Questions.

What do I need before it works?

A Mac with Apple silicon on macOS 13 or later, and one API key. No Docker, no Python install, no runtime to set up, no account to create with me. One app that runs on a stock machine on the day you get it.

Do I need the key before I can even look at it?

No. Safata opens with no key at all. The workspace is live, a worked example is already sitting on the shelf, and a few ready-made actions come installed, so you can see what it produces before you commit to anything.

The key is asked for at the first thing you send. You type your message, Safata asks for a key, and once you paste it your message goes on its way. Nothing you typed is lost to the interruption.

Do I need to know how to code?

No. When code is the right tool, for parsing a document, crunching a file or cleaning a dataset, Safata writes and runs it and hands you the result. You don't have to read the code, but it's always there to see: every command runs past you before it runs at all.

It isn't a coding agent; repositories, review queues and test suites belong to those. But if you're the kind of knowledge worker who knows what an API key is, you're who it's built for today.

I already pay for ChatGPT, Claude or Gemini. Can I use that?

No, and it is the first thing to know. Those are consumer subscriptions, and no vendor lets a third-party app sign in with one. Safata needs an API key: a separate, pay-as-you-go developer account at the same company, with a card on file, billed per use, not per month. Same models, a different door.

What you get for the second account: you pay for what you use, and the account, the invoice and the off switch are all yours. The memo on the front page cost three cents. The day a vendor offers a supported way to sign in with a subscription, it becomes a method here; I will not build one against an undocumented flow that a vendor can switch off remotely.

What is an API key, and why doesn't Safata just include one?

It’s how a model provider identifies your account and bills you. You hold the key, so you hold the account, the invoice, the usage data and the off switch. When model prices fall, the saving lands on your bill, with no middleman. Getting one takes about two minutes, and the day you want to stop, you revoke it.

Later there will be a paid cloud plan for people who’d rather not manage keys: a plan fee for the hosting, with model access passed through on the same bill at provider prices and no markup. The direct key stays free and stays the default.

Where do I get one?

Pick one provider to start. One is enough, and you can add others later without redoing anything. Sign up, add a payment method or a small credit, create a key, and paste it in. If you have done this before it takes about two minutes; if a developer console is new to you, allow ten, and Safata's connect card walks you through the screens.

• OpenAIplatform.openai.com/api-keys
• Anthropicplatform.claude.com/settings/keys
• Googleaistudio.google.com/apikey
• Mistralconsole.mistral.ai/api-keys
• xAIconsole.x.ai
• DeepSeekplatform.deepseek.com/api_keys
• Moonshotplatform.kimi.ai/console/api-keys
• Z.aiz.ai/manage-apikey/apikey-list
• OpenRouteropenrouter.ai/keys — one key, hundreds of models

Safata walks you through this in the app too, which is the version that can't go stale.

Where is the key kept?

In your operating system's credential store: Keychain on macOS, Credential Manager on Windows. Not in a config file, not in a dotfile, not on any machine of mine.

A key is only ever sent to the provider it belongs to. Your Anthropic key cannot end up on a request to anyone else, enforced at the point the request leaves the machine.

What does it cost to run?

It depends far more on which model you pick than on anything Safata does; the gap between the cheapest and the most expensive model on the list is more than a hundredfold. Two measured numbers. In a live test, one small task took under two minutes and cost about $0.03: read a sales export, work out what's going on in it, write the memo. And the internal suite that runs seven reference jobs across several vendors cost $4.63 in its latest full run.

You can cap it: every session takes a spend limit, and a session that reaches it stops.

What does “local” mean here?

The agent itself, your files, your transcripts, your deliverables, the code it runs and the search over your own history are all on your machine, and stay there. There is no server of mine in the path: none to be down, none to be breached, none to change its terms.

The model is the exception: inference happens at whichever provider you chose, over your key. So the text of your turn goes to that provider and the answer comes back. Local means your data, your compute, your storage, your control. It does not mean the model runs in your living room.

Running models on your own hardware is a natural fit for how Safata is built and it isn't supported today. When it is, I'll say so here.

So what exactly goes over the wire?

Only what the model needs for the turn you asked for, and there’s a log of it. Every request Safata sends passes through a single inspectable point, so you can check the claim instead of taking my word for it.

One boundary: a shell command you’ve approved runs as a real command under your account. The approval and the exact command are recorded, but traffic the command itself makes isn’t intercepted, which is why commands that reach the network sit behind the gate in the first place.

Where is my data processed?

On your machine, and at the model provider you chose. Nowhere else. Safata has no server, so there is no region of mine to ask about; the region and the terms that apply to the text of your turns are the provider's, and the roster below names where each one is based. If your organization has a rule about which providers may see its data, pick from the list accordingly: a key is only ever sent to the provider it belongs to, and the log shows every host that received anything.

Is there telemetry?

None. No analytics, no crash reporting, no usage pings, no account, no licence check phoning home. Not as a setting you turn off; there is nothing there to turn off.

The cost: I can’t see what breaks for you, so I’m dependent on you telling me.

Will my data be used to train models?

Not by me; I never see it. What the provider does with API traffic is governed by that provider's terms, and the major ones say they don't train on it by default. That’s their promise to you, not mine, and one more reason the choice of provider is yours.

Does it work offline?

Your files, your past sessions and the search over them all work with no network at all. New turns need to reach the model you chose, so those don't.

Which models can I use?

US — OpenAI · Anthropic · Google · xAI Europe — Mistral China — Moonshot · DeepSeek · Z.ai Hundreds more — via OpenRouter

Each of the direct providers is built against natively, with its own harness. OpenRouter is one key that reaches the long tail, including model families no one else routes to.

Which one should I pick?

Start with whichever provider you already have an account with; it matters less than the internet says. If you have none, the frontier models from OpenAI, Anthropic and Google are the safest first choice for hard work, and DeepSeek is the one to know about when the volume is high and the budget is not.

Then change your mind freely. Switching models is a menu, not a migration, and the sessions you've already done stay where they are. And the way to know is the receipt under a session, not the benchmark: your brief, your folder, the clock and the cost.

A model came out this morning. How do I try it on my own work?

Get its vendor's key (two minutes, the links above), paste it in Settings › Model, tick the model, open a new session on it and paste last week's brief. The receipt under the session — clock, cost, what left the machine — is the benchmark that matters, because it is your data. Through OpenRouter the same model is one tick on the shelf, and the catalog says whose cloud it runs on.

Nothing you did on the old model moves: sessions keep the model they were written in, and the memory every model searches is on your disk. The front page's fourth case is this, done on 23 September with Kimi K3: one key, the same folder, $1.61 to know.

Can I run more than one at once?

Yes, and it's the intended way to work. Open a second window and you have a second agent, on the same model or a different one, both reading from the same local store of everything you've done. Group sessions into a project and they know about each other as they work: each one is told what its siblings are doing and which files they've handed over, without any of that leaving your machine. Within one session the agent can also hand a bounded piece of work to a different model and bring back the result.

How is this different from ChatGPT or Claude in a browser?

The tab workflow is upload, wait, copy the answer out, fix the formatting. Here nothing is uploaded, since the work happens in the folder where your files already are, and nothing is copied out, because the answer arrives as the finished file. Every session is filed on your disk, searchable later by any model you use, and the price of each session is printed next to it.

The tab also binds your history to one vendor. Here the model is a menu, and the memory is yours.

Can I change my mind halfway through?

Yes. The document builds on the canvas while you are still talking about it, so a correction mid-sentence changes the paragraph, in the same file, on your disk. There is no clean new draft to reconcile against the one you had already marked up.

A permission prompt is also a steering wheel: yes and no are answers, and so is an instruction. A perfectly good reply to "may I run this?" is "use the weekly numbers rather than the monthly ones". Stopping the work and correcting it are the same keystroke. And if a turn goes somewhere you did not want, /rewind puts the folder back the way it was and tells you what it moved.

Which platforms?

macOS 13 or later on Apple silicon, today. Windows is next: it builds, but nobody has run it on a real Windows machine yet, so it isn't offered. There's no Linux build and no build for Intel Macs; I'd rather ship nothing for a platform than a button that promises one.

Can I connect it to other tools?

Yes, three ways. Google Drive, Dropbox and Box connect directly, all three read-only, so your strategy docs in Drive, the client's folder on Dropbox and the signed contracts in a Box deal room are read where they are, while the finished file still lands on your disk. The next question states what each grant allows. Safata is also an MCP client, so anything with an MCP server plugs in; Slack is how a scheduled report reaches a channel. And it can hold a read-only token for a service and teach itself the API: HubSpot and Airtable come with a guided connect and a shipped manual, which is how a pipeline review reads the CRM, and it is the pattern for the long tail of software that will never have a proper integration.

What do the cloud grants allow?

Three services, three different shapes.

Google Drive — only the files you pick, through Google's own picker. Safata cannot see the rest of your Drive and cannot search it: the grant is the pick. Disconnecting revokes the grant at Google itself, not just on your machine.

Dropbox — the consent screen says all your files, and it does. Read-only is real, though: the app is registered with read scopes only, so a write couldn’t be granted even by accident.

Box — you register your own free Box developer app in a short walkthrough and connect through it, read-only. The grant lives in your own console, where you or your admin can see it and revoke it.

No Gmail and no Calendar today. Google puts mail reading behind an annual security audit.

What happens when it goes wrong?

It will, sometimes: a model misreads a column, a command fails, a draft goes the wrong way. Three things are true when it does. The whole transcript is on your disk, including the exact command that ran and what came back, so you are never reconstructing what happened from memory. /rewind puts the folder back to where it was before the turn and tells you what it moved. And every session has a spend cap, so a run that goes in circles stops instead of running up your bill.

There is no telemetry, so I cannot see a failure unless you send it to me at hello@safata.ai, with the transcript if you are comfortable sharing it. That is the trade for a tool that reports to nobody, and while the early builds are going out I would rather hear about every one.

When can I get it?

Now, if you have a Mac with Apple silicon: download the early build, open the disk image and drag Safata to Applications. It is signed and notarized by Apple, so it opens without a warning. It never checks for updates by itself; new builds appear on the releases page, and GitHub will tell you about them if you watch it.

Is it free?

For local use, yes: Safata on your own machine, on your own keys, at home and at work, employed or freelance. There's no trial and no tier doing quiet work in the background: the local product is the product.

Can I use it for my job?

Yes. The use cases it’s built for are a working week. And nothing in the software is capable of checking.

What will cost money?

Two things, both planned, neither built, and both things that have to be operated for you. One is a cloud plan: Safata hosted, with model access through one bill at provider prices, no markup. The other is the management layer organizations need to deploy it centrally, which is paid by default.

Separately, nobody resells Safata itself: no bundling it into something you charge for, no running it as a service for other people. The details are here.

Why a separate harness per model instead of one pipe?

Because the labs train their models inside their own scaffolding, and a model is at its best in the shape it was trained in. Each direct provider here is built against natively, with its own tool-calling dialect and its own reasoning and caching conventions, instead of through one lowest-common-denominator pipe, which is convenient for the tool and costs you the top of every model’s range. Safata adapts to the model, never the reverse.

Is it a desktop app or a terminal tool?

Both, and it's one binary. The desktop app is a small native window with the conversation on one side and the deliverable taking shape on the other. The same engine runs in a terminal for people who'd rather live there (on a Mac it is the file inside the app, /Applications/Safata.app/Contents/MacOS/safata), and a scheduled job can be answered from either. Open three windows of either and three agents run at once.

How would I verify the egress claim?

Everything that leaves the machine goes through one inspectable point, and the per-session log is that point's own record. Run Safata behind Little Snitch, LuLu or your own proxy and compare: the hosts you see should be the model you chose, the clouds you connected, and whatever a command you approved reached on its own. An approved shell command runs as a real process under your account, and its traffic is yours, which is why network-reaching commands sit behind the gate.

Can I read the source code?

No. Safata ships as a signed binary and the source isn’t published, so here you’re trusting a claim rather than reading the code. The claims are checkable from outside, though: there is no account, no server and no telemetry to hide behind, and the previous question is how to check.