Painted Wolf Code 1.0 is available for macOS
Painted Wolf Code 1.0 is available today for macOS, under the Apache-2.0 license. It is the first stable release of an open-source AI coding agent that runs entirely on your own machine.
It works with the models you already use. Connect the providers you choose, cloud or local, with your own keys, and the agent, your code, and the record of its work stay on your machine. Its limits don’t rest on the model’s restraint: on macOS, the operating system enforces them.
Painted Wolf Code is built from scratch with a fast Go engine, ready to help you create anything.
It also does less of the expensive work. Painted Wolf Code 1.0 ships with Bialy, our tuned decision engine built on Laya, running on your Mac: it does the sorting other agents pay a frontier model to do, so every turn starts leaner and takes fewer calls.
Bialy cuts the frontier model’s work
Coding agents tend to send every tool definition and every instruction with every call, or make the model spend calls asking for what it needs. Either way, you pay for the search.
Laya is the open decision model Convai Innovations released in September 2026: a small model that gives calibrated answers in one forward pass and writes no text at all. Our tuned engine, Bialy, builds on Laya. On your Mac it prepares each turn before your provider sees a thing. It loads what the work needs: the tools the request will call, and the best-fitting skill, read ahead of time. It prunes the rest: tool definitions, guidance, and skills the request doesn’t need stay out of the prompt. And it reranks: when the agent summarizes code or reads its map of the repository, Bialy puts the files and definitions that matter first. The frontier model has what it needs from the first call, with less to read and the best material at the top, so turns take fewer calls and finish sooner.
We built the same browser chess game twice, once without Bialy and once with it. On the first turn, the instructions the model received shrank by more than a third: about five pages of text it no longer had to read. That saving repeats on every call. Across the session’s 35 model calls it added up to more than 230,000 prompt tokens, roughly two novels’ worth of text your provider never had to read and you never paid for.
It loads, prunes, and ranks; it doesn’t write. The model gives calibrated answers about options the app already allows, so it cannot invent a tool, widen what the agent may do, or touch an approval. It cuts only what it is confident the request doesn’t need, and anything it cut, the agent can still ask for.
We didn’t bolt it on. Bialy runs natively inside the app on our own Rust engine, which uses Apple’s MLX to answer on your Mac’s GPU: no Python, no server. The decision heads on top of it are ours and open weights under Apache-2.0; we trained them on benchmark sessions across open repositories, scored across open models. Every decision leaves a receipt of what it read and what it answered. How Bialy builds on Laya goes deeper.
Your providers, all at once
The app connects directly to the model providers you choose, cloud or local, using your own API keys, and you pay them at their rates. There’s no account to create.
Connecting directly also buys capability. The app spreads work across several providers at once, so throughput isn’t capped by one account’s rate limit: a frontier model for the hard reasoning, a cheaper and faster one for mechanical passes, in the same session. Spend is estimated as you go, with an optional per-session ceiling.
It asks only when something is at stake
Most coding agents leave you two options: approve every command, or switch approvals off and hope. Both end the same way, with someone clicking through prompts they stopped reading days ago.
Painted Wolf Code is built so that a prompt is worth reading when it appears. Ordinary project work happens inside an operating-system boundary, and the app keeps a version history of the files it changes, so it runs without asking. Reaching past that boundary stops for approval, and so does what nothing can undo: infrastructure destroyed, access granted, a package published, history force-pushed.
Drawing that line requires knowing what a command can actually reach rather than what it is called, and the same knowledge covers the quieter cases. Your cloud credentials stay usable, because the check belongs on the action and not on the key.
Recognizing the difference takes a catalog rather than a hunch. Painted Wolf Code ships an extensive catalog of rules that read the operation an action performs — emptying an object-storage bucket, deleting a Kubernetes namespace, destroying Terraform-managed infrastructure, disabling an audit trail, minting a credential, publishing a release — across the AWS, Azure and Google Cloud command lines, the structured cloud calls an MCP tool makes, and the local shell.
Credentials the model never sees
The other thing you cannot take back is a credential that has already left. Painted Wolf Code screens every outbound payload — model requests, web searches, page fetches, MCP calls — against the credentials it knows and the shapes it recognizes, before the send. A match holds the request for a decision: send it redacted, send it unchanged, or don’t send it. Nothing has left the machine when that card appears, and the check runs at every approval setting.
You can also point at a credential yourself, in a source file, a message draft, or project settings. The value goes into an encrypted vault and the model receives a reference; the bytes are substituted only inside the command, terminal input, HTTP request, or MCP call that needs them, and the transcript keeps the reference. Marking a value in a file does not modify the file.
The full security model documents every layer and the limits of each.
Work you can check
Answers cite the files and lines behind them, verified against what the agent actually read. Click a citation and the file opens at that line.
Real security scanners run against your project as you work, and their findings reach the agent as evidence it can cite, so it fixes the hardcoded token instead of speculating about it. Static analysis is built in and works on the first scan. Teams with their own scanners can add them.
Everything stays searchable afterward from one box: messages, filenames, code in the live tree, evidence, tool calls, outcomes. A session is a record you can query months later, not a chat log that scrolls away.
Forty-one languages parse to real syntax trees, so the agent reads a symbol by name, searches structurally instead of by regex, and rewrites a pattern across a whole tree.
The behavior you shape is configuration, not code
A coordinator delegates to specialists working in parallel: an implementer, a path explorer, a repo researcher, a code reviewer, a security reviewer, a plan writer, a plan reviewer, a skeptic, and a web researcher. Each is a YAML persona with a fixed capability ceiling. Their workflows, injected guidance, and pack-defined policy rules and gates are configuration too. Together, that customizable behavior ships as thirteen extension packs the app loads at boot.
So all of it is yours to change. Disable a pack, replace a single piece, or point one at your own fork. Commit the result to your repo and everyone who clones it gets the same behavior. New packs install from a git URL, and the shipped app is the authoring tool. The SDK covers the surface, and a ten-minute tutorial ends with a working pack.
The pack-defined guardrails are portable too. Painted Wolf Code enforces Open Agent Rules, an open standard published in its own repository with JSON Schemas and a conformance corpus. A rule is a single YAML document, and this app is one implementer of that standard, not its owner.
Local-first, top to bottom
Scans, sessions, transcripts, and keys stay on your machine, and so does the decision model: it ships inside the app, runs on your Mac’s GPU, and sends nothing anywhere. The first-party application code is Apache-2.0; bundled configuration and dependencies retain the open-source licenses listed on the License page, so none of this has to be taken on trust.
Availability
Painted Wolf Code 1.0 runs on macOS 14 (Sonoma) or later, on Apple Silicon. It is on the Download page and available through Homebrew:
brew install --cask paintedwolf-ai/tap/painted-wolf-code
Source is at paintedwolf-ai/paintedwolf-code; release notes are on the Changelog. The app builds and runs from source on Linux today, and packaged Linux and Windows builds are the next priorities.
About Painted Wolf LLC
Painted Wolf LLC builds open-source AI coding tools that run where you do. Its flagship product, Painted Wolf Code, is an AI coding agent that runs on your hardware, connects to the model providers you already pay for, and keeps your code local.