Tallpine

Local by design. Locked down by you.

Tallpine runs entirely on the developer’s Mac. Every rule starts off; anything you set through MDM is locked for the user.

Write to us Policy reference
Illustration. First, a configuration profile from Jamf or any MDM reaches the Mac and the rules it sets become locked, while unset rules stay off. Second, the only connections that leave the Mac: model providers, GitHub or GitLab (including the app’s update check), and the optional phone connection. Tallpine servers and telemetry do not exist.
Runs on the Mac
The app, its background service and every agent run locally, with the developer’s own sign-ins.
Data stays on the machine
Database, worktrees and app data live in one folder on the Mac. Nothing is sent to us.
No telemetry
Analytics, crash reporting, cloud sign-in and update telemetry are removed.
Off by default
Every policy rule. An unconfigured install changes nothing about how agents run.

Everything runs on the Mac

The desktop app and the tallpine CLI are clients of one local daemon. Agents run as local processes with the developer’s own sign-ins. There is no Tallpine server in the path.

Architecture: on the Mac, the desktop app and tallpine CLI talk to the Tallpine daemon over loopback. The daemon stores state in ~/.tallpine and starts agents in git worktrees. Outside the Mac: the model providers the agents call, GitHub or GitLab, and no Tallpine servers.
Your Mac
Desktop appBoard, chat, terminal, review
tallpine CLIOptional, for scripts and agents
HTTP and SSE,
loopback only
Tallpine daemon127.0.0.1:3101Plans, spawns and watches every session, and applies agent policy at launch.
State~/.tallpine/data
WorktreesOne branch per worker
spawns with
policy applied
Cc Claude CodeInstalled CLI, user’s sign-in
Cx CodexInstalled CLI, user’s sign-in
Ki KiroInstalled CLI, user’s sign-in
Outside the Mac
Model providersEach agent calls its own provider directly, under your organisation’s account.
GitHub or GitLabPull requests, checks and reviews, using the credentials you configure.
Tallpine serversNone. No accounts, no telemetry. App updates come from GitHub.

Set policy once, from your MDM

Deploy a configuration profile for the preference domain ee.justdev.tallpine with Jamf “Application & Custom Settings” or any MDM that writes Managed Preferences. Include only the rules you want to manage; the rest stay with the user.

Precedence, highest first. Managed and environment values are locked for the user.

  1. ManagedMDM profile
  2. EnvironmentTALLPINE_AGENT_* variables
  3. ProjectTighten-only for security rules
  4. UserSettings, Agent policy
  5. DefaultOff

A malformed managed file fails closed: the strictest permission cap is applied and locked, with a warning.

policy.json, schema v2
{
  "schemaVersion": 2,
  "rules": {
    "permissionCap": { "max": "auto" },
    "envFilter": { "mode": "allowlist", "passthrough": ["CORP_PROXY_*"] },
    "githubCreds": { "mode": "helper" },
    "orchestratorApprovals": { "enabled": false },
    "accountPool": { "placement": "least-used", "failover": true }
  }
}
  • permissionCapCaps the most permissive mode an agent may run in, including mid-session switches.default none
  • envFilterStarts agents with an allowlisted environment instead of the full shell.default inherit
  • githubCredsKeeps GitHub tokens out of agent environments, or refuses them.default env
  • orchestratorApprovalsWhether an orchestrator may answer its workers’ permission prompts.default false
  • accountPoolSpreads sessions across signed-in accounts, with optional failover.default: placement default, failover off

Each agent gets only the credentials it needs

Limit ambient credentials without breaking the tools developers rely on. Every launch records which variable names were dropped, never their values.

Per-harness allowlist

A Claude Code worker gets ANTHROPIC_* but not OPENAI_*; a Codex worker the reverse. Add tool-specific names with passthrough.

tallpine policy show --session w-7f3a
envFilter: allowlist
dropped: OPENAI_API_KEY, AWS_PROFILE

GitHub credential helper

In helper mode no token sits in the agent’s environment. git and gh ask the daemon per use, with an audit line and the option to deny.

githubCreds.mode: "helper"
git  uses tallpine git-credential
gh   runs via tallpine gh-exec

Account pools

With several organisation seats for one harness, place new sessions on the least-used account and fail over when one hits its limit.

accountPool.placement: "least-used"
accountPool.failover: true

What leaves your machine

Only what your agents send to their own model providers, the source-control traffic you configure, and the app’s update check on GitHub. Tallpine sends nothing to us. The full list of connections is below.

Leaves the Mac

  • Prompts and code contextSent by each agent to its provider (Anthropic, OpenAI, AWS), under the account it is signed in with.
  • Git pushes and PR activityTo the GitHub or GitLab remotes of the projects you add.
  • Agent version checkTallpine asks GitHub whether a newer release of an agent CLI exists. It sends no data about you or your code.
  • App update check (on by default)The Mac app checks the public GitHub Releases of Tallpine at launch and every 6 hours, and downloads only builds signed by our Apple Developer ID. Tallpine adds no account or identifier to the request. Users turn it off in Settings; through MDM you can turn it off, choose the stable or beta channel, or pin a version.
  • Phone connection (off by default)If you turn it on, traffic goes through the Tailscale or Cloudflare tunnel you choose, and push notifications go through Expo.

Never sent to Tallpine

  • Source code and session historyStays in ~/.tallpine and your repositories.
  • Credentials and tokensRead from the machine at launch; never uploaded.
  • Usage dataNo telemetry, analytics or crash reports. There is nothing to opt out of. Policy rules set through MDM are locked for the user.

Rolling Tallpine out to a team?

Write to us Architecture docs