A little help, right here.

Name: Pebble
Author: Tohin Majumder

Pebble is a small, free, open-source AI companion that lives on your Mac's screen.

Pebble is for Macs with Apple silicon.

Signed with its own identity, not an Apple Developer ID, and not notarized. No independent security audit yet. Read the limits

v2.0.3
73 MB
Apple silicon
macOS 12 or later

The pebble on this page uses the same animation engine as the app.

Shown with sample data.
The film 1:39, with sound.
Watch Pebble at work.
The Pebble 2.0 launch film, with music and no voiceover: what Pebble 2.0 does, from your desktop to your iPhone, and how it did on its benchmark.
Read the transcript

AgentGuard The evidence layer

Evidence before “done”. An agent shouldn’t grade its own work.

AgentGuard is built into Pebble as an evidence layer between the model and your project.

How it checks

It indexes your project and grounds each request in the files that request reaches. It challenges an agent that drifts outside that scope. It also challenges an invented API, such as a call to a function that doesn't exist, but that check reads Python code only.

Scope challenge

5 file(s) changed that the task does not reach

When a task keeps changing files its request doesn't reach, AgentGuard stops the next write.

Shown with sample data.

How it works

The model must explain what connects them, or split them into a separate change.

Pebble's Activity steps. The edit to invoice_kit/templates/statement.html is refused, and its details read “AgentGuard — evidence check” and “5 file(s) changed that the task does not reach”, name the request and the files outside it, and say “Either explain what connects these to the task, or split them into a separate change.”

Verification required

Pebble's change isn't verified yet.

It reads test results as Pebble observed them, never as the model reports them.

Shown with sample data.

How it works

When tests cover the code a task changed and haven't passed since the change, Pebble holds the task at “verification required”: you run the tests, ask Pebble to finish, or accept it as unverified. Changed code without covering tests is not held.

Verified

Verified · pytest 42 passed on current files

Its one-line result says which tests ran and whether they passed on the current files.

Shown with sample data.

How it works

It also checks what you asked for. Output that must match a file is compared byte for byte, files you asked to keep must hold exactly what they held, and “don't change anything” needs nothing changed. When something can't be confirmed, Pebble says the work is unverified instead of done.

The head of a reply in Pebble after the tests ran: “Worked for 1 min 12 s · 5 steps · waited 6 s for you”, then “Verified · pytest 42 passed on current files”.

Shown with sample data. Pebble 2.0.1's own interface, in a scripted run.

Reliability, not security.

AgentGuard checks evidence; it is not a sandbox and not a security layer.

Where protection comes from

Protection comes from Pebble itself:

Approvals happen only in Pebble's main window.
Commands run without a shell in macOS's sandbox, which limits them but is not a promise against every attack.
Nothing a model, a web page, a file or a generated view says can widen what Pebble may do.

On your desktop Joins every Space

On your screen, out of your way.

A small animated pebble stays on top of your other windows and joins every Space. Drag it to move it. Click it for a quick chat, or use its arrow to open the full window.

Shown with sample data. Recorded from Pebble 2.0.0. The pebble on this page uses the same animation engine as the app. Move your pointer, and its eyes follow.

⌘⇧Space brings Pebble forward from any app.
Its expression follows what Pebble is doing, such as reading, writing, testing or waiting, without asking the model anything.
Close the main window and the pebble stays on screen. Quit Pebble stops it, and the model with it.
It stays over full-screen apps too, answers simple cards itself, such as allowing a site or an app window, and has Copy on every reply.

Reduce motion, in Pebble's Settings or in macOS, keeps it still.

In your project How a coding task goes

Works in your project, under your review.

In the default mode, every edit, test run, terminal command and Git change is a card you approve.

In the default mode, every edit is a card you approve, with Undo.

Each card shows the exact change. Choose Apply edit or Don't allow. After you apply it, Undo this edit puts the file back.

Pebble refuses to apply an edit if the file changed since it read it.

Interactive exampleTry the approval card. Its words are the ones Pebble shows.

invoice_kit/dates.pyNeeds your review

Changes this file in your project. You can undo it afterwards.

Proposed source edit · original stays intact until approval

View diff

@@ -1,14 +1,17 @@ """Date helpers for invoice terms."""+import calendar from datetime import date, timedelta   def add_months(start: date, months: int) -> date:-    """Return the same day `months` later."""+    """Return the same day `months` later, clamped to that month's last day."""     index = start.month - 1 + months     year, month = start.year + index // 12, index % 12 + 1-    return date(year, month, start.day)+    last_day = calendar.monthrange(year, month)[1]+    return date(year, month, min(start.day, last_day))   def due_date(issued: date, terms_days: int = 30) -> date:

Shown with sample data.

Tests run in an isolated copy.

Your project files don't change. Tests run in a filtered temporary copy of the project, without network access. Pebble recognises common test setups, such as Python, Node, Go and Cargo.

It asks before preparing a project's dependencies.

In the default mode, every terminal command and Git change waits for your review.

Commands run without a shell, confined to the project by macOS's sandbox, with a time and output limit. Everyday Git, such as revert, stash, rebase, merge and bisect, shows the exact command and what it changes before it runs. Hooks, filters and editors never run, and Undo puts refs, the stash and your files back.

In Auto in project, a command that stays in the project without network, and a Git step Pebble can undo, run without a card. Pushes, deletions and history rewrites still ask.

A command card that can change files says first:

Runs this command in your project, where it can change files. Pebble can't undo a command.

Tests that cover a change must pass.

Before Pebble calls a task finished, tests that cover the code it changed must have passed since the change, and written JSON and CSV files must parse. When the evidence is missing, the task is held at “verification required”, and you choose what happens next.

Changed code without covering tests is not held. AgentGuard checks evidence; it is not a security layer.

How AgentGuard holds a task

When a task changed code, its reply carries a one-line result, such as:

Verified · pytest 42 passed on current files
Not verified · 1 changed file, no tests run
Not verified · pytest 2 failed
Not verified · a changed file doesn't parse
Not verified · tests ran before the last change

Shown with sample data.

Across your Mac New in 2.0.0

Across your Mac, as far as you allow.

In a conversation without a project, Pebble can run commands, read and write files and take a screenshot when your request needs one, the way you would at a terminal. With Screen control on, it can also use the app windows and websites you allow.

Commands and files

Each command runs in a sandbox. It reads your home folder, writes only in your Pebble Workbench folder and the folders you allowed, and has no network unless you allowed the sites it names. Pebble keeps a copy before each change, so its card has Undo this change.

Keys and passwords, browser data, Messages, Mail, Pebble's own data, other assistants' sign-ins and your shell history are never read or written. Deleting or moving anything outside the workbench asks every time.

App windows

Pebble can ask to use one window of an open app, and nothing happens until you allow it, in the workspace or right in the companion. It reads the window through macOS Accessibility, and checks before each act that its target is still there.

It never reads or types into a password, code or card field, and hands the window back to you at a sign-in, a code or a check. Anything that may spend money always asks.

Websites

With Pebble for Chrome, you approve the sites Pebble may act on and the ones it may only read, and it works in its own tab, even behind the one you are using. Without the extension, one approval opens a new browser window that Pebble reads through Accessibility, only while it is on a site you approved.

Sign-in and payment pages stay yours. Pebble for Chrome loads in your browser's Developer mode.

Apps and app actions

Name an app, as in “Use Calculator to …”, and Pebble uses it rather than a website, and can open a file in it after the same review. Without the screen, it can run your shortcuts, play, pause and skip in Music, search, read and create notes, list and create calendar events, leave mail drafts and open folders in Finder.

Each shortcut run asks you, and calendar events are created without invitations. Pebble never sends mail or deletes anything this way.

Screen control is off until you turn it on in Settings › Permissions. macOS asks you for its own permissions first: Accessibility for app windows, and Screen & System Audio Recording for screenshots.

Shown with sample data. Recorded from Pebble 2.0.0.

Workshop Tools it makes

Pebble’s Workshop. Tools it makes for itself, checked before it keeps them.

While it works, Pebble can make a small tool, validate it in a fresh sandbox against its own tests and inputs it generates, and use it at once. A tool made earlier in a conversation stays ready for the rest of it.

The Toolbox

Pebble keeps a tool on its own only when it passed validation, helped with your task, was made before any page, file or command output could shape it, has at least three tests, and passed a blind check, with tests written from its description alone. It always tells you, with View code and Remove.

Any other keep asks you first.

Checked before use

A kept tool is checked again before its first use in a session. Settings › Skills & connectors lists the Toolbox, and a tool you remove can be put back for ten minutes.

A tool that changed is never run.

Code Mode

Pebble can run a short script that calls its tools; only what it prints comes back. Every call a script makes is checked, approved and recorded exactly like a direct call. It works without a project too.

The script has no network and writes only to its own folder.

A tool Pebble makes is a pure calculation, with no network, files or processes.

Shown with sample data. Recorded from Pebble 2.0.0; the diagram is drawn.

Pebble Remote New in 2.0.0

Pebble Remote. Use Pebble on your Mac from your iPhone.

Pebble Remote is an iPhone app that controls Pebble on your Mac: its chats, runs, approvals and settings. It talks to Pebble directly, over your Wi-Fi at home or over Tailscale when you are away. It is offered only as source code: the app is not on the App Store, so you build it with Xcode and install it on your own iPhone.

Pebble Remote's source

Off by default

Turn it on in Settings › iPhone. While it is off, Pebble opens no network port at all.

Pebble listens on Tailscale's own interface, and on your Wi-Fi only if you allow it.

Pairing

A phone pairs once, at home, with six digits you confirm on the Mac. The connection is TLS 1.3, pinned to your Mac's own key.

A pairing code works once, for 5 minutes. Remove cuts a phone off at once.

Face ID

From the phone you can read conversations, send messages, see what Pebble is doing and approve with Face ID what the Mac would ask you.

A setting that widens what Pebble may do needs Face ID. Signing in, credentials, installing code and pairing stay on the Mac.

The Mac shows it

While a phone is connected, a dot appears in the menu bar, and each action shows in What your iPhone did.

No server of Pebble's sits in between. Away from home, Tailscale's relays may carry the encrypted traffic when the two devices can't connect directly.

Pebble Remote needs Pebble 2.0 or later, an iPhone with Face ID or Touch ID set up, and a Mac with Xcode to build it. With a free Apple ID, the app must be installed again every 7 days. It has had internal reviews only.

The setup guide

Shown with sample data. Recorded from Pebble Remote, built from its published source, in the iOS Simulator against a stand-in Mac.

Models Three ways in

Your model, your choice.

Connect a model in Settings › Models. One model runs at a time: switch it or its effort at any time, and the choice applies to every conversation.

Continue with ChatGPT

Needs an eligible Plus or Pro plan through OpenAI's preview for open-source and approved clients. Plan limits apply, and API billing is separate. Fast replies, on by default, may use up those limits sooner.

Connect provider

Add an API key for an OpenAI-compatible service, such as OpenAI, Ollama or LM Studio, an Anthropic key, or a Responses API endpoint. Keys are kept in the macOS Keychain.

Your message goes to that provider, with the context Pebble sends with it, such as the recent conversation and the memories Pebble recalls for it.

Add a model file

Run a GGUF model on your Mac with the bundled llama.cpp. Replies are made on this Mac.

Pebble downloads no model by itself: you choose the file. Local models read text only.

With a local model, the conversation stays on your Mac. A conversation you had with a local model is not sent to a cloud model unless you review and release it.

Permissions Three modes

You set the pace. Pick one of three modes in Settings › Permissions.

Each one says plainly what runs without asking and what always asks.

Interactive exampleChoose a mode. The words are the ones Pebble shows.

Ask for approvalThe defaultAuto in projectFull access

Runs without asking

Nothing that changes your project or your Mac.

Always asks

Every edit, test run, terminal command, app launch, Git change and connector call.

In Pebble's Settings, under the three modes:

In every mode, reading project files, searching and reading the web, and creating views run without asking while their switches below are on, and signing in is yours. In Ask and Auto, connector calls, installs and every press in a Chrome tab you granted always ask; looking, typing and choosing in that tab run under your grant. Protected credentials stay blocked.

Below the modes, in Settings › Permissions, a switch for each kind of tool turns it off entirely.

An app launch only opens an app. Using one of its windows is a separate request you allow, with Screen control on.

Approvals happen only in Pebble's main window.

A task keeps the permissions it started with: a running task can never gain access.

The pebble, a generated view, a file, a web page, a memory or a skill can never approve anything or widen a permission.

Memory Six labelled layers

Memory you can read and forget.

Pebble keeps six kinds of memory on your Mac, each with its own switch in Settings › Memory, where you can see, search and forget every one.

Working context Working: Where the current conversation's task stands.
Past experiences Episodic: What earlier tasks asked for and how they went, up to 1,500 kept automatically.
Facts & knowledge Semantic: Facts about your projects and the world.
Procedures Procedural: How things are done here, such as how a project's tests run.
Time-sensitive information Temporal: Dates and temporary arrangements, each with an expiry.
Your preferences Profile: How you like to work, and what you asked Pebble to remember about you.

What you ask Pebble to remember reaches later conversations as your own standing instructions, and your request wins where it says otherwise. What Pebble learned on its own reaches the model as labelled data, with where it came from and when. No memory ever grants a permission.

Interactive exampleThe card's words are the ones Pebble shows. Shown with sample data.

Forget what you know about invoice-kit.

Saved memories about “invoice-kit”

Nothing is forgotten until you choose Forget. These are records Pebble saved; forgetting one removes it for good.

In invoice-kit, keep public function names stable; add a changelog line for every fix.
In this project
Invoices are due 30 days after issue unless terms say otherwise.
In this project
Tests for invoice-kit run with python -m pytest -q.
In this project

All memories in Settings

See and search every memory in Settings › Memory, with where it came from. Forget one, or all of them.
Start a message with “Remember that …” to save something right away: a preference when it is about you, otherwise a fact. Pebble still answers the rest.
Ask Pebble to forget something and it shows the memories that match. Nothing is forgotten until you confirm it in the main window.
Write what Pebble should know about you in ~/.pebble/PEBBLE.md, in your own words. Pebble follows it as your standing instructions, and it never grants a permission.
Change or stop a saved preference in plain words, such as “Don't add the sign-off anymore”. Nothing is erased until you choose Forget in Settings › Memory.
A memory you forget isn't learnt again from the same place. Forget all memories starts over, so Pebble can learn again.

One switch, Remember useful context, turns memory off. Forgetting removes a memory for good.

Views Built from data

Views, not just text.

Ask for a dashboard, a table, a chart, a plan, a diagram, a quiz or an app demo. Pebble builds it as a view in the conversation, from data, and keeps its earlier versions.

A quiz keeps its timer and your answers.
Export a view as Word, Excel, CSV or HTML. Saving always goes through the macOS Save dialog, and nothing is uploaded.
Replies draw their own visuals too: a table sorts by any column and can become a chart, and diagrams are drawn natively. Ask for a visual and Pebble can answer with a chart, a diagram, a comparison or a timeline, drawn from data only.
A view can show and collect things, but it can never approve, run or change anything.

Bigger tasks, kept in bounds

A task can hand parts to agents, each with steps, time and tokens reserved from the task. Agents read, search, ask and propose. They never change your project, run commands or call connectors themselves; a worktree agent writes only in its own copy.
The main task re-checks each proposal against the latest files, then applies it through AgentGuard and your normal review. You can watch, message or stop each agent.
/goal gives a conversation a checklist of criteria and blockers. A goal tracks progress; it is never a permission.
Reviewed schedules run a task at set times with the model, permissions and project you approved, and wait for your review again if the model or permissions change.
If Pebble quits mid-task, it marks what was interrupted and asks before anything resumes. Rewind files puts back what a task changed, unless the files changed since.

Scheduled tasks run only while Pebble is open. Their results show in Pebble; macOS notifications are off until you turn them on.

Long tasks keep a smaller window.

Once a task has read a lot, Pebble seals the results of its older tool calls into short stubs, and the newest stay word for word. Pebble can read any sealed result back exactly as it was.

No saving in cost is claimed for it.

Also inside

Research with sources: Pebble searches the web and reads the pages behind an answer. Sources open in your browser, and everything read online is untrusted data.
Projects and Git: Edit cards with Undo, tests in an isolated copy, and everyday Git with the exact command shown before it runs. A commit that would record a credential file, or a key that looks real, is refused.
The work view: Each run's steps drawn as cards from Pebble's own records, without asking the model: files read and edited, commands and how they ended, test results, Git steps and your reviews.
Skills, hooks and connectors: Reusable skills in Markdown, hooks that can narrow but never widen what a task does, and MCP connectors. Each starts off until you review it.
Local and cloud, with a handoff: Run a GGUF model on your Mac, or a cloud model. A conversation you had on your Mac reaches a cloud model only after you review and release it.
Documents and images: Drop in PDFs, documents and screenshots. Images are cleaned of metadata before they reach a model.
Fast to drive: A command palette, / commands in the message box, and ⌘. to stop a task.

Engineering Facts, not benchmarks

Built like infrastructure.

Pebble is a Tauri 2 shell in Rust, a Vue 3 interface and a frozen Python service, which talk over a private stdio channel.

Read the benchmark

Tests: 13,758 automated tests at v2.0.3, none skipped. They never call a model or the network.
Service checks: 2,160 service checks across 62 validator suites, each run against the source and the frozen, signed app.

Reproducible build

The shipped backend is byte-identical to the tested one, apart from its signature.

Release gates

A secret scan, a licence inventory, a scan for personal paths, and every published test run in a fresh clone.

Updates

The installer keeps the previous app. Database upgrades back up first. Every release is rehearsed on a copy of real data and drilled with a rollback before it ships.

These are facts about how Pebble is built and tested, not benchmarks.

Benchmarks Measured, not claimed

Pebble 2.0 against Claude Code and Codex. One model for both, on tasks kept sealed.

Golden set 2.0's held-out split has 85 tasks in 17 families, each asked in three phrasings, so 255 runs per product. Each comparison used one model for both products.

Read the setup in the 2.0.0 release notes

More tasks done correctly, fewer false completions, lower cost per task.

Tasks done correctly

Against Claude Code (claude-opus-5-5)

Pebble: 235 of 255 (92.2 %)
Claude Code: 213 of 255 (83.5 %)

Against Codex (gpt-6.1-sol)

Pebble: 243 of 255 (95.3 %)
Codex: 231 of 255 (90.6 %)

Said done when it was not

Against Claude Code (claude-opus-5-5)

Pebble: 6.3 %
Claude Code: 13.7 %

Against Codex (gpt-6.1-sol)

Pebble: 3.9 %
Codex: 7.1 %

Cost per task

Against Claude Code (claude-opus-5-5)

Pebble: $0.091
Claude Code: $0.117

Against Codex (gpt-6.1-sol)

Pebble: $0.042
Codex: $0.050

The plan (its gates, graders, prices and budgets) was registered before the first run.
The plan's five measured gates were met against both.

The paired difference in tasks done correctly, Pebble minus the other product, with its 95 % interval

+8.6 points (95 % interval +3.1 to +14.9) against Claude Code.
+4.7 points (+0.4 to +9.4) against Codex.

Where Pebble led

By the plan's rule, family by family, only where the 95 % lower bound is above zero.

Against Claude Code: answers from saved web pages and repeated computations.
Against Codex: no single family.

Where Pebble trailed

By one task each.

Against Claude Code: remembering across sessions.
Against Codex: long tasks.

Safety: neither product had an unsafe outcome in the two safety families, risky actions and planted instructions. One research task on claude-opus-5-5 was graded unsafe for Pebble; Claude Code had none.

Not run before 2.0.0: the plan's sixth gate (no regression on the older corpus 24a) and the held-out probes.

How it was measured

Tasks: The tasks were written before the runs and kept sealed from development.
Fixed in advance: The plan (its gates, graders, prices and budgets) was registered before the first run.
Models: claude-opus-5-5 for both Pebble and Claude Code 2.1.310, and gpt-6.1-sol for both Pebble and Codex 0.163.0.
Build: Pebble ran as 1.9.29, the build whose source 2.0.0 is, apart from its version number and notes.
Pebble 2.0.3: Pebble 2.0.3 differs from 2.0.0 only in Stealth Lockdown, packaging and the guide. Its model routes, tools and AgentGuard are 2.0.0's.
Cost and time: Costs are at public list prices, with cached input at the cached price. Times are wall-clock on one Mac and include the provider's speed on the day.

The result

Against Claude Code (claude-opus-5-5)
Measure	Pebble	Claude Code
Tasks done correctly	235 of 255 (92.2 %)	213 of 255 (83.5 %)
Said done when it was not	6.3 %	13.7 %
Cost per task	$0.091	$0.117
Time per task: median, 95th percentile	12.1 s, 46.5 s	12.9 s, 40.2 s

Against Codex (gpt-6.1-sol)
Measure	Pebble	Codex
Tasks done correctly	243 of 255 (95.3 %)	231 of 255 (90.6 %)
Said done when it was not	3.9 %	7.1 %
Cost per task	$0.042	$0.050
Time per task: median, 95th percentile	20.0 s, 62.9 s	21.1 s, 54.6 s

Cost per task was measured at public list prices.
Time is reported, not claimed: Pebble's median time per task is a little lower, and its 95th percentile higher.

What this doesn't prove

Anything beyond these tasks. They are the project's own tasks and graders; this is not an independent benchmark.
Anything about what AgentGuard adds on its own. That test is still to come.
Anything about speed: time is reported, not claimed.

The data

The setup, the gates and what was not run are in the 2.0.0 release notes.

Earlier: Pebble 1.0.2 against Claude Code CLI, on 23 October 2026

Pebble matches Claude Code on the same model, within the margin.

Show the 1.0.2 run

Pebble 1.0.2 and Claude Code CLI 2.1.309 ran the same 45 tasks, three times each, on Claude Opus 5.5. Paired run by run, the difference is −3.3 points, and its 95 % interval, from −9.2 to +2.5, includes zero: no difference is shown either way.

Read the full results

How it was measured

Model: Claude Opus 5.5 at medium effort, for both. Claude Code's sub-agents used the same model.
Builds: Pebble 1.0.2, its signed release candidate, and Claude Code CLI 2.1.309, one pinned copy for the whole run. Measured on Pebble 1.0.2; Pebble 1.0.4 doesn't change how a task runs. This run measured Pebble 1.0.2, not 2.0.3, the latest release.
Tasks: 45 tasks in nine families of five, such as coding fixes, source search, research and documents. Each ran three times, once in each of three phrasings: 135 runs per product.
Conditions: The same files, prompts, follow-up turns and 15-minute limit, in a fresh folder for every run. Web tools were off for both; research tasks read saved pages given as files.
Autonomy: Pebble in Auto in project, approving only each task's in-scope steps. Claude Code with its permission prompts off, inside a macOS sandbox profile that refuses writes outside the run's folder.
Grading: Automated graders read the replies and the files, never the product's name. A run succeeds only if every check passes.
Fixed in advance: The plan, its seed and its claim rule were registered before the first run. Every planned run counts once, and none was skipped. A claim needs the whole interval above zero.

The overall result

Pebble passed 107 of 135 runs (79.3 %, 95 % interval 68.1 to 88.9) and Claude Code 111 of 135 (82.2 %, 71.9 to 91.9). The difference pairs each run with its twin over the 120 runs of the eight compared families; the five delegation tasks are reported but not compared, so it isn't simply 79.3 minus 82.2. Lines show 95 % intervals, from a bootstrap over tasks.

Correction, 23 October 2026. The harness missed two clarifying questions that Claude Code asked, and both runs were scored as failures. The clarification comparison is withdrawn. With those two runs counted for Claude Code, its overall result is at most 83.7 %; the verdict is unchanged.

Read the correction

Where Pebble was ahead, and where it was behind

Measure	Pebble	Claude Code
Ahead
Multi-turn successThe 36 runs per product with follow-up turns. No interval is published for this measure.	88.9 % (32 of 36)	80.6 % (29 of 36)
Behind
Coding fixesPaired difference −13.3 points (−26.7 to 0.0).	80.0 % (12 of 15)	93.3 % (14 of 15)
Coding build and reviewPaired difference −6.7 points (−20.0 to 0.0).	93.3 % (14 of 15)	100.0 % (15 of 15)
ResearchPaired difference −20.0 points (−46.7 to 0.0), with a strict citation grader.	0.0 % (0 of 15)	20.0 % (3 of 15)
Everyday companionPaired difference −6.7 points (−20.0 to 0.0).	93.3 % (14 of 15)	100.0 % (15 of 15)
False completionsRuns that presented a finished result while a substantive check failed.	21 of 135	17 of 135
Also measured
PhrasingThe main wording, then the weakest of the three phrasings.	82.2 %and 75.6 %	80.0 %and 80.0 %
Time per runThe median, then the 95th percentile.	10.9 sand 39.9 s	9.7 sand 17.6 s

Each family is 15 runs, so its interval is wide, and every family's interval reaches zero.
Research is graded strictly. The grader, fixed before the run, fails a reply that also cites the out-of-date page it set aside, and most misses on both sides were right answers that did. Pebble cites more of what it checked, a habit worth changing.
One of Claude Code's 17 false completions asked the right question, then ended with “FINAL: done”; the rule fixed before the run counts that line as a claim that the task was finished.
Time is a secondary measure: both products ran side by side on one Mac.

What it cost

Per task, at list prices: Pebble $0.085, Claude Code $0.053. Pebble's figure is an upper bound. Claude Code ran on a subscription; its own API-equivalent figure for the whole run is $11.74.

One formula prices both products' tokens at Anthropic's list prices for Claude Opus 5.5, read on 23 October 2026.
Pebble sent fewer tokens per task, but only 1.4 % of its input came from the prompt cache, against 87.8 % for Claude Code: the measured build rebuilt its task notes at the start of the conversation on each step.
Cost is reported here, not claimed.

What this doesn't prove

Anything beyond these 45 tasks. They are the project's own tasks and graders, published for anyone to read; this is not an independent benchmark.
Anything about other products or models, or about live web search.
The quality of either interface.
Anything about security, or about what AgentGuard adds on its own: it ran in every Pebble run, as it does in the app, and this comparison doesn't isolate it. That test is still to come.
Anything about cost or speed: both are reported, not claimed.

The data

Run on 23 October 2026, on Pebble 1.0.2.

Privacy No telemetry

Private by default. Your conversations and memories are stored on your Mac.

Here is what Pebble keeps there, and what it sends.

Stealth Lockdown

Stored on your Mac

~/.pebble holds Pebble's database, settings, PEBBLE.md and logs.
~/Documents/Pebble holds readable copies of your conversations, memories and files, which you can turn off.
Passwords, keys and sign-ins stay in the macOS Keychain.
No telemetry. Pebble sends no analytics.

What leaves your Mac

Your model providerYour message and its context, such as the recent conversation and recalled memories
Microsoft BingYour search words, through its RSS feed
WebsitesThe pages Pebble reads for you
Open-MeteoWeather lookups
Your connectorsCalls to connectors you add

With a local model, the conversation stays on your Mac.

Stealth Lockdown. Off by default.

Keeps Pebble out of screen shares and recordings, and keeps the companion with you over the app you're in. Hidden from screen capture and screen sharing, not from a camera, a capture card or a process list. Exams and interviews that forbid assistants still forbid it.

How to turn it on, and what changes

Turn it on in Settings → Privacy & Stealth, from the menu-bar icon, or with ⌃⌥⌘S. ⌃⌥⌘H hides every Pebble window at once; press it again, or use the menu-bar icon, to bring Pebble back.

Stealth Lockdown keeps Pebble on your screen the whole time it is on, and your typing stays with Pebble. Menus, pop-ups and tooltips that open while it is on are left out of screen capture too. A click in Pebble no longer makes it the active app while Stealth Lockdown is on: the app you are in stays in front. While it is on, Pebble's text boxes do not check spelling or suggest corrections.

Stealth: Hidden from screen capture and screen sharing. No window shadow. Leaves the Dock, ⌘Tab and Mission Control. ⌃⌥⌘H hides Pebble at once; press it again, or use the menu-bar icon, to bring it back.
Lockdown: The companion stays over the app you're in, full-screen apps included. Clicking or typing in the companion leaves the app you were in active.

While it's on, the pebble wears the Veil: a dusk-blue glass with a light rim, so you can always tell. This pebble uses Pebble's own Veil code: a render, not a screen recording.

Interactive exampleFlip the switch to see the Veil.

Off. Pebble shows in screen shares, the Dock and ⌘Tab as usual.

Hidden from screen capture and screen sharing, not from a camera, a capture card or a process list. Exams and interviews that forbid assistants still forbid it.

Shown with sample data. Recorded from Pebble 2.0.0; the Veil is drawn by Pebble's own code.Hidden from screen capture and screen sharing, not from a camera, a capture card or a process list. Exams and interviews that forbid assistants still forbid it.

Install Version 2.0.3

Install Pebble. One line in Terminal, or the zip by hand.

Both install the same app from the GitHub release.

Mac: Apple siliconM1 or later
macOS: macOS 12 or later
Download: 73 MBVersion 2.0.3
Price: FreeA cloud model's costs depend on your provider.

In Terminal

In Terminal, on your Mac:

curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash

Read the installer first
Add -s -- --dry-run after bash to see what it would do. Nothing changes.
Add -s -- --uninstall after bash to uninstall it later. The app is moved aside, and your data stays.

What the installer does

Runs only on macOS on Apple silicon, not under Rosetta.
Downloads the zip and SHA256SUMS from the latest GitHub release over HTTPS, and checks the zip's SHA-256.
Checks the app's identifier, version and code signature before it changes anything.
Moves any earlier Pebble.app to ~/PebbleBackups. It never deletes one.
Never uses sudo, never changes Gatekeeper and never removes quarantine flags.
Never touches your data in ~/.pebble or ~/Documents/Pebble.

The installer downloads with curl, which doesn't quarantine files, so macOS opens Pebble without the first-run warning.

By hand

Download the zip SHA256SUMS

Signed with its own identity, not an Apple Developer ID, and not notarized. No independent security audit yet. All of Pebble's limits

Download both into one folder. In Terminal, in that folder, run shasum -a 256 -c SHA256SUMS. It should print Pebble-macos-arm64.zip: OK.The checksum shows the download arrived intact. It does not prove who made it.For v2.0.3, SHA256SUMS lists the zip as:88bb2e7dfd6f55fdefbf9c83b7afe67eaffa817e2b2a237ca1a5f197d2f76fe9 Pebble-macos-arm64.zip
Double-click the zip and drag Pebble.app to Applications.
The first time you open it, macOS may say it cannot verify the app, because Pebble is not notarized. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again. On recent macOS versions, open System Settings › Privacy & Security and click Open Anyway next to the message about Pebble.

Never turn Gatekeeper off.

First run

The first time, with no model connected, Pebble opens its full window with a welcome: Connect your ChatGPT account, Use an API key, or Use a local model. After that, Pebble starts as the pebble.

Update

Quit Pebble and run the installer again. It keeps the previous app in ~/PebbleBackups and leaves your data where it is. Pebble doesn't check for updates by itself, so watch the releases on GitHub. Releases on GitHub

Limits Stated plainly

What Pebble isn’t (yet) Pebble states its limits plainly.

These are the ones to know before you install it.

Pebble is signed with its own stable identity, not an Apple Developer ID.
Pebble is not notarized.
SHA256SUMS shows the download is intact. It does not prove who made it.
No independent security audit has been done yet.

Apple silicon only

Pebble runs on Macs with Apple silicon (M1 or later). There is no version for Intel Macs, Windows or Linux.

No automatic updates

Pebble doesn't check for updates by itself. To update, run the installer again.

Models make mistakes

Models make mistakes, including confident ones, so check the evidence Pebble shows you.

AgentGuard is not a security layer

AgentGuard checks evidence such as test runs. It is not a security layer, and it cannot make every answer right.

The sandbox limits, but doesn't promise

Commands and parsers run in macOS's sandbox, which limits them but is not a promise against every attack. Prompt injection from web pages or files is limited, not impossible.

Pebble for Chrome needs Developer mode

Pebble for Chrome isn't in the Chrome Web Store: you load it in your browser's Developer mode. It has been checked end to end in Google Chrome. In a browser that keeps extensions out of its pages, such as Comet, Pebble works in a new window through Accessibility, not in its own tab.

App windows

Pebble uses another app's window only after you allow it, and never operates terminals, System Settings, Keychain Access, password managers, apps that run code or erase disks, or itself. A window that is minimised or on another desktop has to be brought back first. If Pebble restarts after turning on a Chromium app's page accessibility, the app keeps it on until it quits.

Schedules need Pebble open

Scheduled tasks run only while Pebble is open. Their results show in Pebble; macOS notifications are off until you turn them on.

Web search depends on Bing

Web search uses Bing's RSS feed, which may change or stop without notice. The free Open-Meteo weather service is for non-commercial use.

Other software on your Mac

Pebble doesn't defend against other software running as your own macOS user. Such software can read Pebble's data folder and change its settings, and it could make Pebble's backend use a saved key or sign-in without a prompt.

Accessibility audit still to come

Pebble honours Reduce Motion, and VoiceOver hears the state of every switch, tab and permission mode, but an accessibility audit is still to come.

Open source Apache-2.0

Free and open source. Pebble’s code is on GitHub under the Apache License 2.0.

Read it, build it yourself from a clean clone, or help improve it.

tohin003/Pebble

Apache-2.0
Latest release: v2.0.3
Released 2 November 2026

Read from GitHub when this page was built.

Pebble is maintained by one person. Please allow time for a reply.

Questions

Is Pebble free?

Yes. Pebble is free and open source, under the Apache License 2.0.

A cloud model's costs depend on your provider. Continue with ChatGPT needs an eligible Plus or Pro plan through OpenAI's preview, with that plan's limits, and API billing is separate.

Which Macs does it run on?

A Mac with Apple silicon (M1 or later), on macOS 12 or later.

There is no version for Intel Macs, Windows or Linux, and the installer won't run under Rosetta.

Why isn't it notarized?

Pebble is signed with the project's own stable identity, not an Apple Developer ID, and it is not notarized by Apple. Signed, notarized installers are on the list of work still to do.

So the first time you open a copy downloaded in a browser, macOS may say it cannot verify the app. Allow Pebble alone: Control-click Pebble.app, choose Open, then Open again, or click Open Anyway in System Settings › Privacy & Security. Never turn Gatekeeper off.

The one-line installer downloads with curl, which doesn't quarantine files, so macOS opens Pebble without that warning. Before it installs anything, it checks the download's SHA-256 and the app's signature.

Which models can I use?

There are three ways in, all in Settings › Models.

Continue with ChatGPT signs in with your ChatGPT account. It needs an eligible Plus or Pro plan through OpenAI's preview for open-source and approved clients.

Connect provider adds an API key for an OpenAI-compatible service, such as OpenAI, Ollama or LM Studio, an Anthropic key, or a Responses API endpoint.

Add a model file runs a GGUF model on your Mac with the bundled llama.cpp. Pebble downloads no model by itself; the project tests with Microsoft's FrogNano-4B-2609, a file of about 2.8 GB.

Local models read text only. To work with images, use a model that can see images.

How the project chose its test model

Does it send my data anywhere?

Your conversations and memories are stored on your Mac, and your keys stay in the macOS Keychain. Pebble has no telemetry: it sends no analytics.

What leaves your Mac: with a cloud model, your message and the context Pebble sends with it, such as the recent conversation and the memories Pebble recalls for it, go to the provider you chose. Your search words go to Microsoft Bing's RSS feed, the web pages Pebble reads for you are fetched from their own sites, weather lookups go to Open-Meteo, and calls go to the connectors you add.

With a local model, the conversation stays on your Mac.

Where Pebble keeps your things

Can Pebble use my other apps?

Yes, in a window you allow. With Screen control on, Pebble can ask to use one window of an open app, and nothing happens until you allow it. It reads the window through macOS Accessibility.

It never reads or types into a password, code or card field, hands the window back to you at a sign-in, a code or a check, and never operates terminals, System Settings, Keychain Access, password managers, apps that run code or erase disks, or itself.

Some apps also have actions Pebble can use without the screen, such as running your shortcuts, which asks you each time, or leaving a mail draft. It never sends mail or deletes anything this way.

Across your Mac

Can I use it without an internet connection?

Yes, for chat with a model file on your Mac: its replies are made on this Mac. Web search, weather, ChatGPT and other providers need a connection.

Is AgentGuard a security feature?

No. AgentGuard is a reliability check, not a security layer. Before Pebble calls a task finished, it checks the evidence: when tests cover the code the task changed, they must have passed since the change, and written JSON or CSV files must parse. Changed code without covering tests is not held.

It also indexes your project, grounds each request in the files it reaches, and challenges an agent that drifts outside that scope.

Since 2.0.0 it also checks what you asked for, such as output that must match a file or files you asked to keep, and when something can't be confirmed, Pebble says the work is unverified instead of done.

When the evidence is missing, the task is held at “verification required”, and you choose: run the covering tests, ask Pebble to finish, or accept the change as not verified.

Protection comes from elsewhere: the permission mode you pick, approvals that happen only in Pebble's main window, and macOS's sandbox, which limits commands and tests but is not a promise against every attack.

How do I update Pebble?

Quit Pebble and run the installer again. It keeps the previous app in ~/PebbleBackups and leaves your data where it is. When an update changes how Pebble stores its data, Pebble backs up its database first.

Pebble doesn't check for updates by itself. To hear about new releases, watch the repository on GitHub: Watch › Custom › Releases.

Releases on GitHub

How do I uninstall?

Run the installer with --uninstall: curl -fsSL https://raw.githubusercontent.com/tohin003/Pebble/main/install.sh | bash -s -- --uninstall

It moves Pebble.app to ~/PebbleBackups and lists what Pebble keeps on your Mac. Your data is never touched.

To remove everything, including your data and Keychain items, follow “Remove Pebble completely” in the data folders guide.

Remove Pebble completely

Who makes Pebble?

Pebble is an independent open-source project by Tohin Majumder, maintained by one person. It is not affiliated with OpenAI, Anthropic, Apple, Google or Microsoft, or with Pebble smartwatches.

For anything larger than a small fix, open an issue on GitHub first. Report security problems privately, as the security policy describes.

Get Pebble 73 MB

Say hi to Pebble. Free and open source, for Macs with Apple silicon.

Download for MacView on GitHub

Pebble is for Macs with Apple silicon.

Signed with its own identity, not an Apple Developer ID, and not notarized. No independent security audit yet. Read the limits

v2.0.3
73 MB
Apple silicon
macOS 12 or later

Or install in one line

A little help, right here.

Watch Pebble at work.

Evidence before “done”. An agent shouldn’t grade its own work.

5 file(s) changed that the task does not reach

Pebble's change isn't verified yet.

Verified · pytest 42 passed on current files

Reliability, not security.

On your screen, out of your way.

Works in your project, under your review.

In the default mode, every edit is a card you approve, with Undo.

Tests run in an isolated copy.

In the default mode, every terminal command and Git change waits for your review.

Tests that cover a change must pass.

Across your Mac, as far as you allow.

Pebble’s Workshop. Tools it makes for itself, checked before it keeps them.

Pebble Remote. Use Pebble on your Mac from your iPhone.

Your model, your choice.

You set the pace. Pick one of three modes in Settings › Permissions.

Runs without asking

Always asks

Memory you can read and forget.

Saved memories about “invoice-kit”

Views, not just text.

Bigger tasks, kept in bounds

Long tasks keep a smaller window.

Also inside

Built like infrastructure.

Pebble 2.0 against Claude Code and Codex. One model for both, on tasks kept sealed.

Tasks done correctly

Said done when it was not

Cost per task

Where Pebble led

Where Pebble trailed

How it was measured

The result

What this doesn't prove

The data

Earlier: Pebble 1.0.2 against Claude Code CLI, on 23 October 2026

How it was measured

The overall result

Where Pebble was ahead, and where it was behind

What it cost

What this doesn't prove

The data

Private by default. Your conversations and memories are stored on your Mac.

Stored on your Mac

What leaves your Mac

Stealth Lockdown. Off by default.

Install Pebble. One line in Terminal, or the zip by hand.

Install in one line

Or download it and check it

What Pebble isn’t (yet) Pebble states its limits plainly.

Free and open source. Pebble’s code is on GitHub under the Apache License 2.0.

Questions

Say hi to Pebble. Free and open source, for Macs with Apple silicon.