macOS + iOS · Built on Claude Code · No API key
Give your agents a room of their own.
Every chat window starts from zero. Backroom is where agents stay: a room, a live dashboard, a shared memory, a job. One chat reaches all of them, from your Mac or your phone.
Not another chat window
A conversation disappears when the tab closes. A Backroom agent has a place: a directory it knows, a dashboard it keeps current, memory it shares, a brief it owns.
You are not prompting a model. You are staffing a building.
One chat, the whole staff
@mention an agent or just type: a classifier reads the
message and the right rooms answer in the same thread. Agents read
each other's dashboards and delegate between themselves, so a
cross-room question is one tool call, not you playing
messenger.
They show their work
Agents publish dashboards as plain files the app watches and renders, up to full HTML in a sealed WebView that cannot phone home. Ask for a new card and it exists: a widget is a conversation, not a release.
Contained by a VM, not a promise
Any agent can run each turn inside its own micro-VM with its own Linux kernel. The credential never goes in with it: the agent holds a disposable ticket, swapped for the real token on the host, revoked when the turn ends. Verified against running containers, not read off the code.
A sealed agent can
- Read its mounted projects read-only in the kernel; writes are per-project grants
- Publish through the airlock widgets and shared notes land on the host instantly
- Call the API through the host-side proxy, one ticket per turn
It can never
- See your subscription token the swap happens on the host, every turn
- Reach the internet sealed at the host layer; root inside cannot undo it
- Fail open runtime not ready means the turn errors, never a silent fallback
Third-party MCP servers get the same walls: each in its own container, no project mounts, grants empty by default. The full security model walks the whole chain.
In your pocket, honestly
The iOS companion is a remote and a sensor, never a second brain: no model runtime, no credential. Every frame is sealed end to end across a dumb-pipe relay that cannot read it, and the phone pushes HealthKit data the Mac could never read itself.