Local. Native. Yours.
The Nebbos app for macOS and Windows. Runs an offline-capable subset of the platform. Syncs to the cloud through the Nebbos MCP when online. Every operator’s first install.
Get the highlights
Five commitments. One local surface.
Platforms
macOS · Windows
Signed installers. Auto-update opt-in. No install wizard, no adware.
Mode
Offline-capable
Local-first workflows continue when the network doesn't.
Sync
Through the MCP
State reconciles on reconnect via authenticated MCP calls, not shared cloud storage.
Bundle
Included with Platform
Every Platform subscription includes the app at no separate charge.
Approval
Biometric-first
Elevated ops on local files gate on Touch ID · Face ID · Windows Hello.
Take a closer look
What the app is good at.
Runs where you work
The app installs on macOS or Windows and integrates with the OS's native biometric surface. No web tab, no browser context.
Offline is a first-class mode
Read caches, draft actions, and queue elevated ops locally. When the network returns, everything reconciles through the MCP.
Air-gapped deployments supported
For sensitive contexts where continuous internet isn't safe, the app runs against a locally-hosted MCP with periodic manual sync.
Enrolled once, used everywhere
First-touch WebAuthn enrollment registers your biometric-bound credential. Every subsequent session uses that credential; no password to type.
The core
Bundled with Platform.
The Nebbos app is not a separate purchase. Every Platform seat includes the app for the operator on that seat. Install on any macOS or Windows machine that operator uses.
When an operator pairs a Nebbos USB (L2 or L3), the app enables the tier-gated operations for the paired device. Same code, same binary — the gate is the presence, not a feature flag.
Built for
The operators working where the network isn’t.
Field operators
The people executing outside a data center — deployment sites, remote offices, on the move.
Air-gapped teams
Defense, classified, and disaster-recovery contexts where continuous internet isn't safe.
Every Nebbos operator
Anyone on a Platform seat. First install, day one.
Values
Three commitments.
Local isolation
Your data stays on your device.
The app operates on local caches and drafts. Nothing transmits until you approve it via biometric assertion.
Biometric approval
Every elevated action, your fingerprint.
Touch ID · Face ID · Windows Hello. The private key never leaves your device's Secure Enclave. No password, no shared token.
Signed distribution
Signed installers. Verifiable builds.
Notarized on macOS, code-signed on Windows. Auto-update opt-in with signature verification per release. Reproducible from source.
Tiers
Same app. Tier scope depends on your Platform seat.
The app itself is one binary. What it lets you do depends on your Platform tier. L2 unlocks paired-USB operations; L3 unlocks enclave-attested workstation ops.
L1 · Basic
Local native macOS + Windows client, bundled with Platform.
Bundled with · Platform L1 subscription
Ops · Dashboard view, personal-scope reads, low-risk tool calls.
L2 · Privileged
Local native client with USB-gated elevated operations.
Bundled with · Platform L2 subscription
Ops · Shell writes, memory registers, admin operations within the Shell.
L3 · Admin
Local native client for enclave-attested admin operations.
Bundled with · Platform L3 subscription
Ops · Shell creation and destruction, substrate mutation, cross-Shell, quorum-required actions.
Native. Local. Every operator’s first install.
The Nebbos app ships with every Platform subscription. Reach out and we’ll walk you through onboarding, biometric enrollment, and USB pairing for elevated tiers.