This 600-Star Swift Agent Lets AI Operate Your Entire Mac — Safely

Architecture: One App, Two Layers

AgentiLoop Agent (Agent!) is a native Swift 6.2 macOS application (MIT licensed, 600+ stars) that runs on macOS 26.4+ with Apple Silicon. Its structure is summarized as: an outer "brain" layer connecting to 23+ cloud model providers (Claude, Gemini, Grok, DeepSeek, GLM, Qwen, DashScope, MiniMax) plus local options (Ollama, LM Studio, vLLM) and Apple Intelligence running on-device for free classification, summarization, and token compression; and an inner "hands" layer covering four control planes: code and Xcode (reading, diffing, native building, git), any Mac app via accessibility APIs (25 element-level actions with fuzzy matching and auto-retry), scripts and shell (AppleScript, JXA, user and root privileges via LaunchDaemon), and iMessage/voice (remote control via SMS or saying "Agent!"). An autonomous task loop — reason, execute, observe, self-correct — chains these capabilities until the goal is met.

Deep System Integration: Apple Ecosystem to the Bone

Unlike tools that simulate clicks, Agent! uses system-level integration. App control goes through the Accessibility API with 25 element-level actions targeting semantic elements ("this button") not coordinates, with fuzzy matching and automatic retry. The script layer includes AppleScript, JXA, and 51 ScriptingBridge application bridges, all running in-process with permissions managed by the system TCC framework.

A standout mechanism is AgentScript: users write ordinary Swift files that are compiled at runtime into dynamic libraries loaded into the process, directly reusing Agent!'s system permissions — granting access to Calendar, Mail, Contacts, Photos, etc. The project ships with 35 ready-made examples: checking today's schedule, reading unread mail, packaging DMGs, archiving Xcode projects. The LLM creates and modifies these scripts; the human audits them.

For root-privilege scenarios, Agent! registers a proper LaunchDaemon: the user approves once, and every subsequent invocation undergoes signature verification and full audit.

Preventing AI "Mischief": An Engineering Case Study

The article details the reliability engineering that makes automation trustworthy:

Tasks cannot self-declare completion. Each task defines a goal_state with explicit acceptance criteria. The AI must attach evidence to every criterion; a critic role can review the diff before delivery.

Read before edit. Edit tools refuse to operate on files not yet read or whose on-disk SHA-256 has changed externally — preventing hallucinated edits. Every edit step snapshots the file, enabling one-click rollback or full task rewind.

Double-layer dangerous command interception. Commands like rm -rf / are hard-coded blocked on both client and server-side daemon; the LLM cannot bypass them. Anti-hallucination: if the LLM claims an action (click, search) without tool output, the system detects and injects a correction.

Context management for long tasks. Compression thresholds are dynamically calculated from the model's actual context window. After compression, goals and plans are re-attached; oversized tool outputs are spilled to disk and fetched on demand.

273 automated tests and a deadlock guard that halts after repeated failures hit a ceiling.

Getting Started and Target Audience

Installation: drag the app into Applications, open it to auto-configure, then pick a provider and paste an API key in settings. The author recommends GLM-5.3 via Z.ai for simplest registration and cheap pay-as-you-go — near-zero barrier for Chinese users. Fully offline operation is possible with local Ollama.

Hardware gate: Apple Silicon + macOS 26.4+ only. Running 30B-class models locally requires 64 GB RAM minimum; otherwise use affordable cloud APIs.

The README demo has Agent! play chess against Claude: each move includes reasoning, notation, and completes in ~7 seconds — a concrete illustration of the observe-think-act loop.

Everyday automation use cases: organizing photos, querying calendars, batch renaming files, monitoring email — tasks that previously required hand-written AppleScript, now reduced to a single sentence.

Honest Limitations

Young project (~600 stars), essentially single-maintainer. All dependencies are hand-written (clean), but bus factor is 1; if the author stops, the project stalls. Serious workflows should factor this in.

Source is MIT, but official Release binaries retain copyright — free to use, but rebranding/redistribution requires building from source.

Ecosystem is early compared to cross-platform projects like OpenClaw; Mac-only naturally halves the potential audience. Conversely, Mac user density and willingness to pay may make this niche viable.

Siri Answers, Agent! Acts

The project's tagline — "Siri answers, Agent! acts" — captures its essence. Apple has long promised system-level AI operation but hasn't delivered; a third-party Swift project shipped "AI takes over the whole Mac" as a finished product, and simultaneously produced a 273-test engineering specimen for "how to make AI actions trustworthy." The next phase of the agent race isn't about who's smarter, but whose actions can be trusted. This project scores on both fronts; heavy Mac users should install and try it.

https://github.com/AgentiLoop/Agent