The Launch Daemon is 100% optional and can better turned off along with its tools. It's there to help users install things like software updates or disk commands that required elevated access.
It operates under least priv. And the user must approve the Launch Agent (runs under use space, same as running locally within the App), and the Launch Daemon. There are 4 levels involved and the Daemon is last on the list and is rarely used. The user can just disable it and its tools get disabled as well. The LLM won't be able to use it in that state.
What gets used:
1. AppleScript/Osascript TCC, runs within the app, user approve each app being automated
2. AgentScript/Swift Dylibs/ScriptingBridge, same TCC runs within the app
3. Local shell scripting - backup if the user's Launch Agent (user space is down
4. Launch Agent (runs in the user space), primary for running shell commands.
5. Launch Daemon, software updates, etc. Anything the previous 4 layers can't handle. Rarely ever used. can be turned off by the user. I have used it to access the security of the Mac itself and it was surprisingly accurate and thorough.
For those wondering about Priv. Agent is built on least priv. It will Run TCC related tasks locally and each app that is being automated required consent from the user. same with automating Safari + user must check a few boxes in Developer tools for Safari. Then there's shell scripting which the preferred route is the Launch Agent which the user approves along with the Launch Daemon.
If the Launch Agent is not available, shell scripts run locally. AgentScripts within in swift also run locally in the app.
Anything priv. runs through the Launch Daemon. This is mostly used for software updates. Lately when creating a dmg using hdiutil, I have seen Agent securely ask for the the password and not use the launch daemon.
The Daemon was created first as a test to see what would happen if an LLM had access to one. And under that mode it knew about 50 things it could run as an administrator of the computer. It was never ran in that state. and its 3-4 layers of access were created.
The user can turn of the Launch Daemon and when this happens not only us the Daemon turned off, so are is access to the Launch Daemon tool. This model is used all over Agent! The user can turn off anything. I do plan to harden the Launch Agent and Launch Daemon on off access with Local Authentication and later a Pass-Key to prevent Agent! from turning it back on via things like Accessibility.
I am the creator of Agent! macOS26.4+, and many won't know this but I have been coding AI apps and related tools from scratch for the past 3 years. I wanted to build something specifically for Mac but at an Agentic level.
I'll remove the stars and forks from the banners. The ribbons are emojois. To raise awareness, I have stage 2 (T2) bladder Cancer. I have been extremely sick the past two weeks. Agent was created a month ago. But most of the work that was done in the past 3 years has been applied to Agent.
If you want to be completely save, Agent does run on a macOS VM, but without any help from Apple Intelligence which runs various things locally. Some parts of Apple AI like Triage/Mediator are experimental.
I chose macOS26 because no one else claimed it and wanted to make it clear what version of macOS the user needed. You'd be surprised how many people still asked if it ran on 10.14 Mojave.
Off topic, but I sincerely ask: am I the only one that is disturbed by the use of the term "Mac OS X" to refer to modern versions of the OS that is currently called "macOS"? (and not MacOS either)
Recently I tried a similar project: Fazm. It's also implemented in Swift, just like Agent here. The Fazm feature set is similar with with main differences are it's focused more on Claude exclusively. https://github.com/mediar-ai/fazm
Would love to be able to use this with my Claude Max Plan subscription ($100/month)... not going to pay with an API Key which burns through tokens way faster. Might try it for the local Apple Intelligence and accessibility to drive local apps tho.
> Our Founder! of this project is battling cancer. Your Stars and Forks are appreciated.
I'm sorry to hear this, but I'm also surprised that this is the first thing I learnt about this project, and that it is written in the third person. It detracts from the project.
54 comments
> Securely runs root-level commands via a dedicated macOS Launch Daemon
lovely.
It operates under least priv. And the user must approve the Launch Agent (runs under use space, same as running locally within the App), and the Launch Daemon. There are 4 levels involved and the Daemon is last on the list and is rarely used. The user can just disable it and its tools get disabled as well. The LLM won't be able to use it in that state.
What gets used: 1. AppleScript/Osascript TCC, runs within the app, user approve each app being automated 2. AgentScript/Swift Dylibs/ScriptingBridge, same TCC runs within the app 3. Local shell scripting - backup if the user's Launch Agent (user space is down 4. Launch Agent (runs in the user space), primary for running shell commands. 5. Launch Daemon, software updates, etc. Anything the previous 4 layers can't handle. Rarely ever used. can be turned off by the user. I have used it to access the security of the Mac itself and it was surprisingly accurate and thorough.
Been using Macs since 1984. Mac OS X since 2000, beta 1.
I really didn't think about humanizing the name. I just felt this flowed really well https://agent.macOS26.app and https://github.com/macOS26/agent
I do want to thank those who have taken the time to look at the app and who have left feedback!
Anything priv. runs through the Launch Daemon. This is mostly used for software updates. Lately when creating a dmg using hdiutil, I have seen Agent securely ask for the the password and not use the launch daemon.
The Daemon was created first as a test to see what would happen if an LLM had access to one. And under that mode it knew about 50 things it could run as an administrator of the computer. It was never ran in that state. and its 3-4 layers of access were created.
The user can turn of the Launch Daemon and when this happens not only us the Daemon turned off, so are is access to the Launch Daemon tool. This model is used all over Agent! The user can turn off anything. I do plan to harden the Launch Agent and Launch Daemon on off access with Local Authentication and later a Pass-Key to prevent Agent! from turning it back on via things like Accessibility.
I am the creator of Agent! macOS26.4+, and many won't know this but I have been coding AI apps and related tools from scratch for the past 3 years. I wanted to build something specifically for Mac but at an Agentic level.
I'll remove the stars and forks from the banners. The ribbons are emojois. To raise awareness, I have stage 2 (T2) bladder Cancer. I have been extremely sick the past two weeks. Agent was created a month ago. But most of the work that was done in the past 3 years has been applied to Agent.
If you want to be completely save, Agent does run on a macOS VM, but without any help from Apple Intelligence which runs various things locally. Some parts of Apple AI like Triage/Mediator are experimental.
I chose macOS26 because no one else claimed it and wanted to make it clear what version of macOS the user needed. You'd be surprised how many people still asked if it ran on 10.14 Mojave.
I mean, the name was changed ten years ago...
What is a harness? People have been talking about it and couldn’t glean what it is
> Our Founder! of this project is battling cancer. Your Stars and Forks are appreciated.
I'm sorry to hear this, but I'm also surprised that this is the first thing I learnt about this project, and that it is written in the third person. It detracts from the project.