An open-source AI agent that lives on your Mac — and answers to your iPhone.
It runs your terminal, uses your apps and keeps working while you talk.
Anything that acts in your name waits for your click.
📖 Technical docs (English · 中文)
Try asking it
“Gather this year's invoices from Downloads into one folder, and tell me which months are missing.”
“How many duplicate files are in Downloads? Move the copies to the Trash, keep the newest.”
“Turn sales_q3.csv into a one-page report with a chart.”
“Make a note in Notes with the three points from this meeting.”
“Every morning at 9, check this page and tell me if the price changed.”
You keep talking while it works. Anything that deletes, sends, installs or touches another app asks you first — on your Mac or your iPhone.
Get started in a minute
- Download Arslan for macOS (Apple Silicon, macOS 11+) — signed, notarized, updates itself.
- Drag it into Applications and open it.
- Paste a model API key in Settings — OpenAI, Anthropic, Gemini, DeepSeek, Qwen, Kimi, OpenRouter and more — or point it at a local model through Ollama.
That's it. No account, no sign-up, no Arslan server.
What's new in 0.1.63 — change course mid-reply, answers as they are written, undo a turn
Type a message while Arslan works and it reaches the reply at its next step; answers appear as the model writes them; up to four reads run at once; and before a turn first changes your working folder Arslan saves a checkpoint, so "Undo this turn" puts the files back. Files you ask for come back as attachments, on the iPhone too. Two safety changes come first: every new terminal command now asks before it runs (switch back in Settings › What Arslan may do › Terminal), and scheduled tasks run no commands in this version — a step that needs one is skipped and listed in your Inbox. Each reply and each background task also stops at $2 of model spend by default, and the expert-era code is gone (12,514 fewer product lines than 0.1.62). The notes also list what moved to 0.1.64 and two pre-release bars we missed. Full release notes →
Recently:
- 0.1.62 — long commands finish: a command runs to its own limit (2 minutes by default, 10 at most), "needs your check" only when something may really have happened, MCP tool descriptions can no longer break a chat, and writing a file never follows a link out of your working folder.
- 0.1.61 — one approval card everywhere (chat, Inbox, island, iPhone), MCP servers that start themselves, and Claude works again after a rejected
temperature setting.
Why Arslan
| |
|---|
| One loop, every action behind a gate | A message enters one native tool-calling loop. The model proposes; a fixed policy function — not another model — answers run, ask or forbid for every shell command before it runs. Results come back wrapped as untrusted data, so instructions hidden in a web page are read, not obeyed. |
| It keeps working while you talk | Long work becomes a background job and the turn ends. A job ends done, partial, blocked or stopped — never silently. Schedules run at most every 15 minutes (up to 10), and a schedule your Mac slept through is not replayed. |
| Status in the notch | The Arslan Island shows what it's doing, asks when it needs you, and tells you when it's done. Menu bar, push-to-talk, and a Stop button for anything in flight. |
| Hands, asked not assumed | Mac apps through Arslan Hands, Arslan's own browser, your Shortcuts, AppleScript. It never types into a password field, and never touches Keychain Access, password managers, System Settings, macOS security prompts, Notification Center or itself. |
| Your Mac in your pocket | Arslan for iPhone (coming to the App Store) talks to your Mac through your own private iCloud, end-to-end encrypted. The same approval card shows on both; the first answer wins. An unanswered card waits 30 minutes, and running out is not a no (since 0.1.61; earlier versions declined it after 300 s). |
| Local-first, bring your own key | Memory lives in SQLite on your Mac; your model provider sees only the turns you send, on your key. Arslan runs no servers. Correct it once and it remembers the practice — with Undo. |
| Credentials stay yours | Arslan never fetches or injects your account credentials. Authenticated connectors (App Store Connect and the like) remain disabled until an isolated credential broker passes security review — see W11. A command you approve outside the sandbox runs with your own permissions. |
This is the beginning of the README. Read the rest at the original. Read the full README ↗
