Wysebee Desktop
Build AI tools without writing code. Wysebee Desktop turns your machine into a set of nodes — named bundles of tools you configure in the app — and hands them to your own Claude or ChatGPT over an MCP server or a plain HTTP API. It hosts no model and runs no agentic loop: your AI decides what to call, this app answers.
macOS 12 or later · Apple Silicon or Intel · 222 MB · No sign-in · Nothing dials out
Install
Three steps, and that's the whole install.
macOS 12 or later · Apple Silicon or Intel. Nothing else needs to be installed first.
- 1
Download Wysebee-0.1.0.dmg
Grab the 222 MB disk image from the release page. It's a single file — there's nothing to install first, and no account to create.
- 2
Drag Wysebee into Applications
Open the disk image and drag the app across, the way you would any Mac app.
- 3
Launch it from Applications
The build is Developer ID signed and notarized by Apple, so it opens normally — no Gatekeeper warning, no right-click-Open dance. First launch is immediate: there's no image to pull and no server to wait for.
Docker Desktop is optional
The app runs, serves nodes and answers your AI without it. Docker becomes necessary the moment a node needs to run a shell command — which means the moment you create a workspace and connect it to a node. If you get that far without it, install Docker Desktop; from then on Wysebee starts it for you in the background at launch, and never asks for your password.
Uninstalling
Drag the app to the Trash. Your data lives outside it — Settings → Desktop shows the database path, and workspaces are folders under ~/Wysebee/workspaces — so removing the app leaves both. Delete those two locations and nothing Wysebee ever wrote remains.
Quickstart
Your first MCP tool, in about five minutes — no code.
- 1
Create a node
Open Nodes and add one. A node is a named bundle of tools. New nodes get an MCP server entry point by default, so it's reachable the moment it exists.
- 2
Add a tool on the Tools tab
Pick a template: a fixed JSON response, an HTTP request to any API, a subset of tools from an external MCP server, a bash command inside a workspace, or a fixed local executable.
- 3
Copy the address from the Access tab
The Access tab prints the node's exact MCP address. The gateway binds a fresh loopback port each launch, so always copy it from there rather than guessing.
- 4
Point your AI at it
Any MCP client that speaks streamable HTTP can connect. Your model lists the node's tools, decides what to call, and Wysebee answers — it hosts no model and runs no agentic loop of its own.
Connecting an MCP client
A node with an MCP server entry point is served over streamable HTTP at /node/<node>/mcp. Copy the full address — host, port and path — from the node's Access tab; the gateway takes a fresh loopback port at every launch, so it is never the same twice.
{
"mcpServers": {
"wysebee": {
"url": "http://127.0.0.1:<port>/node/<node>/mcp"
}
}
}Or call it over plain HTTP
Add the Node API entry point and the same tools answer over ordinary HTTP — handy for scripts, cron jobs and your own agent framework. There is /tools to discover, /call/stream for SSE, and /ping for a health check.
curl -X POST \
http://127.0.0.1:<port>/node/<node>/tools/<tool>/call \
-H 'content-type: application/json' \
-d '{"arguments": {"city": "Ottawa"}}'A node's entry points are the whole decision: give it an MCP server, the Node API, or both — give it neither and nothing can reach it.
Tool types
Five templates. Every one of them is a form.
Every tool you build is one of these. Pick a template, fill in the fields, and it shows up in your model's tool list — no SDK, no server code, no deploy step. Two more tool packs come free, with nothing to configure at all.
JSON Response
A fixed or templated JSON answer. The fastest way to hand your model a lookup table or a canned result.
HTTP Request
Call any HTTP API, with a stored credential injected into the header. The secret is encrypted at rest and never reaches the model.
Toolset
Connect to an external MCP server as a client and re-expose the subset of its tools you pick. One config, N tools — schemas are snapshotted, so listing needs no network.
Bash Command
Run a command inside the node's workspace container. This is the one tool type that needs Docker.
Local Command
Run a fixed executable on the host, where only the arguments come from the caller. Argv is never a shell, the environment is allow-listed, and there's a background mode for things not meant to finish.
Built-in tool packs
Nothing to configure: bash, read_file and write_file appear once a node has a workspace, and load_skill once it has at least one skill.
Beyond tools
Skills, workspaces, and a way out to the internet.
Skills
Give a node a SKILL.md of instructions your model loads on demand through load_skill. Four templates ship with the app — skill-creator, summarize, diagram-maker and weather.
Workspaces
A Docker container plus a folder that nodes reference. Pick a base: bare-bones Debian, Python + Jupyter, PostgreSQL, MySQL, or your own Dockerfile. Every non-bare base is a Dockerfile you can read and edit.
Publishing
Reach a node from outside the machine through ngrok — the app records a domain and starts the tunnel — or through your own nginx, Caddy, Cloudflare tunnel or port forward.
Sign-in for published nodes
A published node gets a real OAuth 2.1 authorization server, so the Claude app can connect. There is no password: a person types a username and you click Allow in Settings → Users.
Security & your data
Give your AI tools. Don't give it your machine.
Two mechanisms carry most of the weight here: a gate that decides who may call a node at all, and a container that decides how far a call can reach once it is through.
No node answers without passing its gate
Give a node an authorization gate and the check runs before anything else — before the Node API serves a request, and at the moment an MCP session initializes. The gate is an access check, never a tool: it is never offered to a caller's model and never appears in a tool list.
- Known users — a whitelist of people this machine knows, holding tokens this machine issued
- JWT claims — validate the caller's token, then test its claims against conditions you write, combined with AND or OR
- Your own endpoint — Wysebee calls it with the caller's bearer token, and a non-2xx denies
- Fails closed everywhere: a missing token, an unknown mode, a malformed gate, or an error all deny
A node with no gate configured is open to anything that can reach it. Until you publish, that means processes on your own machine — and a published node with nothing gating it is flagged in red on its Access tab rather than left quiet.
Shell commands never run on your host
Wysebee runs no model, but its whole purpose is that the caller's model chooses which tool to invoke and with what arguments — so a poisoned page in someone's chat can still steer a Bash Command tool. It runs somewhere that holds no secret, has none of your source, and can see exactly one node's files.
- cap_drop=ALL with seven capabilities added back, not Docker's default fourteen; no-new-privileges; an unprivileged uid
- Memory, CPU, and process-count ceilings, and a command timeout that ends the command rather than the container
- An allow-listed environment built from scratch — never your shell's, never the gateway's — with no credential key and no database route
- read_file and write_file are confined to that one workspace folder, and paths resolve through symlinks before the containment check, so a link pointing out is caught like a ../ escape
The one deliberate exception is the admin-only Local Command tool, which runs a fixed program on your host on purpose. Even there the arguments never reach a shell and the environment is allow-listed — it lives in its own module precisely so the sandbox guarantee above stays absolute.
The rest of the posture
- The gateway binds exactly one port, and only node surfaces answer on it. The admin API binds no socket at all — the app's UI reaches it in-process — so nothing else on your machine can reach your config, and a tunnel aimed at the port finds nothing but nodes.
- There is no sign-in and no identity provider. The gateway runs as the machine's owner.
- Credentials are encrypted at rest and decrypted only at the moment of use — never logged, never returned, never placed on a surface your model can see.
- The SPA is served off disk through a custom wysebee:// scheme, not over HTTP.
- The macOS build is hardened-runtime, Developer ID signed and notarized by Apple.
Known limitations
What v0.1.0 does not do yet.
macOS only, for now
This release ships a macOS build. Windows and Linux builds are not available yet.
Back up before you upgrade
There is no database upgrade step in this release. Settings → Desktop shows the database path — copy that file before installing a new version.
Publishing is all-or-nothing
A tunnel forwards a port and every node answers on one, so there is no per-node publish switch. That's by design, not a simplification.
ngrok allows one agent per machine
Starting a tunnel from Wysebee may end one you already have running for something else.
FAQ
Questions about the desktop app
Do I need to know how to code?
No. Every tool is one of five templates you fill in inside the app — there is no SDK to learn, no server to write and no deploy step. Two of the templates do take a command you type (Bash Command and Local Command), and a custom workspace base is a Dockerfile you edit, but the common path — wrapping an API you already have, or re-exposing an existing MCP server — is configuration only.
Can Claude or ChatGPT read and write files on my Mac?
Only inside a workspace you connected to that node. Shell commands run in the node's Docker container, never on your host, and read_file / write_file are confined to that workspace's own folder — paths resolve through symlinks before the containment check, so a link pointing out of the folder is refused just like a ../ escape. Nothing else on your disk is reachable. The one deliberate exception is the admin-only Local Command tool, which runs a fixed program on the host because that is its purpose.
What stops someone else from calling my node?
An authorization gate, checked before the Node API serves anything and at MCP session initialize, and failing closed on a missing token, an unknown mode, a malformed gate or an error. Three modes: a whitelist of people this machine knows, a JWT tested against conditions you write, or your own HTTP endpoint that has to return 2xx. Note the default: a node with no gate is open to whatever can reach it. Before you publish, the gateway is loopback-only, so that means processes on your own machine — and once published, an ungated node is flagged in red on its Access tab.
Do I need Docker?
Not to run the app. Wysebee starts, serves nodes and answers your AI without it. Docker Desktop becomes necessary the moment a node needs to run a shell command — that is, the moment you create a workspace under Workspaces and connect it to a node. Once a workspace exists, Wysebee starts Docker for you in the background at launch and never asks for your password.
Does it send anything to Wysebee?
No. There is no sign-in and nothing dials out. Everything durable lives in two places you control: a SQLite file in your per-user data directory, and each workspace's folder under ~/Wysebee/workspaces.
Does it include an AI model?
No. Wysebee Desktop hosts no LLM and runs no agentic loop. It answers the tool calls your own Claude, ChatGPT or custom agent decides to make.
How do I uninstall it?
Drag the app to the Trash. Your data lives outside the app, so removing it leaves both the database and your workspaces behind — deleting those two locations removes everything Wysebee ever wrote.
Can I use it at work, across a team?
The desktop app is built for one machine and one person. When your team needs shared nodes, accounts, SSO and audit logs, that's Wysebee Cloud — or an on-premises deployment inside your own VPC when the data has to stay home.
Need this for a team?
The desktop app is built for one machine and one person. When your tools need to be shared, governed and always on, the same platform runs as Wysebee Cloud or on-premises inside your own VPC.