The harness

Naseem is 57 MB. The desktop apps it competes with are a gigabyte and a half, because they carry a browser. This is what is inside instead.

Three layers

The app sits on two Swift packages, each with one job. The lower two are open source — the agent that works on your Mac is built on code anyone can read.

Naseem The Mac app — profiles, approvals, projects, the interface private SwiftAgentKit The loop — steps, tools, memory, sub-agents, skills open LLMProviderKit The wire — one interface for every model service open
SwiftAgentKitThe agent loop LLMProviderKitThe provider seam

What the harness does

CapabilityWhat it means for you
ToolsFiles, terminal, Python, PDFs, web search and the iOS Simulator, called by the model directly — with your approval gate in front of anything consequential.
Context that stays smallFinished tool output is filed away and fetched back on demand, so a long task is still coherent at its fortieth step.
Sub-agentsBounded side-tasks run in their own fresh context, so a long investigation does not crowd out the main thread.
MemoryPlain Markdown the agent reads and writes across sessions. Tell it something once.
SkillsFolders of instructions, yours or imported, loaded only when a task calls for them.
Lessons from what went wrongWhen you refuse an action, or a run recovers from a failure, Naseem proposes a short lesson. You approve it, and it quietly steers later work. The agent gets better at your work without you writing a prompt.
MCP serversConnect external tool servers — filesystem, GitHub, a browser, whatever you run — and decide per server whether its tools need your approval each time.
Any providerAnthropic, OpenAI, Google, OpenRouter, Ollama and on-device models behind one interface — switch without losing a feature.
Local modelsOllama and on-device MLX run with no key and no network at all.
Effort controlAsk for less thinking on simple work and more on hard work, per conversation, on models that support it.
StreamingAnswers arrive token by token, with every tool step visible as it happens.
Stop, alwaysA run can be cancelled between steps, and a stopped run leaves its work where you can see it.

You decide what it can do

An agent with a terminal on your Mac is only useful if you can say where it stops. Every way Naseem gains a new ability is one you see first, and can take back.

Nothing arrives unseen

Skills come from links and repositories — someone else's instructions, telling your agent how to work. Naseem fetches one, reads it, and reports what it found before anything is added. If it ships code as well as instructions, that is a separate decision you make on its own.

You get: a look at it before it can act, not after.

A switch on everything

Any skill can be turned off. It stays on disk and leaves the agent's view entirely — no editing around it, no deleting it to be sure, no wondering later why a run behaved oddly.

You get: a way to answer "what could it see when it did that?"

Approval per server, not per app

External tool servers connect through MCP — filesystem, GitHub, a browser, whatever you run. Each one decides for itself whether its tools ask you every time, so a server you trust runs freely and a server you are still weighing up does not.

You get: one blanket setting replaced by a choice per source.

What happens when you press Return

YOU A request AGENT Assemble the prompt plus a one-line list of your skills File away finished work a summary stays, the full text on request WIRE Check what this model supports so nothing is asked that it cannot do Send it retried if the service stumbles BACK Stream · tool call · your approval then the next turn every turn

Every turn takes the same path down and back, whichever provider is answering.

The code is open: SwiftAgentKit and LLMProviderKit. How it works covers the same ground from the outside in.