# Quaka

> Ship with agents. Like a team of ten. Quaka is a desktop harness for coding agents. It runs Claude, GPT, Gemini or a local model on the user's own machine (macOS, Windows, Linux), and it enforces in code what other tools only ask a model to do in a prompt: an OS sandbox, a network firewall, a guard against untrusted input, proof that a change works, and the user's approval before anything leaves the machine.

Quaka is a desktop app, not a hosted service. There is no Quaka server in the path of a run: code, keys and threads stay on the user's machine, and each model request goes straight to the provider the user picked. The one opt-in exception is device sync. Quaka is in private beta, with a waitlist at https://quaka.app. It is made by Quaka Labs.

## What it does

- Agents work side by side like teammates. A thread can launch several writer agents, each in its own git worktree, and only the parent thread merges their work.
- Every command, diff and test is in view in the app, through to the pull request the agent opens.
- Any model: API keys for Anthropic, OpenAI, Gemini or any OpenAI-compatible endpoint (such as NVIDIA's or a company gateway); local models through Ollama, MLX, LM Studio or llama.cpp's server; or the user's Claude and ChatGPT plans through the official Claude Code and Codex command line tools, whose commands run under Quaka's sandbox and firewall.
- Work starts where the team already is: Slack, Discord and Telegram bots on the user's own token (outbound connections only), /quaka commands on GitHub pull requests, failing CI checks, Linear issues and scheduled automations. Whatever needs the user waits in one inbox.

## The five layers

These are enforced by the operating system and by Quaka's own code, whatever the model decides.

1. Sandbox: every command runs in the operating system's sandbox (macOS Seatbelt, Linux bubblewrap, and on Windows 11 24H2 or 25H2 with the August 2026 update, Microsoft's execution containers). It can write to the project, temp and package caches, and it cannot read ~/.ssh, ~/.aws, the keychain or Quaka's own data.
2. Firewall: each run gets its own network proxy, which records every host it reaches. In Ask and Allowlist modes the operating system makes that proxy the only way out for commands.
3. Untrusted input: once a run reads text the user didn't write (web pages, search results, issues, comments, CI logs, MCP results), every side effect asks first, and a run that starts from someone else's text works in a copy of the project.
4. Proof: before a run calls itself done, Quaka runs the project's checks, then runs the new tests against the code without the change, in a separate copy. A test that fails there and passes with the change is proof. Optionally a model from another lab reads the diff and the results and says whether it agrees.
5. Approval: pushes, pull requests and actions that leave the machine ask first, and undoable runs hold them until the user reviews and applies the work.

## Memory and context

- Each model gets its whole context window. When a thread outgrows it, older messages are summarized for the model but kept in the thread word for word, and the agent looks up the exact line it needs with recall.
- One memory of the user and their projects, kept on the machine and shared by every model, Claude Code and Codex included. Notes written by a run that read untrusted content wait for the user's approval. Optional sync to Supermemory, Mem0, Zep, Graphiti or any memory MCP server.
- Replay re-runs merged pull requests with each model the user picks, graded by each pull request's own tests, and says when a difference could be chance instead of ranking.

## Limits

- The firewall starts in observe mode: it records every host and blocks nothing until the user picks Ask or Allowlist.
- On Windows the sandbox needs Windows 11 24H2 or 25H2 with the August 2026 update. On older Windows, commands run unsandboxed behind approval prompts and the firewall only records.
- MCP servers and the built-in browser are not sandboxed. They go through Quaka's proxy, but a server that ignores proxy settings can still reach the network.
- Device sync is off by default and is not end-to-end encrypted: Quaka's relay holds each account's key, so Quaka can read synced data. API keys never sync.

## Pages

- [Home](https://quaka.app): what Quaka does, and the waitlist
- [Sync](https://quaka.app/sync): what device sync carries, what the relay stores, and who can read it
- [Privacy](https://quaka.app/privacy): what Quaka collects, and how to have it deleted
- [Blog](https://quaka.app/blog): writing on local coding agents, harnesses and how Quaka is built

## Blog

- [When your coding agent says it is done](https://quaka.app/blog/verified-completion-coding-agent): Agents report success after running no tests at all, and review is now the bottleneck. How to make completion a check the harness runs instead of a sentence the model writes.
- [The coding agent harness, explained](https://quaka.app/blog/coding-agent-harness-explained): A coding agent is a model plus a harness. The harness owns the tools, permissions, context and verification, and it decides most of the quality you actually experience.
- [Quaka and the cloud coding agents](https://quaka.app/blog/quaka-vs-cloud-coding-agents): A side by side of local-first and cloud coding agents on data, model choice, review control and cost, using public complaints and incident reports rather than marketing claims.
- [What is a local AI coding agent?](https://quaka.app/blog/local-ai-coding-agent): A local AI coding agent runs on your own machine, edits your real repo and shows a diff before anything is committed. How it works, what stays private, and when a cloud agent still wins.
- [How to read coding agent benchmarks](https://quaka.app/blog/how-to-read-coding-agent-benchmarks): Top scores on SWE-bench Verified vary by ten points depending on who reports them, and a 100-line harness scores 65%. What these benchmarks measure and what to do instead.
- [Guardrails, snapshots and rewind](https://quaka.app/blog/ai-coding-agent-guardrails): Nine public incidents in fourteen months, and the sandbox escapes that did not need to break out. What guardrails a coding agent needs before you point it at a real repository.
- [Bring your own model](https://quaka.app/blog/bring-your-own-model-coding-agent): Provider choice is the difference between a tool you own and a tool you rent. How BYOK, local models and provider-neutral threads work in practice.
- [MCP and the quiet tax on your context window](https://quaka.app/blog/mcp-token-bloat-context-window): Tool schemas for a popular messaging integration can occupy nearly 70% of a context window. How MCP costs show up, and what to do about it before it decides your model choice.
- [Where a coding agent run spends its money](https://quaka.app/blog/ai-coding-agent-cost-prompt-caching): Savings of 80 to 89% from caching, a timestamp that drops one to 6%, and why cached output costs more than fresh output. The economics of a long agent run.
- [Running several agents on one repository](https://quaka.app/blog/parallel-coding-agents-git-worktrees): Two agents editing one directory start stepping on each other within minutes. How worktrees, isolation and collision detection make parallel runs actually work.
- [Agent Client Protocol: swapping agents like editors](https://quaka.app/blog/agent-client-protocol-acp-explained): ACP lets an editor talk to any agent through one interface, and a public registry launched in January 2026. What it changes for anyone tired of one-vendor lock-in.
- [Why Quaka is a Tauri and Rust desktop app](https://quaka.app/blog/why-quaka-is-built-with-tauri-and-rust): A 3.8MB binary against a 165MB one, 25MB of memory against 180, and why an agent that runs your shell needed a native permission boundary.

## Contact

- GitHub: https://github.com/quaka-labs
- X: https://x.com/tryquaka
- Email: hello@quaka.app