wisp

wisp is a small AI agent that runs on your Mac and stays there. It drives Apple’s on-device Foundation Model, the one behind Apple Intelligence, or a model you run locally in Ollama, MLX, llama.cpp, or LM Studio, and gives it tools: it can run a command, read and edit a file, report on the machine, and send you a notification. No prompt, file, or command output leaves the Mac, and there is no key, account, or bill.

It is for two kinds of user at once: a person at a terminal who wants a local assistant that cannot do anything behind their back, and a coding agent (Claude Code, Codex, any MCP client) that wants to hand the local chores to something cheaper than itself: run the tests and return the failures, condense a log, summarise a diff, scan a commit for secrets.

Two faces

Both open the same kind of session, with one configuration, one set of approvals, and one audit log.

The safety model, in five lines

1. A policy refuses what should never run (sudo, rm -rf /, piping into a shell, disk tools, a wisp agent of its own).
2. A Seatbelt sandbox confines every command’s writes to the directory wisp was started in, the temporary directories, and the build caches you configure; it can never write ~/.wisp. A command that cannot run sandboxed (brew upgrade) runs outside it only when you approve that one run, every time, or type it yourself after !!.
3. A risk classifier rates each simple command safe, moderate, or dangerous, rules first and a fast Core ML model beside them.
4. You are asked at moderate and above, and your answer has a scope you choose; silence is a refusal, and the agent that called wisp can never answer for you.
5. The audit log records every prompt, tool call, verdict, approval, and command outcome, verbatim, and every reply says what the turn actually ran.

Where to go next

wisp is open source, at github.com/pidster/wisp; every page here has an edit link to its source in the repository’s docs/ folder. The Changelog says what each release changed.