What JARVIS does, how each part works, and what it needs. The app is free and has no account of its own; the AI work runs on your own accounts and subscriptions, named under each feature.
Windows: everything. macOS: the app with the wake word, an icon in the menu bar, shortcuts that work from any app, dictation into other apps, working in other apps' windows, step-by-step control and telling the Mac's own sound from your voice. The built-in browser panel and the small listening window are Windows-only for now. Every change is run by automated tests and, on a real Mac at GitHub, by a check that opens TextEdit, types, presses and dictates in it, takes a picture of the screen, presses each shortcut from another app, chooses from the menu-bar menu, plays "Hey Jarvis" to the wake word and measures a sound the Mac plays. Its owner has installed it on a real Mac and opens it from its icon; nobody has used it day to day yet. Features marked Windows only are not on the Mac yet.
Typed and spoken messages go to the same fast assistant.
Answers typed and spoken messages, with the words appearing as they are written.
Simple requests such as "set a timer for ten minutes" or "volume up" are carried out at once with no AI at all. Everything else goes to a Claude model (Haiku unless you choose Sonnet or Opus), and a spare session is kept ready so even the first message of a new chat starts quickly.
Needs: the Claude Code command-line tool, signed in with your Claude subscription.
Press the wave button (or Ctrl+Space) and talk: JARVIS answers out loud, sentence by sentence, then listens again.
You can interrupt by talking: its voice dips at once and it stops when it hears real words from you. "Stop" ends what it is doing, "go to sleep" makes it wait for its name, and an idle session goes to sleep after 15 minutes (a setting). Questions that need a yes, such as "Shall I send this email?", can be answered out loud.
Needs: a Groq key (free tier) for speech-to-text with Whisper, or an OpenAI key. An ElevenLabs key for its voice is optional; without one, the browser engine's built-in voices speak.
Say "Hey JARVIS" from anywhere, with or without the window open, or say the request in the same breath.
The listening happens on your computer and is for the wake word only, so ordinary talk is dropped on the spot and never leaves it. Only a sentence that begins with the name is transcribed and handed to JARVIS. On Windows, Windows' own offline speech recogniser listens, and an optional small neural model (openWakeWord) hears the name better across a room or over music. On a Mac that small model is what listens, and the installer sets it up. It can be switched off.
A film, a video or music playing through the speakers is not taken for you.
JARVIS knows how loud everything the computer plays is at each moment: Windows reports it, and on a Mac (macOS 13 or newer) a small helper measures it and keeps nothing of what it hears. Sound at the microphone that rises and falls in step with it is dropped before anything is transcribed. While something is playing, only what is said to JARVIS by name counts, and a spoken yes needs the name too, so a film cannot give instructions or approve anything.
The microphone button writes what you say into the message box.
Ctrl+Alt+D on Windows, or Control+Option+D on a Mac, works in any app: speak, and the words are typed where your cursor is. Nothing is recorded unless the shortcut was pressed. An attached audio or video file (up to 25 MB) can also be written out as text.
Switch on Research beside the message box and your next message is looked into on the web.
JARVIS runs several web searches and answers with a report and its sources. A small arrow beside the chip chooses who does the research.
And it asks before sending, deleting or paying. Every action is checked by the JARVIS service before it runs, and the AI cannot answer that check for you.
Ask it to open apps, files and websites, switch windows, press buttons and fill boxes, find and read files, set timers and reminders, or change the volume and brightness.
Buttons are pressed by name through the system's accessibility layer (UI Automation on Windows, the Accessibility interface on a Mac), which lists the buttons, boxes and links of a window. While it works for you, it types and clicks only in the window it opened or switched to, never in whatever happens to be in front and never in its own window; if that window cannot be brought to the front, nothing is typed. On a Mac, macOS asks you once to allow this under Privacy & Security.
A chip in the message bar sets how much JARVIS asks before it acts: Auto (the usual one: only before sending, deleting or paying), Manual, Accept edits, Plan, or Bypass permissions. Shift+Tab goes to the next one.
When JARVIS asks, the question is a card at the end of the chat with its answers on it; nothing else stops, and the work carries on as soon as you answer. A yes covers exactly the action that was shown, once. Bypass permissions asks nothing; what JARVIS never does stays off in every mode.
Some actions are refused outright, whatever you or the AI say.
It never types passwords, card numbers or keys, never reads saved passwords, browser profiles or its own settings, never acts on banking, payment or password-manager windows, and never runs commands that wipe disks, your user folder or the system's security.
Web pages, files, the screen and the clipboard can hold text written to trick an AI.
Once a chat has read any of these, JARVIS asks before changing anything or sending anything out, for the rest of that chat, whatever your settings. A new chat starts clean.
Stop and Esc end what JARVIS is doing or saying at once.
Ctrl+Alt+Backspace on Windows, or Control+Option+Delete on a Mac, stops anything it is doing on the computer from any app. On Windows, saying "JARVIS, stop" is caught even while it is talking.
Optional and off by default: an AI moves the mouse and types to carry out one task you give it.
By default each step is shown and waits for your OK. It refuses tasks and windows that involve sign-ins, payments, banking or trading, never types anything that looks like a password, and stops after 30 steps or 10 minutes. A picture of the screen is sent to Google's Gemini model for each step, and the panel says so.
Needs: a Gemini key. On a Mac, also the Accessibility and Screen Recording permissions.
Optional: JARVIS can look things up in, and act on, the email and calendar accounts you connect through Composio.
For each request a small helper AI is started that reaches only your connected accounts. A helper that looks things up can only read; anything that sends, creates, changes or deletes waits for your yes first. Email can also be sent directly with an app password, after your yes, or opened as a draft in your mail app.
Needs: your own Composio project key, or an email app password.
Describe what to build and choose Build. The coding agents run on your own subscriptions.
A coding agent works in a separate git branch in its own folder, never in your real checkout.
The project's checks run on the result. It is merged into your project on this computer only if the checks pass, the base branch is unchanged and no protected file was touched. Nothing is pushed or deployed. Keys and tokens are removed from the job's environment, and the agents run in their normal permission mode, never with bypass flags.
Needs: the Claude Code and/or Codex command-line tools, signed in with your own subscriptions; Git.
Small, normal and complex tasks go to different models, chosen between Claude Code and Codex.
The allowance left on each subscription is read and shown, with its reset time. An agent that hits a usage limit is set aside and the job moves to the next one, keeping the edits made so far.
If the project's checks fail, the job makes a limited number of attempts to repair them.
If no attempt passes, the branch is kept for you rather than merged. Jobs interrupted by a restart are recovered, and jobs on the same project run one after another.
The chat you ask in becomes the project's Master chat. It holds one checklist of everything it set going; each line opens to show that work's progress. Each piece of work has a chat of its own, named after what it does, under the Master in the sidebar.
Several requests run at once (four jobs at a time; jobs on the same project take turns so their changes cannot collide).
As in T3 Code, JARVIS uses your Claude and ChatGPT subscriptions through Claude Code and Codex: Settings, AI models & accounts shows whether each is signed in, with Sign in and Sign out. Each signs in on its own page; no token passes through JARVIS. API keys for other services are still there.
Give it a prompt and it does the rest: when the project's checks pass, the change goes into your project by itself, and the chat shows one line that opens to the diff. There is no time limit on a job.
A change can be undone with a checked revert commit, and your own work is never discarded. In Manual mode a change waits on a card in the chat: Keep it or throw it away.
Ultracode gives work that has to be right the strongest model, thinking as hard as it can, and a second AI looks at the result.
It uses much more of your allowance, and says so. Dry run shows what JARVIS would do with what you typed (which AI, which steps, what counts as done) without starting anything.
When a coding job needs an answer from you, it shows the question with a way to reply.
Your yes is tied to exactly the question on the screen and is used once; if the job is asking something else by then, the yes is refused. The same job then carries on. A yes in words never lifts the job's safety rules.
One model plans and never changes a file; another builds, a few steps at a time.
The planner can only read, list and search files. The builder is an ordinary coding job, with its own copy and the project's checks. What it did goes back to the planner, which revises the plan and hands over the next part. After a fixed number of hand-overs the pair stops and waits for you, so two models cannot go round in circles on your allowance.
One panel shows every agent at work: coding jobs, planners and builders, the assistant answering in a chat, a trial in the Court, a skill pack being scanned.
It shows what each is doing this moment and since when, what is waiting for you, what is scheduled (timers, reminders, routines) and what has just finished. It only reads; nothing there starts or stops anything.
Find the usual holes in one of your projects, and have them fixed in a copy.
JARVIS reads a project's files, says what kind of project it is and which scanners ran, and lists what it found with the line in question.
It only reads: nothing from the project is imported, run or installed, symbolic links are not followed, and it has hard limits on files, size and time. Any secret it finds is shown hidden. Nothing is sent anywhere; Bandit is used for Python projects only if it is installed outside the project.
Tick the findings you want fixed, and one ordinary coding job fixes them in its own copy of the project.
The copy can be scanned again to see that the findings are gone. Applying the fix goes through the usual review and checks, and always waits for you to look, even in a project that otherwise merges by itself. It can be undone later.
Something you want done again and again, at the times you choose.
For example "every morning at 8, tell me what is on my calendar" or "every 2 hours, run my project's tests and fix what fails".
A routine is a request, the project it is about (if any), whether it is answered in a chat or run as a coding job, which agent does it, and when. Each run is a message in the routine's own chat, so its whole history is in one place.
Each run is sent through the same path as a message you type, so every approval, review and limit applies to it.
A run that needs your yes waits for it. A time slot is fired at most once; after the app was off, only the latest missed run is started, never a burst; runs never pile up; and after 5 failed runs in a row the routine pauses itself and says so.
Pages, slides, sheets, charts and whiteboards, with their history.
A reply that makes something whole (a web page, a picture, a diagram, a small app, a document, slides, a sheet, a chart) shows it beside the chat.
Everything made in every chat is also kept in one library, and you can start a document, slides, a sheet, a chart, a design or a whiteboard there directly and edit it yourself.
A version is never rewritten or dropped by a later one.
Going back to an earlier version adds it again as the newest, so nothing is lost. Artifacts are kept in the app's own folder on your computer, one file each, and anything that looks like a key is hidden before it is written.
Slides, sheets (with formulas), charts and whiteboards are drawn by the app itself from plain text.
Nothing in an artifact is ever run as code or treated as an instruction. Pages run in a sealed frame that cannot reach the app or its data, and a sheet saved as CSV keeps only the plain sums the app itself understands: any other cell a spreadsheet program would run is saved as text. What private or deleted chats made is not listed.
One idea, put on trial, in the Courtroom panel.
You submit one idea per session. It goes before the Grand Jury (can it be tried at all?), the Prosecution (the strongest honest case against it), three Analysts (does it hold up in the real world, with sources from the web), the Tribunal (a ruling on fixed criteria) and the Executioner, who only pronounces.
An adverse decision at any stage sends the idea straight to the Executioner.
Needs: the Claude Code command-line tool.
The AI writes the arguments; each stage's decision and the verdict are worked out by the app from what the stages said.
A stage that has decided is never asked again, so there are no second tries for a kinder answer. Once submitted, the idea cannot be changed. What the Analysts read on the web is evidence, never instructions, and if they could not search, the record says so. A trial that was cut off can be resumed.
An Obsidian vault is JARVIS's second brain: plain Markdown notes you can read and edit.
Chats, project memory and the results of coding jobs are saved as Markdown notes in your vault.
"Remember that…" is kept in a note you can edit. Each project has its own memory note for its requirements and decisions.
A model gets recent history and the project's memory, not your whole archive.
Links to other notes in a message attach those notes, if they are not private. Notes are searched with a full-text index on your computer, with no cloud or model call.
Notes in a Private folder, and notes marked private in their header, are never given to a model.
A chat can also be kept out of context. What is not listed cannot be fetched by its id either.
Claude and ChatGPT exports (JSON or ZIP) can be imported and kept as reference.
An optional browser extension, which you load and pair yourself, can capture conversations you open on those two websites and send them only to JARVIS on your computer. It does not read cookies or passwords.
Playbooks for the coding agents, and your own changes to how JARVIS behaves.
A pack of skills (a folder, a .zip or a git address) is fetched once and scanned with SkillSpector before anything else happens.
Nothing in a pack is ever run: it is text for the coding agents to read. An item is only usable once a finished scan has covered it; an item with findings stays off unless you switch it on by name after seeing what was found.
Needs: SkillSpector installed; without it, no skill is added.
When a coding job starts, the few switched-on items that fit the task are put beside it as files and named in two lines each.
An agent that does not need them never reads them, so a large library adds little to each job.
Your own commands (a short /name for a longer request), hooks, panels and a status line.
A hook can show a note or say something when JARVIS opens, an answer or coding job finishes, or a reminder is due. A panel is a page of your own, pinned beside the chat and sealed off like every page JARVIS makes.
JARVIS has no server and no account of its own. What leaves your computer goes to the services you set up, for the work you asked for.
JARVIS looks for a newer version once a day, fetches it in the background, and installs it the next time it starts, or now from Settings, Updates.
An update is installed only when its signature from JARVIS's maker checks out: a key that never leaves the maker's computer, so even someone who took over the download site could not slip one in. Your chats, notes, settings and keys are kept, and if the new version does not start, JARVIS goes back to the one you had. You can choose to be asked first, or to never look.
The app is a small service listening at 127.0.0.1, on your computer only, shown in its own window.
It refuses requests addressed to any other host name, needs a fresh random token on every request, and keeps its port to itself so no other program can listen beside it. On Windows, the window page that carries the token is only given to programs of your own account.
API keys live only in environment variables or the system's credential store (Credential Manager on Windows).
They are never written to the vault, logs, receipts or chats, and are masked if they appear in any text. Coding jobs run with every key and token removed from their environment.
Notes in a Private folder or marked private are never released for AI use.
Secrets are removed from text before it is written to the vault or logs, or sent to a model.
A yes covers one action, with exactly the details you were shown, once.
Actions the app carries out for the assistant (email, timers, memory, coding jobs) run from a one-time permit holding exactly what was approved. A yes to a coding job's question answers that question and no other.
Messages go to Anthropic through your Claude subscription, or to OpenAI when Codex does a coding job.
Speech goes to Groq or OpenAI to be transcribed, and replies to ElevenLabs to be spoken, when you use those. Other services are reached only for the request that needs them: a web search, the weather, a picture (the free Pollinations service receives its description). The app has no server of its own to send anything to.
JARVIS