Put the fleet
to work.

01What is Redeep

Redeep is a native macOS app for agentic coding and data-analysis work. Instead of one chat, you run a team of agents — each in its own isolated session — and manage them like work on a Kanban board. Agents can read and edit files, run code and shell commands, analyze data, drive a real browser, operate other Mac apps — and publish what they build as live sites served from your Mac.

Two ideas make it different from a browser-tab assistant:

• Bring your own keys. Route across five cloud providers or run open-weight models on-device. No markup, no lock-in — you pay your provider directly, or nothing at all for local models.
• Native, not Electron. A real macOS app: fast, private, and integrated with the system. Your code and credentials stay on your machine.

02Requirements & install

Requirements

• macOS 14 (Sonoma) or later.
• Apple Silicon (M-series) — required for on-device inference.
• An API key or account from at least one supported provider (or use on-device models with no key at all).

Install

1. Download Redeep for macOS — it's free.
2. Open the downloaded .dmg and drag Redeep into your Applications folder.
3. Launch it from Applications. On first run, macOS confirms opening an app from an identified developer — the build is signed and notarized.
4. Open Settings (⌘,) and connect a model.

Installing to /Applications matters: macOS only grants system-notification permission to apps that live there, so board and session notifications work once Redeep is in your Applications folder. Redeep also stays resident in the menu bar when you close the window — and the kraken in the menu bar swims while agents are working, so you can tell at a glance.

03Connect a model

Redeep never ships its own inference. You connect a provider you already have — the key is stored in the macOS Keychain, never written to disk or a config file. Open Settings (⌘,) → Models.

Fastest: Connect with OpenRouter

Click Connect with OpenRouter. Redeep opens your browser to authorize (OAuth), then saves the issued key to the Keychain and makes OpenRouter the default. One account reaches most major open-weight and frontier models.

Or bring a key from any supported provider

Paste a key into the provider's field and click Save. Mix and match freely — Redeep routes each task to the model that fits it.

On-device & Apple Intelligence

Redeep runs open-weight models locally with MLX — fully private, no key, no network. Local models handle the cheap, high-volume long tail (compaction, commit messages, routing); the main agentic loop runs on a capable cloud model. Apple Intelligence is available as an additional helper tier.

Power users: environment variables

For each provider Redeep reads the Keychain first, then falls back to an environment variable: OPENROUTER_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, AI_GATEWAY_API_KEY.

04Sessions & approvals

A session is one conversation with an agent working toward a task. You give it a goal in plain language; it plans, calls tools, and reports back. Sessions are persisted — close the app and pick them up later — and each runs against its own workspace. Point a new session at any folder, or clone a Git repository (a URL or owner/repo) straight from the New Session sheet.

Approvals

Every tool has a safety class so you stay in control of anything consequential:

• Auto — read-only actions (reading files, searching, listing) run without a prompt.
• Gated — anything that writes or executes (editing files, bash, running code) asks for approval; you can allow it once or for the rest of the session.
• Critical — high-impact actions like desktop control always prompt, every time.

Output that could carry hidden instructions — fetched web pages, tool results from external servers — is wrapped and treated as data, not commands, to guard against prompt injection.

05Project boards

Boards are how you manage many agents like a team. A board is a Kanban board where every card is a session — a durable agent conversation plus its board metadata.

• Columns you define (e.g. To Do → Doing → Done, or a full Backlog → In Progress → In Review → Done pipeline from a template).
• Worktree isolation. Cards working in the same repo each get their own git worktree, so parallel agents never collide. Parallelism happens across cards; within a single card, work runs serially.
• Column actions. Attach a natural-language instruction to a column that runs automatically when a card enters it, or only when you press ▶. A batch column action can run once over all the cards in a column.
• Tag to dispatch. Comment @Redeep <instruction> on a card to enqueue work for the native agent — or hand it to an external CLI with @codex or @claude. Multiple tags queue up and run in order.

Cards show live status — running, or needs-you — as in-app badges and (when installed in /Applications) macOS notifications.

06Built-in tools

Agents have 30+ built-in tools out of the box (more when you connect boards, credentials, or MCP servers). The philosophy is structured tools first for reliability, with bash as the escape hatch and run_code for stateful compute.

07Data analysis & run_code

run_code is a persistent Python kernel — like a notebook cell. Variables, imports, and loaded DataFrames stay alive across calls, so you can build up an analysis step by step.

• Batteries included. The managed environment ships pandas, numpy, scipy, matplotlib, plotly, pyarrow, duckdb, openpyxl, requests, and lxml. Need more? install_packages adds them on demand.
• SQL over your files. query_sql runs DuckDB across workspace files (CSV, Parquet, Excel) and the kernel's own DataFrames, sharing state with run_code.
• Interactive charts. Plotly is the preferred path — figures render as interactive charts in the notebook canvas, with matplotlib captured inline too.
• Interactive artifacts. Agents can build full HTML pages — dashboards, widgets, mini-apps — rendered safely in a sandbox. Buttons you press and form inputs you set in an artifact flow back to the agent with your next message, so a page can drive the conversation.
• Big outputs stay readable. A large DataFrame sends the model a head + shape + dtypes, while the full result is persisted and rendered for you.

08Deployments & sharing

Anything an agent builds — a dashboard, a report, a small site — can become a live URL served from your own Mac. No hosting account, no upload: Redeep runs a local web server, and your deployments stay up across app restarts.

Deploy

• From the Files panel. Right-click any file or folder and choose Deploy.
• By the agent. The gated publish_artifact tool lets an agent publish what it just made and report the URL back to you.
• Manage it all in the Deployments tab (⌘3) — every deployment with its URL, share state, and delete.

Deploys are smart about what you hand them. A folder with no index.html offers a choice: an AI-designed landing page or a clean file listing. Spreadsheets and CSVs get a preview page with a proper download button. Pages that reference external images can be inlined into a self-contained bundle at publish time.

Share it — three reaches

• This Mac & your LAN. The default — reachable on your machine and local network.
• Your tailnet. Share over Tailscale to your private network, so only your devices and teammates on the tailnet can reach it.
• The internet. Share publicly through a Tailscale Funnel or a Cloudflare quick tunnel — a real HTTPS URL, still served from your Mac.

Click the globe on any deployment to open the share popover. If a tunnel provider isn't set up yet, Redeep shows the exact steps — or installs it for you.

Control who can view

• Secure links. Restrict a deployment and share the link that carries its key — anyone without it gets nothing. Rotate the key to instantly revoke every old link.
• Per-person access. Allowlist emails or whole domains. Each person gets a private link you can copy into iMessage or Slack; removing them from the list revokes it immediately.
• Automatic sign-in emails (optional). Visitors request access on a sign-in page, and allowlisted addresses receive a one-time link by email.

09Computer use

With Desktop Control enabled in Settings, the computer tool lets an agent operate your Mac the way you would. It's off by default and its actions are critical — they always prompt for approval.

• See the screen. Take a screenshot for a vision model, or read the accessibility tree as text (headings, messages, rows, and controls with their positions).
• Act by meaning, not coordinates. Click or type on an element by its accessibility label and role; Redeep resolves it to the live on-screen position rather than guessing pixels.
• Full control. Click, double-click, scroll, type, key combos, open apps, use menus, and read or set the clipboard and selected text.

10Skills

Skills are reusable playbooks — packaged know-how an agent loads on demand via use_skill, so you can teach it something once and reuse it everywhere. A skill can be a single Markdown playbook or a folder bundle with supporting files and scripts. Redeep ships 26 starter skills across categories, and you can add your own.

11Sub-agents

An agent can fan work out to focused sub-agents with dispatch_subagent. Read-only sub-agents run in parallel to gather context; a writer works in an isolated git worktree and returns a diff, which the main agent lands through the gated apply_subagent_changes. Six starters ship in the box:

• explore — read-only codebase explorer; fan out one per question. Never modifies files.
• spike — research-and-verify scout for external APIs and libraries; reads real docs and runs a minimal probe, reporting what's verified vs. merely documented.
• architect — read-only design partner; proposes architecture, trade-offs, and a phased plan.
• engineer — implements a focused change in its own worktree and returns a reviewable diff.
• reviewer — read-only critic; returns cited findings ranked by severity.
• site-designer — turns a folder of files into a polished, self-contained landing page, ready to deploy.

12MCP & external agents

MCP servers

Connect your stack over the Model Context Protocol — local servers on your machine or hosted ones, with OAuth sign-in where a service requires it. Add servers in Settings → Plugins, search the official MCP registry from inside the app, or let the agent find one — an agent-proposed server always goes through a gated approval. Their tools appear to agents namespaced as mcp__server__tool.

Per-server secrets go in the Keychain, and every tool can be individually allowed, gated, or blocked. Trusted servers' tools run automatically; everything else asks first. When a connected catalog grows past a handful of tools, agents get a compact discovery surface — search the catalog, then call the tool they need — instead of hundreds of tool definitions crowding the model. MCP runtimes (node, npx, uvx, python) are located from your system — nothing is bundled.

External agents

Hand a task to your own Codex or Claude Code CLI with dispatch_external (or the @codex / @claude card triggers). The delegated agent runs out-of-process on your account and billing, in an isolated worktree, and returns a report plus a reviewable diff. Redeep never injects your API keys into these tools.

13Privacy & security

Redeep is built so your work stays yours.

• Local-first. The app runs natively on your Mac; open-weight models run fully on-device with MLX. When you use a cloud model, requests go directly to your provider on your key.
• Secrets in the Keychain. Every key and credential lives in the macOS Keychain — never on disk, never in the repo.
• Sandboxed execution. bash and run_code run inside a macOS Seatbelt sandbox that confines writes to the session's workspace and blocks reading sensitive directories (SSH keys, keychains, cloud credentials).
• Workspace jail. Structured file tools refuse paths outside the workspace unless you opt in; reference repos can be added as read-only roots that writes can't touch.
• Isolation by default. Sub-agents, external agents, and parallel board cards each work in separate git worktrees; their changes only land through a gated diff review.
• Sharing on your terms. Deployments are served from your Mac under a strict content-security policy. Nothing is reachable beyond your machine unless you share it; secure links are revocable in one click, and removing someone from an allowlist locks them out immediately.
• Injection-aware. Untrusted content (web pages, external tool output) is framed as data, not instructions.