Pair on a coding agent.
Live.

A program you talk to in ordinary sentences. You point it at one folder on your computer and it can read what is in there, run your commands, and propose changes to your files. You decide what it may do without asking; for the rest, Bellows stops it and shows you the exact change first. Bellows is the window you do that in: the agents, the permission prompts, the diffs, the record of what was decided. If that is still abstract, the walkthrough is six working models you can click, and it takes about twelve minutes.

To get value from it, yes — this is a tool for people who work on code, and you have to be able to read a change to know whether to accept it. You do not need to know anything about agents, terminals or configuration files: the app ships with sample rules, worked examples and a guided tour of its own window.

OpenAI’s Codex, Gemini CLI, Qwen Code and any other agent that speaks the Agent Client Protocol (ACP), plus Claude, which is built in and runs on your Anthropic API key. Your rules apply to every action an agent asks permission for. Codex asks about commands and file changes through its own app-server; the few it treats as safe run without asking, and Bellows records each of those in the audit trail as having run. An ACP agent is governed through the permission requests it sends. Each keeps its own credentials: an API key is stored encrypted by your operating system and never sent to us. Whichever agent runs, the same rules apply and the same audit records are written.

Yes. If Ollama or LM Studio is running, Settings → Models → Find local models lists its models, and one click starts sessions on the one you choose — no gateway to set up, and your prompts and code never leave the machine. The same rules, permission prompts and audit records apply. What it takes: coding agents need a long context window (in Ollama, set the context length to 64k or more), and a graphics card or Apple silicon to run on. On a processor alone a single turn can take ten minutes or more, and the small models that fit on a laptop often fail to use tools at all. Bellows warns you when Ollama is running a model without a graphics card.

Yes. The complete desktop client is free. Bring your own agent account; provider usage charges still apply. The optional team control plane is the paid layer.

Sessions run on your machine using your agent and provider credentials. The Bellows control plane receives usage and sanitised audit metadata, never your source files or full transcripts. Your agent provider’s own data terms still apply.

When an agent finishes a job that works on files — merging two supplier lists, totalling a timesheet, turning a folder of exports into one clean import file — Keep as a tool turns it into a small app with file pickers and a Run button. Next month you choose next month’s files and press Run. It is ordinary local code by then, so running it needs no agent, no account and no AI usage charge. Changing it still uses your agent, as it should. Not every job can become one: work that needs the shell, the network, a login or the model itself stays a session, and Bellows tells you so in those words rather than quietly charging you for an agent instead.

That is the point of it. Share writes one `.bellows-tool` file — email it, message it, put it on a share. Whoever receives it installs the free Bellows desktop app once and opens the file. No agent, no provider account, no terminal, no team subscription. They can also open the version they have with their own agent and adapt it. Installing an app is a real cost compared with a link, and we are not pretending otherwise; what you get for it is a thing that runs on your own machine, on your own files, with nothing sent anywhere.

Opening one shows you what it is before anything is kept: the files it will ask for, what it gives back, everything inside it, and where it came from. Looking is not running. The file is plain text, so a tool’s whole source is readable in the thing you were sent. When it runs, it runs sealed off — it gets the bytes of the files you picked and nothing else, with no network of any kind, no shell, and no access to a file you did not choose or to any other tool’s data. If the tool ships samples with expected results, Check runs them and compares, which tells you it does its job — not that it is safe. Treat a tool from a stranger as you would any program from a stranger; the sandbox is what limits the damage, and it has been tested against deliberately hostile tools, but it has not had an independent security review.

A reviewed catalogue where teams publish the tools they keep, and install each other’s. Browse it at bellowsai.app/tools or inside the app; installing, publishing and rating are part of the Team plan. Every version is reviewed by Bellows staff — who read its whole source — before anyone else can install it, and every marketplace tool ships samples with expected results, so Check can prove it works on your machine before you trust it with real data. Tools you install keep working if you cancel.

Report it from the app; staff read every report. If a version is withdrawn, Bellows disables every installed copy of it — however it arrived, and whether or not its owner still subscribes — so it can no longer be run or shared. Review lowers the risk and the sandbox limits what a tool can reach, but neither is a guarantee: treat a tool as you would any program.

A person, not a machine. Their laptop and desktop belong to the same seat. Add the people you need, when you need them.

Yes. Team workspaces include 90 days of audit history, with CSV and JSONL exports for your archive and reporting tools.

You share a session you are running. Your colleague opens a link and sees the same transcript and the same diffs, live — syntax highlighted, line by line. Their link carries one role: watch, suggest, or type. A suggestion is queued for you and never reaches the agent until you accept it, and answering permission prompts is a separate switch that is off until you turn it on. The session runs on your machine throughout. The link can be served straight from your machine, which works across your own network and is free, or carried by the hosted Bellows relay so somebody outside your network can join without you setting up a tunnel; the relay is part of the Team plan. The relay forwards sealed frames and is a pipe, not a participant: the session, your files and your agent stay on your machine either way.

Shipped: desktop sessions with Codex, Gemini CLI, Qwen Code, any ACP agent and Claude (with an Anthropic API key), and with local models through Ollama or LM Studio; team policy publishing and enforcement, with a policy generator to start from; the hash-linked audit trail with export; usage reporting and a daily budget per machine; machine pairing and revocation of team access; live session sharing on your own network, and through the hosted relay on the Team plan; switching agents mid-task (Continue with…) with a project memory every agent reads, and History for every agent; handing a session to a teammate as a file; a live review pane of the agent’s edits; answering permission prompts from your phone on any network and from the web console, on the Team plan. Keep as a tool, running kept tools with no agent, sharing them as files, Check, four ready-made tools, and the reviewed tool marketplace. Windows is the platform tested end to end; the macOS and Linux builds carry the same code. Team billing is live: start a trial with no card, then subscribe from the console and pay through Stripe. SSO and SCIM are planned.

Parallel agents, coming soon: give several agents several jobs at once, each in its own copy of your code (a git worktree), then review every change and choose what is merged. Mix Codex, Gemini CLI, Claude and any ACP agent in one run; each one runs under your team policy, and its decisions land in the audit trail. It builds on the worktree sessions Bellows already has.