Open-source macOS assistant that processes local personal data with an on-device model, builds a local knowledge base and prepares proactive tasks for user-approved computer-use execution.
Product sources: Sentient OS official product surface + Y Combinator F26 company page
Sentient OS is a local-first proactive assistant for Apple Silicon Macs. Its current design runs nightly on-device processing, builds an editable knowledge base in plain Markdown and prepares proactive cards that can be executed through computer use only when the user approves them.1 A Sidekick mode can also take over an active Mac task with its own cursor while the user moves on.1
The product combines an on-device model for most context processing with optional frontier-model access supplied by the user through services such as ChatGPT/Codex, Claude, OpenRouter, LM Studio or a custom endpoint.1 The canonical repository is public and actively exposes the macOS app, security documentation and implementation materials; LICENSING.md states that the project is free/open source under GNU AGPL-3.0, with a commercial-license route for organizations that do not want AGPL obligations.2
Sentient OS itself is free and open source.12 There is no required Sentient subscription on the current consumer surface. Users who choose cloud/frontier models bear the cost or subscription terms of their own ChatGPT, Claude, OpenRouter or other model access; local LM Studio-style use can keep more of the stack on-device.1
The cost model is attractive for technically comfortable Mac users, but effective access also depends on compatible Apple Silicon hardware and the local resources needed for continuous or nightly inference. Organizations considering proprietary modification or embedding should review the AGPL-3.0 obligations or commercial-license option separately.2
Sentient's public SECURITY.md is unusually explicit about its trust boundary. The app requires Full Disk Access to read local data sources such as iMessage, WhatsApp and Apple Notes databases, and the repository says that this content is processed locally while cloud models receive PII-stripped summaries rather than raw source data.3 The product also needs Automation permission for its computer-use helper, which means installation grants meaningful control over the user's Mac.3
The optional MCP mirror is off by default. The security document says the Mac encrypts the knowledge base with AES-256-GCM before upload, the hosted mirror stores ciphertext, no account identifies the vault and unrefreshed mirrors auto-delete after 30 days.3 It also states an important limitation: the design does not claim protection against a malicious or compromised operator of the running mirror service because requests can be decrypted in memory using the key embedded in the bearer-secret connector URL.3
Those disclosures are useful, but they are still project-authored security claims. AiToolMap did not independently audit the source code, test the privacy invariants or perform exploit testing. The fixed 50-source panel also surfaced no eligible exact-product independent review, benchmark or numeric user-rating corpus, so external validation remains weak.
Sentient OS is best suited to privacy-conscious macOS users who want an assistant to synthesize context across local files and personal apps without continuously uploading raw source data to a vendor cloud.1 Y Combinator independently corroborates the active Fall 2026 company and the same on-device/proactive-computing product surface.4
It is less suitable for Windows/Linux users, people uncomfortable granting Full Disk Access or Automation permissions, buyers who need independently certified security controls, or organizations that cannot accept AGPL obligations without a separate commercial license. Users should also treat the optional mirror connector URL as a secret and review exactly which local sources Sentient is allowed to ingest.
free/open-source distribution; local Markdown memory; substantial on-device inference; user approval before proactive actions fire; support for local or user-supplied frontier models; transparent licensing; and unusually detailed public disclosure of Full Disk Access, secret handling, mirror encryption and explicit threat-model limits.132
very young product; macOS-only focus; powerful device permissions; some higher-capability workflows depend on external model accounts; the opt-in mirror has an honest but material operator-compromise limitation; and independent product/security evidence is currently sparse. Open source improves inspectability, but it is not itself proof that the implementation satisfies every stated privacy invariant.
Products matched by shared tasks, audience, workflow, product type and capabilities.