.

Osaurus app data lives in ~/.osaurus/, and local MLX models default to ~/MLXModels/. If several people share the Mac account or FileVault is off, fix the device and account boundary first. After enabling SQLCipher, plan for recovery because losing the key may make the data inaccessible.

Backups create a separate risk. The official uninstall instructions warn that deleting ~/.osaurus/ is irreversible and recommend exporting a plaintext backup from Storage first. Do not leave that plaintext file in an unencrypted shared folder or casually sync it to an uncertain cloud destination. Confirm that the export is readable before deleting anything.

Troubleshoot one gate at a time

Use a fixed order so you can identify the failing layer:

1. Source and version: confirm the app came from the website or current GitHub Releases and that the Mac meets the chip and OS requirements.
2. Server health: run osaurus status and query the health endpoint before changing anything else.
3. Model capacity: confirm the model finished downloading and that SSD and unified memory have room.
4. Core Model: under General, make sure an explicit model is selected instead of Use chat model.
5. Permissions and folder: check the working folder and whether the agent actually needs each capability.
6. Network: allow it only when cloud models, remote MCP, or downloads require it, then inspect Insights.

If a local model is too demanding, choose a smaller or more heavily quantized one and keep Strict mode loading one model at a time. The Models documentation also supports moving models to an external drive with OSU_MODELS_DIR. Switching to the cloud is not a troubleshooting failure, but it does change the data boundary, so repeat the five network-exit checks.

When should you not use Osaurus?

Keep your current tool if any of these are essential:

• You need Windows, Linux, or a consistent cross-platform workflow.
• You only need a stable inference server, not agents, memory, and automation.
• You require claims backed by an independent security audit or penetration test.
• You cannot manage model storage, FileVault, permissions, and backups.
• You depend on a hosted frontier model but cannot allow prompts or context to leave the device.

A complete Traditional Chinese UI is also uncertain. As of the verification date, the official documentation and repository do not support a claim that the interface is fully localized. If English settings screens are a problem, waiting for a clearer official status is safer than guessing on pages that control sensitive permissions.

Pass the smallest task before expanding access

Whether Osaurus is worth installing cannot be answered by the labels “free,” “local,” and “open source.” It depends on whether you can explain where each request goes, what the agent can touch, and how to recover from a mistake.

If you only need a local inference endpoint on a Mac, keep Ollama or LM Studio and avoid the overhead of agent permissions. If you need persistent memory, tools, and automation, first complete the README test in an empty folder. Record the model, network access, and permissions, then give it one reversible side project. The first run does not need to be impressive; every step needs to be understandable.