Which AI hosts can connect to Luti?

Any host that speaks MCP — cloud or local, web app, desktop app, IDE or command line. ChatGPT, Claude, Grok, Codex and Cursor are examples, not an allowlist. The main path is a cloud chat: it registers itself through OAuth dynamic client registration and waits for you to approve it on the Mac. Clients already on the machine take a shorter road over localhost, with no domain and no tunnel.

No. Luti ships no model, no planner and no second agent loop. Reasoning, planning and orchestration stay with the host. Luti owns the project boundary, the persistent context, the local capabilities, the approvals and the audit record.

How does project memory work?

Context is stored in three layers. Activity records every tool call. A session journal records what a runtime session changed. Project memory holds the durable semantics — architecture, decisions, conventions, constraints, security notes, pitfalls, goals and rationale — written explicitly by the model with its source, revision and supersedes chain preserved. Memory is scoped per project; there is no global profile and no cross-project merge.

Does my traffic go through Luti's servers?

No. The tunnel is your own: the request goes host to tunnel to your Mac, and Luti runs no server in that path. Nothing there needs a Luti account either — the app is free and open source, and it runs entirely on your Mac.

Is a project scope the same as a sandbox?

No. A project scope is a semantic boundary, not an OS sandbox: an approved process runs with your user's permissions. A tunnel is not authentication, OAuth is not tool permission, and tool permission is not macOS TCC. Execution policy and checkpoint restore have shipped. An OS-enforced sandbox backend has not, and until it does, a workspace or isolated process fails closed rather than quietly running unsandboxed.

Nothing. Luti Desktop is free and open source under Apache-2.0, and everyone gets the complete product. The Mac app source is on GitHub, and official builds are Developer ID signed and notarized by Apple.

Open source macOS project runtime

Cloud AI.
On your Mac.

Any chat that speaks MCP gets one shared project memory and 29 local capabilities. The code, the execution and the context stay on this Mac.

See how it works Download for Mac

ChatGPT chatgpt.com

@luti first time on this project — give me the background

Connected. acme-dashboard — 24 memories, 7 sessions, 29 tools.

Codex localhost

@luti which project am I on?

acme-dashboard — the same project, and the same context, as the IDE and the web.

Claude claude.ai

@luti are you connected?

Connected. Active project is acme-dashboard — vite · pnpm · tsc.

Grok grok.com

@luti is the dev server still up?

Connected. job_7c31 is still running — 18 passed, 0 failed.

MCP

your own tunnel

Luti memory → waiting for a call acme-dashboard

queue.ts — ~/dev/acme-dashboard Lutiedit_files

1import { open } from "./sqlite"
2export async function createQueue() {
const db = await open("queue.db")
await db.exec(
  "CREATE TABLE IF NOT EXISTS jobs (" +
  "id TEXT PRIMARY KEY," +
  "payload TEXT NOT NULL)"
)
return db
10}

Preview — acme-dashboard Lutibrowser_observe

localhost:5173

Queue
SQLite · 3 workers ready

Project memory memory

Memory Sessions Activity

conventionclaude · 2d

pnpm only. CI rejects npm lockfiles.

pitfallcursor · 5d

The /api dev proxy needs changeOrigin, or cookies are dropped.

constraintchatgpt · 9d

The local queue must not depend on the network; it has to persist offline.

24 memories · 7 sessions

Claude → MCP · localhost → Luti · project runtime → acme-dashboard

Project context

The project remembers. Not the model.

Architecture, decisions, conventions, the mistakes already made — they stay with the project. Change models, change clients, and it is still one context.

Project Memory

What this project should know for the long run. Written explicitly by the model, each fact carrying its source, its revision and what it supersedes. Rewriting an old conclusion means naming its revision — conflicts are rejected, never silently overwritten.

architecturedecisionconvention constraintsecuritypitfall goalrationale

Session Journal

What a session actually finished. Files changed, jobs run, whether the tests passed, what failed and how it recovered. Never the transcript, never command arguments, never output bodies.

changed pathsjobs and resultsfailures and recovery

Activity

What happened on every single call. Event-level, generated automatically, verifiable — for auditing and for working out what went wrong. Who called what, when, and how it ended.

callertool and effecttimeline

Memory is a tool, not a black box

memoryaction=recent 24 memories · 7 sessionssummary
memoryaction=recall query="local queue"3 matches
memoryaction=remember kind=decisionmem_9f3c1 · rev 42
memoryaction=sessions last 7 sessions18 calls · 4 paths
memoryaction=forget mem_2b7e0history preserved

Local capabilities

Read it, change it, run it.

Not a description of the command it would run. The work happens on this Mac, and the result comes back into the conversation exactly as it is — including from a chat that has never been on this machine.

Read and rewrite

Build a picture of the structure, dependencies and entry points first, then search, read and edit. Changes stay inside the project scope, every one of them takes a checkpoint first, and the Git state is there to check.

Run it and watch it

Builds, tests and dev servers run as long jobs. Pull the logs whenever you want, stop a job when you need to. One call never sits there blocking the conversation.

Open a browser and check

Open the local preview, click into it, see what really renders. Screenshot, save a PDF, read the console and the network. Whether the change worked is something to look at, not guess.

Where the web cannot reach

Native windows, system dialogs, apps that need a real click — that is Computer Use. It waits for a state to appear instead of sleeping and hoping.

The project’s own skills

Skills and instructions written into the project become capabilities of that project.

Artifacts come back whole

Screenshots, PDFs and build output return as MCP resources, ready to open or download. No going off to hunt through folders.

How it works

The model thinks above. Luti works below.

The host owns understanding, planning and orchestration. Luti owns the project boundary, the persistent context, the local capabilities, the approvals and the record. Between them, only MCP.

Four moves in one task

1
Recall

Read the project before touching it: what this is, what the conventions are, where the last session stopped.
2
Act

Edit files, start processes, drive a browser. Each action has one clear intent and runs exactly once.
3
Verify

Check what actually happened through Git, job results and the browser — rather than restating the intent.
4
Remember

Conclusions worth keeping go back into project memory. The next AI picks up from there.

The same task, as Activity records it

memoryaction=recall "local queue"3 matches
inspect_projectdepth=2 vite · pnpm · tscok
read_filessrc/queue.ts 142 linesok
edit_filesaction=edit +12 −3confirmed
run_processpnpm test job_7c31submitted
job_queryaction=logs 18 passed · 0 failedok
memoryaction=remember kind=decisionmem_9f3c1

Product boundary

A runtime, not another agent.

Luti does not compete with your AI for the work — it gives that work solid ground to stand on.

Luti owns

Project identity, approved scope and switching
Storage, provenance and revision of persistent context
Execution of local capabilities and return of results
Approval before an action, a record after it
The full lifecycle of connections and OAuth

The model owns

Understanding the task, reasoning, planning
Breaking it down and choosing which tool to call
Judging what is worth remembering long term
Resolving semantic conflicts between memories
Retries, subagents and multi-turn orchestration

Persistent context belongs to Luti.
Context intelligence belongs to the model.

Project capability belongs to Luti.
Reasoning and orchestration stay with the host.

Security

Your Mac. Always your call.

The boundaries are written into the system’s semantics, not promised in copy.

One active project at a time Projects are added by you, on this Mac. A remote host can switch between the ones you approved — it cannot name another path, and it cannot create one.
Switching projects swaps the whole context The old workspace, jobs, browser and artifacts are revoked together; memory and sessions follow the new project. The connection stays up and the identity stays the same.
Registering is not permission A client can register itself through OAuth dynamic client registration — but that only gets it in the queue. Without you pressing Allow on this Mac, not one call gets through.
You can tell who is connecting Known platforms are recognised by their OAuth redirect host; local clients come in over loopback; everything else is shown as a custom client. Recognition is for display, not an allowlist.
Every call leaves a trace Who, when, which tool, what came of it — all written into the activity record. The origin is derived from the authenticated context and cannot be forged through a parameter.
A change can be taken back Every file edit and every path change writes a private checkpoint first — before-image, SHA and mode. Restore runs on this Mac with the runtime stopped, and if anything moved underneath in the meantime it refuses rather than guesses.
Project context stays out of your repo Memory, sessions and activity live in ~/.luti/ — directories 0700, files 0600. Real secrets go to the Keychain: never to disk, never to a log.
Off means off If you do not start it, it does not work. Stopping it closes connections, jobs and browsers together. Nothing stays behind.

Where the boundary ends

A project scope is a semantic boundary, not an OS sandbox. An approved process runs with your user’s permissions.
A tunnel is not authentication. OAuth is not tool permission, and tool permission is not macOS TCC.
Only what passes through Luti is Luti’s responsibility. What a host runs elsewhere on its own is outside it.
There is no OS-enforced sandbox yet. Execution policy and checkpoint restore have shipped; a workspace or isolated process fails closed rather than quietly running unsandboxed.

Tool surface

Eight groups. 29 tools.

A fixed public surface: nothing new appears at runtime because of something said in a conversation. To extend it, change the project — manifest, instructions, skills.

Context1

Recall, remember, review, list sessions, forget logically.

Project4

List and switch approved projects, detect the stack, read runtime state.

Files & code7

Search, read, edit, move — plus structured symbol queries.

Processes & jobs4

Start long jobs, pull logs, stop them, answer interactive prompts.

Git1

Status, diff, log, branches — read only. It does not commit for you.

Browser7

Sessions, navigation, interaction, screenshots and PDFs, console and network, dialogs, evaluation.

Computer Use3

Observe the screen, click and type, wait for a state to actually appear.

Skills & artifacts2

Run the project’s own skills; hand artifacts back as resources.

All 29 tools

Context

memory

Project

projectsproject_infoinspect_projectruntime_status

Files & code

read_filessearch_projectlist_directoryread_imageedit_filespath_actioncode_query

Processes & jobs

run_processrun_shelljob_queryjob_action

Git

git_query

Browser

browser_sessionbrowser_observebrowser_actionbrowser_inspectbrowser_transferbrowser_dialogbrowser_evaluate

Computer Use

computer_observecomputer_actioncomputer_wait

Skills & artifacts

skillsexport_artifact

Connections

Cloud AI, straight to this Mac.

The path is short on purpose. A chat in the cloud speaks MCP, comes in through an entrance you own, and lands on one approved project. A client already standing on this Mac skips the entrance entirely.

Who connects

A chat in the cloud

ChatGPT, Claude, Grok — any web chat that lets you add a custom MCP connector. Give it your HTTPS entrance; it registers itself over OAuth, you approve it once on this Mac, and it is on the project. This is the path Luti is built for.

custom connectordynamic registrationone approval

A client already on the Mac

Cursor, Codex, Claude Code. These already have hands of their own — what they get from Luti is the shared part: the same project memory, the same history, the same boundary as every other host. Point one at localhost and it is connected.

local MCP serverlocalhostno account

And the entrance it comes through

Your own Cloudflare Tunnel

Your account, your domain, your tunnel. Requests reach this Mac from your provider — never through a Luti server — and the token goes straight to the Keychain. Quick Tunnel, OpenAI’s Secure MCP Tunnel and ngrok arrive with 1.0.

Local MCP

No entrance at all. A client on this Mac connects to localhost — no domain, no tunnel, no account. That local key is loopback only: it will not open the remote entrance.

Get started

Four steps to put a cloud AI on this Mac.

Everything below happens on your machine and in your own accounts. Nothing is registered with Luti.

Install it and add a project Download the signed build or compile it from source. Add the project folder you want to open up and start the runtime — this step defines the boundary for everything that follows. Projects
Open your own entrance Point a Cloudflare Tunnel on your own domain at Luti and paste the token in. It goes to the Keychain; the address is yours, and so is the account behind it. Cloudflare
Add the connector in your AI In ChatGPT, Claude or Grok, add a custom MCP connector and give it that address. It registers itself — there is nothing to fill in by hand. MCP · OAuth
Press Allow Once the remote side finishes OAuth registration, an approval appears on this Mac. You press Allow, and only then does the conversation reach the project. Allow

A client already on this Mac needs none of it: point Cursor, Codex or Claude Code at localhost and it is on the same project, with the same memory.