Pippa can prepare an email reply in Apple Mail, but its developers say it will never send it. That boundary captures the projectâs approach: give a local AI agent access to everyday office tasks while keeping consequential decisions with the user.
The Pippa project packages a coding-agent harness into a free, MIT-licensed Mac application for people who donât want to open Terminal or pay for an AI subscription. Its advertised tasks include organizing Downloads, explaining letters, finding files, checking spreadsheet totals and preparing email replies.
The underlying design is more interesting than another chat window. Pippa connects a Swift interface, a local model server and the Pi agent to Mac applications. Its usefulness will depend on whether that combination can reliably handle personal documents and actions, not merely generate plausible answers. The published material describes several safeguards, but provides no independent safety audit or task-accuracy results.
A Swift Interface Puts Pi Behind Everyday Tasks
Pippaâs interface is a small, pill-shaped target that accepts dropped files, folders and photos. Users can select an action or ask for help without interacting directly with the agentâs command-line interface.
Behind that front end, the architecture has three main components:
- The Swift application draws the interface, manages settings and connects to Mac applications. Its architecture includes an MCP server for Mail, Calendar and Excel.
- A local llama.cpp server runs the language model and listens on
127.0.0.1, the computerâs loopback address. - Pi in RPC mode supplies the agent, with Pippa-specific skills and a web-access extension.
RPC mode gives the application a way to control Pi as a background component rather than expose its terminal interface. MCP provides an interface through which the agent can interact with application tools.
The Pi toolkit describes itself as a minimal, extensible agent harness. Pippa uses that extensibility to redirect a developer-oriented system toward household and office work.
Pippaâs skills are plain-text files rather than Swift application code. That separates task instructions from the native interface and makes them inspectable. It also introduces an important distinction: instructions describing how an agent should behave are not, by themselves, a security boundary.
The loopback-only model server limits where that server listens for connections. It does not establish what files or applications the agent can access once a task begins.
Free Software Still Requires a Suitable Mac
Pippa requires Apple Silicon, meaning an M1 or later Mac, and macOS 15 or later. Intel Macs are outside its stated requirements.
The installer selects a local model according to available memory. The projectâs installation requirements list Qwen3.5 4B for 8 GB Macs, with an approximately 2.7 GB download, and Qwen3.5 9B for machines with at least 16 GB, with an approximately 5.7 GB download. It specifies 3 to 6 GB of free storage.
The installer can reuse a matching model from LM Studio, Ollama or the Hugging Face cache. Otherwise, users approve a one-time AI download, after which the project says local tasks can run offline.
No Pippa account or subscription is required. That removes a service-payment requirement, but it does not establish how responsive the assistant will feel on supported hardware.
The published specifications give model sizes, not measured latency, memory pressure or task-completion rates. Nor do they show how much better the 9B configuration performs on Pippaâs workflows. Compatibility and useful performance remain separate questions.
Office Work Mixes Model Judgment With Conventional Tools
The advertised workflows vary considerably in how much judgment they demand from the model.
Folder organization presents a proposed destination for files, waits for approval and offers an undo path. Letter explanations are supposed to include the passage supporting an answer. File search lets users describe what they remember about a document rather than supply its exact filename.
For email, users select a message in Apple Mail. Pippa can consult the calendar and prepare a reply as a draft. Calendar and reminder integrations also support adding appointments and deadlines, so the applicationâs actions extend beyond reading and summarizing.
Spreadsheet checking combines model interpretation with arithmetic performed in code. According to the README, Pippa adds numbers again and points out rows that a total omits. Invoice extraction produces a CSV table that can open in Excel, while the original files remain unchanged.
Recalculating a total in code is a stronger approach than asking a language model to guess the sum. It still leaves a separate problem: identifying the correct rows, interpreting their meaning and deciding which amounts belong in the calculation. Correct arithmetic cannot rescue an incorrectly selected range.
Similarly, showing a source passage makes a letter explanation easier to check, but does not prove that a deadline or obligation was interpreted correctly.
The PDF utilities are a different category. The project explicitly describes compressing PDFs and photos, combining scans and converting between PDF, JPG and PNG as tasks that do not need AI. Those operations should be evaluated separately from document comprehension or agent decision-making.
Pippaâs demo is illustrative rather than independent evidence. The README states that its names and files are made up.
Access Controls Are Not the Same as a Sandbox
Pippaâs access settings separate areas such as Desktop, Documents and Downloads from Calendar, Reminders, Photos and Mail. The website says users choose access during setup and can change those choices later.
These controls make intended access more visible, but the project also discloses that Pippa does not run inside the macOS App Sandbox. Its stated reason is that a sandboxed application cannot set up its agent. The README advises keeping Time Machine enabled.
That disclosure matters because the upstream Pi documentation explicitly says Pi has no built-in permission system restricting filesystem, process, network or credential access. By default, it runs with the permissions of the user and process that launched it. Pi recommends sandboxing or containerization when stronger boundaries are needed.
This does not prove that Pippa disregards its own access settings. It does mean those settings should not be confused with a demonstrated operating-system containment boundary around the agent. Establishing how reliably Pippa enforces its narrower permissions requires examining and testing the applicationâs implementation.
Its action safeguards also differ by workflow. Folder tidying promises a preview, confirmation and undo. Email remains draft-only. The website says smaller steps may happen immediately, with a record of changes shown below the answer.
Consequently, Pippa does not promise approval before every action. Nor does folder undo establish that every possible change is reversible.
A cautious first trial would use copied documents and a disposable folder, with narrowly granted access and backups enabled. That recommendation follows from the disclosed architecture and missing independent testing, not from a documented incident.
Local by Default Does Not Mean Never Online
Pippaâs privacy description says its AI runs on the Mac, with no Pippa server. The README additionally says there are no usage statistics.
Sources
- Pippa projectgithub.com
- Pi toolkitgithub.com
- advertised workflowsheypippa.app
