Disclosure: I'm on the team that builds this.

AnyModelBot is a local-first, open-source (MIT) app for Windows, macOS and Linux (Docker image too). A "bot" is a persona with its own default model, its own workspace folder and its own memory. It can read and write files, run commands and operate the desktop, so most of the design work went into deciding what it may do without asking:

• Three permission tiers per bot: read-only; workspace (default — writes only inside its own folder, anything outside pauses for approval); full access (unsandboxed, but recursive deletes still ask).
• Approval cards: when an action steps outside what the bot may do on its own, the task waits for your OK. Computer use can be set to ask before every UI change.
• Conversations, memory, files and keys stay on your device.

Honest limits: it's young (v0.1.x). Models are pay-per-use through a hosted model service, so prompts, file contents and tool results needed for an answer leave your machine to the model vendor you pick; the README is explicit that local-first isn't an absolute security claim. Which features work depends on the model, OS and permissions you grant, and macOS computer use is still Beta.

• Site: https://anymodel.bot/en/
• Source & downloads: https://github.com/modelflare-ai/AnyModelBot

Feedback on the permission model especially welcome — what would you want a desktop agent to always ask about?