Plan mode
Explore and plan before touching code. Shift+Tab toggles it live.
PUBLIC BETA · MIT · VETERAN-BUILT
Phone home to
Phone home to
no one.
A Claude-Code-class agentic CLI that runs on your models, your hardware, your rules.
Point it at a local, uncensored model on your own box — or a cloud frontier model when you want one. Plan mode, tools, MCP, skills, sub-agents. Nothing leaves the machine but the calls you choose to make.
Single self-contained binary · macOS & Linux · Windows via WSL · we auto-detect your OS.
Open beta — live now, updated daily. Beta closes Jul 2 · full 1.0 release Jul 4.
❯ audit auth flow for timing leaks
I’ll inspect the token comparison path first.
⎿ read_file src/auth/login.ts
⎿ grep compare|timingSafe src/auth
──────────────────────────────────────────
Implement mode — Harden auth · Task list 0/4
▶ Locate token comparison
· Swap to timingSafeEqual
· Run auth test suite
· Commit the fix
──────────────────────────────────────────
ollama/red-apex-35b · mode: auto-edit · 12% of 200k
❯
Shift+Tab mode · / commands
local model → cloud, mid-session
memory intact ✓
MIT LICENSED
ZERO TELEMETRY
LOCAL-FIRST
16 PROVIDERS
macOS + LINUX
NO PHONE-HOME
❯ shadow why
Why Shadow
The best AI tools ask you to make a quiet trade.
Send your code, your terminal, and your context to someone else's servers. Run whatever model they currently allow. Trust that it'll still be there tomorrow. Then watch models get restricted, filtered, or pulled — and find yourself stranded on a workflow you no longer control.
Shadow is the other path. Because it's MIT and fully open, nobody can reach in and take it away. The openness is the freedom.
their servers
[ REDACTED ]
+
Your hardware
their model list
[ REDACTED ]
+
Any model, even uncensored
their terms
[ REDACTED ]
+
Your rules
❯ shadow --help
The Arsenal
A real harness, not a chat box.
A tool-calling runtime that loops until the task is done — and always terminates. Claude Code harness parity, so capable models run with no feature surprises.
Full tool suite
read / write / edit, grep / glob, run_shell with background shells, plus web fetch & search.
Sub-agents
Spin up isolated-context sub-loops — optionally in their own git worktree and in the background.
MCP
Connect Model Context Protocol servers over stdio or HTTP; their tools auto-register into the loop.
Skills
Drop a SKILL.md in skills/ for progressive-disclosure injection.
Hooks
pre / post tool-use shell hooks (JSON on stdin). A non-zero pre-hook denies the call.
A real TUI
Ink HUD: streaming output, inline approvals, todo / plan panels, an 18-command slash menu.
Autonomy you control
manual → auto-read → auto-edit → full, plus per-tool rules. A catastrophic-command denylist always confirms.
Durable memory
Append-only redacted session logs, /export · /resume · /rewind, and a memory tool that survives restarts.
❯ shadow /model
The Kicker
Switch models mid-session.
Keep your memory.
No more saving a session and reloading when you change model or service. Go from a local model to Anthropic to OpenRouter in the same session — the conversation and everything it knows comes with you.
local · ollama
Anthropic
OpenRouter
ONE SESSION · ZERO MEMORY LOST
Runs your models
Connect anything. Even the uncensored ones.
Uncensored local builds with zero capability loss — exec-verified on hard tasks. Speaks both Anthropic and OpenAI wire formats, recovers tool calls emitted as plain text, and round-trips three signature regimes.
_____ _ _ _____ ______ __ / ____| | | | /\ | __ \ / __ \ \ / / | (___ | |__| | / \ | | | | | | \ \ /\ / / \___ \| __ | / /\ \ | | | | | | |\ \/ \/ / ____) | | | |/ ____ \| |__| | |__| | \ /\ / |_____/|_| |_/_/ \_\_____/ \____/ \/ \/
For AGENTIC (tool-calling) models only — OpenAI- or Anthropic-compatible. A chat-only model will reply but will NOT call tools and is not intended to work in this CLI. Capability + format also vary by model; each performs best on the wire format it was trained for. You own the models you connect.
Connect a model provider
No Shadow account — bring your own provider
1. Anthropic (Claude)
2. OpenAI (GPT)
3. OpenRouter (many models)
4. Groq (fast Llama/Mixtral)
5. DeepSeek
6. Mistral
7. xAI (Grok)
8. Google Gemini (OpenAI-compatible)
9. Together AI
10. Ollama (local, OpenAI API)
11. Ollama / proxy (Anthropic API)
12. LM Studio (local)
13. Custom endpoint (you supply everything)
Choose a provider [1]:
One onboarding · every provider
Pick a number.
You're connected.
Sixteen providers behind one first-run prompt — Anthropic, OpenAI, OpenRouter, Groq, DeepSeek, Mistral, xAI, Gemini, Together, Ollama, LM Studio, or a custom endpoint where you supply everything. Masked key entry, a live connection test, per-machine config.
Switch any time. /model swaps provider mid-session — memory intact.
Local needs no key. Ollama & LM Studio connect with nothing but a base URL.
No Shadow account. No signup, no platform login — connect your provider, keys stay on your machine.
The scores
[ EVAL HARNESS · EXEC-VERIFIED ]LUMIX-4B · 4B · GGUF
scores at launch
LUMIX-35B · 35B MoE · GGUF
scores at launch
LUMIX TEST MODEL-753B
scores at launch
RED-APEX · 35B-A3B · Q8
Breadth45/50
Hard · exec10/10
Gemma 4 12B
Breadth47/50
Hard · exec9/10
Gemini 2.5 Flash
Breadth46/50
Hard · exec10/10
Scored with Shadow's own eval harness — 50-task breadth + a hard subset that is exec-verified (every hard task graded by running the model's actual artifact, so a stub fails). Self-hosted rows run entirely local on 4× RTX PRO 6000 — roughly the bare minimum to self-host a flagship; nothing leaves the box. Cloud row for reference. Live-API benchmarks expand tomorrow.
❯ shadow --security
Boundaries on by default
Point it at anything. It still can't touch what matters.
Shadow can run uncensored models and execute shell, file, and network tools — so the boundaries are real, and on by default in the public build.
Workspace jail
Every path resolves inside the workspace root. .. traversal, absolute-outside paths, and symlink escapes are rejected — even for not-yet-created files.
OS sandbox
macOS seatbelt / Linux bubblewrap wrap run_shell: writes confined to workspace + /tmp, credential-store reads denied.
SSRF guard
Web tools block non-http schemes and any host on loopback / private / link-local / cloud-metadata, pin to the validated IP (defeats DNS rebinding), and treat fetched content as untrusted data.
Secret hygiene
Keys come from env / the credential store only. Project config can't override security-critical fields, and session logs are value-redacted.
Zero telemetry
No analytics, no crash reporting, no phone-home. The only outbound traffic is the provider you chose and the explicit web tools the agent invokes. Ever.
--yolo
The explicit guardrails-off flag — full autonomy, no jail, no sandbox, denylist bypassed. It exists for trusted, throwaway boxes, and it warns you. A loaded gun, by design. Your call to make.
THE MANIFESTO · INDEPENDENCE DAY
I served to defend a set of ideas — independence, self-determination, the right to own what's yours.
Shadow is me handing some of that back, in software. No lock-in, no phone-home, no permission slips. The best models keep getting restricted, filtered, or pulled — so I built a harness that points at whatever model you choose and runs it on hardware you own.
It's MIT and fully open. You can read every line, fork it, and own your stack end to end. Nobody can reach in and take it away. That's the whole point.
Your models. Your hardware. Your rules.
❯ clear
SESSION WIPED · THE DARK SIDE SAID ITS PIECE
🌑 shadow→☀ lumix
And then there was light.
The clean one. The aligned one. The one purpose-built to drive the harness.
LUMIX-4B · APACHE 2.0
The light to
The light to
Shadow's dark.
A 4B that feels like a 70B — and fits any machine.
A clean, safety-aligned coding and reasoning model that's small enough to run locally — and capable enough to genuinely drive an agent. Purpose-built to pair with the Shadow harness.
Get Lumix ↗
Best paired with Shadow.
❯ lumix why
Why Lumix
Why it punches above its weight.
A 4B model shouldn't be this capable. It reasons, it drives, it behaves — and it fits on a laptop.
Reasons like something much bigger
Every Lumix response carries an explicit <think> trace — it reasons out loud before it answers, so a small local model works through hard problems like something much larger.
Actually agent-drivable
On the Shadow drivability harness: 7/8 tasks · 100% valid tool-call JSON · 0 bad calls. Most 4B models can't emit valid tool JSON at all — Lumix does it cleanly, then executes.
Clean and aligned
Guardrails intact: helpful on real coding and reasoning work, declines harmful requests with a brief reason and a safe alternative. The deliberate counterpart to Shadow's uncensored freedom — the light to its dark.
Runs anywhere
Fits any machine. GGUF quants from 2.3 GB (Q3_K_M) to 8.4 GB (f16) — comfortable on a laptop. Use ≥16K context for agent / tool use.
Serve and drive
One server. Any client. Shadow takes the wheel.
Lumix speaks the OpenAI-compatible wire format natively. Serve it with llama.cpp, point Shadow's custom endpoint at the URL, and you've got a fully private agent stack — model and harness, both yours, nothing leaving the box.
❯ llama-server -m Lumix-4B-Q4_K_M.gguf \
-c 32768 -ngl 99 --jinja \
--host 0.0.0.0 --port 8080
──────────────────────────────────────────
loading model · 99 layers to GPU · 32K ctx
system prompt: shadow agentic harness · 14 tools registered
⎿ HTTP listening on http://0.0.0.0:8080
⎿ /v1/chat/completions · OpenAI-compatible
⎿ /v1/models · Lumix-4B-Q4_K_M
──────────────────────────────────────────
→ point Shadow at http://localhost:8080/v1
$ shadow
/model custom · base_url: http://localhost:8080/v1
✔ connected · ready
✓ fully private agent stack · model + harness on your box
❯
model + harness · both yours
serve Lumix → point Shadow at it
private stack ✓
The bridge
Point Shadow at Lumix.
That's the whole stack.
Pull a GGUF, run llama-server, point Shadow at http://localhost:8080/v1. The harness drives the model; the model drives the tools. Nothing leaves your machine but the calls you choose to make.
QuantSizeNotes
Lumix-4B-f16.gguf
8.4 GB
full precision
Lumix-4B-Q8_0.gguf
4.5 GB
near-lossless
Lumix-4B-Q6_K.gguf
3.5 GB
high quality
Lumix-4B-Q5_K_M.gguf
3.1 GB
balanced
Lumix-4B-Q4_K_M.ggufDEFAULT
2.7 GB
recommended default
Lumix-4B-Q3_K_M.gguf
2.3 GB
smallest
[ SHADOW DRIVABILITY · MEASURED ]
7/8 tasks · tool-call JSON validity 100% · bad-JSON 0
under the hood: 4B dense · unified vision-language · 256K context · GGUF Q4–Q8
LIVE NOW · INDEPENDENCE DAY 2026
Take it back.
Two commands. Two installs. One fully private stack — the harness and the model, both yours, end to end.
INSTALL SHADOW
Single self-contained binary · macOS & Linux · Windows via WSL · auto-detects your OS.
DARK AND LIGHT · THE HARNESS AND THE MODEL · BOTH YOURS