Inside Izuran Pro

How a local assistant runs on your Macs

Izuran Pro is not a wrapper around a hosted API. It is a native Mac app with its own agent harness, a Python MLX engine, and a phone link with no relay server of ours. This page walks through how that works.

Get notified Back to the overview →

Mission

Build, harden and release an honest local assistant

No telemetry, no analytics and no relay server of ours: the phone talks to your Mac directly, and notifications go through Apple’s push service. The work is to keep that line clean while letting the assistant do useful work across your Mac, your accounts, your phone and your home.

Architecture

Three layers that make Izuran Pro what it is

The harness, the engine, and the policy and signatures around them. Each layer is separate; together they keep your data, your prompts and your assistant’s reach on your side of the line.

The harness: Izuran’s own, in Swift

The assistant runs in Izuran’s own harness, a Swift package written for Izuran Pro and run inside the app’s own process. It speaks Apple’s Foundation Models vocabulary: tools are Foundation Models tools, a conversation’s history is a transcript, and every model, whether the engine serves it on this Mac or a model server on your network does, is a route. Each conversation is one append-only log, drawn natively in SwiftUI on the Mac and the iPhone. You extend it with skills, MCP servers and Shortcuts.

One append-only log per conversation feeds the transcript, activity and stats
Plan mode, background jobs, and undo and restore for every turn
Access levels (Read only, Project, Full) and standing answers, each answer recorded
Questions and approvals offered to the Mac and the iPhone at once
Weather, Maps, Music and Hue run in the app’s own process, under its signature
Memory as files Spotlight indexes; conversation titles from Apple’s on-device model

Swift
Foundation Models
SwiftUI
MCP
WebKit

The engine: MLX on your Mac

Models run in a Python MLX engine built in three layers: a signed runtime (CPython and MLX), AIC’s fork of mlx-lm with the model ports, parsers and speculation, and Izuran’s own server, which imports mlx-lm as a library and patches nothing. The runtime comes inside the app and is verified on each Mac before it is used. A model counts as served only after it answers a real completion. Two Mac Studios joined by a Thunderbolt 5 cable can split one model across both, or run copies behind one endpoint; that is built and in testing.

A signed runtime index that pins every archive’s size and SHA-256
A per-Mac verification gate before activation
A prompt cache that spills to disk and survives reloads and updates
Admission control by queue and memory; a person’s turn before background work
Prometheus metrics at /metrics, under vLLM’s names
Updates applied as one transaction; two-Mac split and copies in testing
A privileged helper for memory limits, networking and power, running only while Pro does

MLX
mlx-lm (AIC fork)
Python 3.13
Thunderbolt 5
XPC

Local by policy, signed end to end

Izuran Pro refuses any model server or MCP server outside your Mac and your network. Reading and searching the web are off until you turn them on. It is signed with Developer ID, notarized by Apple and hardened; it is not sandboxed, so macOS asks you for each resource the assistant’s tools reach. Updates are signed; the app checks the signature, downloads in the background and applies an update when you restart it, or at an idle moment three days after it is ready.

A local-only policy for models and MCP servers; web reading and search opt-in
Developer ID, notarization, hardened runtime; a stapled disk image
EdDSA-signed updates (Sparkle), applied at a restart, never while Izuran works
Its own tools ask macOS under Izuran Pro’s name; a command you let it run asks under its own
Mac access: each grant with its state and next step
Its own secrets in the Keychain

Hardened Runtime
Notarization
Sparkle
Keychain Services
CryptoKit

Engineering highlights

Worth pulling out of the codebase

Decisions and details that shape how the app feels in your hands.

The iPhone’s own door

The phone pairs with a 16-character code, and both ends derive a key from it: the link is TLS with that pre-shared key and an ephemeral key exchange, so the code authenticates both sides, there is no certificate to trust, and a recorded session stays sealed even if the code leaks later. Pro advertises it under an opaque Bonjour name. Over cellular the phone uses your own Tailscale.

Decisions on every screen, presence for the risky ones

Every question and approval goes to the Mac, the iPhone and a notification with buttons at once; the first answer settles them all. A payment, a host no standing answer allows, a write outside the project, or a place where keys and passwords are kept needs Touch ID or the Mac’s password, or Face ID on the iPhone. A question waits a short while, then Izuran goes on, and a later answer reaches the conversation as your message.

A TV screen with a real remote

Izuran Pro draws its own screen on a TV display. The phone streams raw touches over DTLS, and the Mac’s focus engine reads swipes, taps and holds the way an Apple TV does.

Answer cards

What a tool found comes back with the data to draw it: calendars, contacts, mail, weather, places, lights, a purchase through Link (never its card). The Mac draws full cards; the iPhone and the TV draw the same values compact.

Speeds are MLX’s own

Izuran never times its speeds itself. The tokens per second under each turn, and in the engine’s metrics, are the figures mlx-lm measured while it generated.

The fine print

How we treat your data

The architecture is one half of the trust story; the policies are the other. The privacy policy is the one the Mac apps carry, for Izuran and Izuran Pro. The terms of use are the Mac App Store edition’s; Izuran Pro’s own terms come with its release.

Hear when Izuran Pro ships

Join the waitlist for Izuran Pro and Izuran for iPhone. To point your own tools at the engine’s OpenAI-compatible endpoint, write to contact@izuran.ai.

Get notified Email us →