--- title: "What's New in ToolPiper Beta 10" description: "Beta 10 turns ToolPiper's chat into one workspace with projects and workbenches, adds four security levels, and runs on macOS 26 and 27." date: 2026-10-15 author: "Ben Racicot" tags: ["Release", "macOS", "Local AI", "MCP", "Security", "Automation"] type: "article" canonical: "https://modelpiper.com/blog/whats-new-beta-10" --- # What's New in ToolPiper Beta 10 > Beta 10 turns ToolPiper's chat into one workspace with projects and workbenches, adds four security levels, and runs on macOS 26 and 27. ## TL;DR Beta 10 reworks the MCP tool architecture for more performant building and tool calling from any app, and reorganizes the tool tiers. ToolPiper was rebuilt so MCP as the system, the new security levels and the agentic credential system are first-class and work together. It's the last version that runs on macOS 26 (and 27). Beta 11 will require macOS 27. In ModelPiper, one chat now holds new projects and a workbench pane, where Studio tier image and video work sits beside code, tests and outreach. The catalog is 463 tools, 206 of the 463 free. The credential upgrade means you re-enter saved API keys once. ## Beta 10 is a beta ToolPiper 0.0.10 is a beta. Not a release candidate, and not version 1. That word means something specific here. Everything below was built and tested on our own Macs, and most of it has never met yours. Features arrive at their first version and improve from one beta to the next. Tool names, plan tiers and defaults can still change between betas, and when they do, the release notes say so. A known gap gets listed, not hidden. Version 1 is the release where names, tiers and defaults stop moving. This isn't it. Beta 10 runs on macOS 26 and macOS 27, on any Apple Silicon Mac (M1 or later) with at least 16 GB of memory. We recommend 32 GB for the larger local models. Intel Macs aren't supported. Beta 11 will require macOS 27 and won't run on macOS 26. The work that opens beta 11 runs on Apple's Core AI, which exists only on macOS 27, starting with a new on-device embedding model that decides which tools a model sees each turn. We'd rather build that once, on the platform it needs, than maintain two versions of the same feature. If you're still on macOS 26 when beta 11 ships, beta 10 keeps running. Instead of offering an update that won't open, ToolPiper tells you the new version needs macOS 27, with a button that opens the macOS update screen. Updating from beta 9 happens inside the app this time. No manual download. Updates roll out to every install over about 36 hours, and Check for Updates… skips the wait. If you're still on beta 8, its updater can't install anything, so download beta 10 from modelpiper.com/download. One thing to know before you update: you'll re-enter your saved API keys once. The details are near the end. ## One chat, with projects and workbenches Beta 9 had six places to talk to a model. Chat, Studio, Code, Testing, Outreach and API Discovery were separate pages, each with its own conversation list and its own idea of where your work lived. Studio's conversation didn't even survive a reload. Beta 10 has one chat. Projects hold the chats. A project carries its own instructions, a default model and the folders its chats can read, so a client engagement and a side project don't share one long sidebar. Project materials turn files and folders into the project's knowledge, and every chat in the project pulls up to five relevant passages, 8,000 characters at most, into each turn. Materials are on the Pro plan. The work opens in a pane beside the conversation, as tabs. Image, video, code, tests, outreach and API discovery are all workbench kinds, and one chat can hold several. Every media card in the chat has an Add to workbench chip, so a generated product shot goes straight into the image tab and you keep talking about it while you edit. The agent arranges that pane on its own judgment. It opens the tab it needs and puts the result where you'll see it, without an approval card for any of it, because arranging the pane changes nothing outside the pane. If you'd rather drive it yourself, turn off Let the agent arrange my pane in Settings. Spoken turns land in the same chat, marked Spoken, and act on the same workbench. Start a thought by voice and finish it typing. Outside agents get the same structure. Claude Code or Cursor can create a project, file a chat into it and open a workbench, and the conversation and project tools that do it are free. ## Agent turns that don't fall over This was the release blocker, and it's the change you're least likely to notice, which is how it should be. An agent turn's tool list used to count as valid only while nothing anywhere in the app changed. Your own Allow for session counted. So did another chat ending, a license refresh, an MCP server restarting, or a model finishing its first download. Any of those ended the turn, in chat, voice and automations alike, even when the change had nothing to do with the tools in use. Beta 10 separates them. A change in one part of the app no longer ends a turn running in another, and answering an Ask mid-turn lets the turn carry on with your answer. Which tools a model sees each turn got sharper too. A tool now brings along the tool that lists the ids it needs, so a model handed a tool that edits a layer also gets the way to find one. When a model asks for a different set of tools, it keeps the ones it has already used. The workbench on screen ranks its own tools higher. On our tool-calling exam, the right tool lands in the 25 a model sees for 435 out of 451 targets, and ranks first for 360. Tools from MCP servers our selector has never seen land in the set 101 out of 102 times. With Claude Sonnet 5.5, sending the selected set instead of every tool cut the tool definitions from 105,026 bytes to 26,844 and scored higher on the exam, 0.260 against 0.180. ## Four security levels Every tool call that reaches ToolPiper, whether it comes from Claude Code, Cursor, ModelPiper, ToolPiper's own chat or your voice, now runs under one of four levels. Pick one in Settings and it applies to all of them. | What the tool does | Disabled | Default | Balanced | Strict | | --- | --- | --- | --- | --- | | Only reads | Runs | Runs | Runs | Runs | | Changes something or reaches the network | Runs | Asks, one click | Asks, one click | Password or Touch ID | | Runs commands or destroys something | Runs | Asks, one click | Password or Touch ID | Password or Touch ID | New installs start at Default. Disabled means ToolPiper adds no checks of its own. It doesn't switch off the audit record, and a Deny or Ask you saved still applies. Pausing is the temporary way down, for an hour, a day or a week, and it turns itself back on. A refusal never offers to lower the level for you. The Security overview shows the whole picture on one screen. Three sections follow the level: MCP tools, firewall rules and credentials, each with Open and Reset…, and Reset shows the exact list it would change before it writes anything. Three sections don't follow the level, and those are tokens, connected apps and activity. Picking a level leaves every choice you saved alone unless you tick that section's Reset list, and none starts ticked. A count ToolPiper couldn't read says so instead of showing zero. Three changes underneath you won't see directly. Each tool call now runs as the app that actually made it, not as ToolPiper's own server. The firewall reads a tool's arguments and weighs risk that builds up across a session, and the audit record says why it decided what it did. MCP clients now receive read-only and destructive hints with every tool, so a client that draws its own prompt can tell a lookup from a delete. ## The same Ask, from every app What an Ask offered used to depend on who was asking. Now there are five answers, and every caller gets the same ones. Allow once, Allow for session, Always allow, Deny and Always deny. Tools that run commands or change files get three of them, Allow once, Deny and Always deny, because a session-long yes to a shell is too much to hand out by accident. Claude Code draws that prompt in its own interface. Cursor, Codex, Claude Desktop and every other client get ToolPiper's card on the Mac instead, right away. If nobody answers, the agent is told the question is waiting in ToolPiper on this Mac, so it isn't left guessing. An outside app's Always allow lasts for its session. To keep it, ToolPiper shows an Accept or Decline card on the Mac, and the rule is saved only if you accept. Only the person at the Mac makes a looser rule permanent. Tools change, and your choices follow them carefully. A tool whose reach changes has its Allow read as Ask, labeled Updated since you allowed it. A renamed tool carries your rules over only when the new one is no riskier, and a Deny always carries. New tools arrive with no review queue and ask the first time they're used. Clicking Allow also allows now. Claude Code's prompt carried a consent checkbox that defaulted to off, so an Accept with the box untouched arrived as a refusal. An untouched Accept now means Allow once. Only Deny, Decline, Cancel or a timeout refuses. Two controls sit above all of it. Stop all agents ends every running agent turn at once, and a master switch turns agent and MCP access off entirely until you turn it back on. ## Credentials that ask instead of refusing A credential that required approval used to refuse whenever it couldn't get one. Now it asks. Set a credential to Every time, and when something wants to use it, ToolPiper shows who's asking, what they want to do and where the key is going. One Touch ID or password and it goes. A chat reply that makes many requests asks once and covers up to 50 of them. That works in chat and voice, the Home ask box, cloud image and video, knowledge-base embeddings, model downloads from Hugging Face, web search, and the Search Console and Reddit tools. Unattended work, like an automation firing at 3 a.m., is refused with a reason, because there's nobody there to ask. Each credential's Use policy is two questions now. Who can use this? lists five callers: you in ToolPiper, ToolPiper on its own, ModelPiper and other local tools, connected apps, and apps without a token. Ask me first? is Never or Every time. A stricter answer saves at once. A looser one asks you to authenticate first. Agents can use a stored credential without ever seeing it. An `http_request` that needs your API key gets the key added on the way out, and the model sees only the response. Credentials live in the macOS Data Protection Keychain, bound to this Mac and never synced. You manage them on ToolPiper's Credentials page. ModelPiper refers to them and never holds a copy. ## The image workbench Image editing moved into the chat as a tab, and picked up most of what a real editor needs on the way. Beta 9 had layers, masks and adjustment layers on a Studio page. Beta 10 adds transform handles with snapping, Shift-click to move a group, canvas size with nine anchors, image size and crop. Selections come as rectangles, ellipses, lassos and polygons, and you refine or erase them with brush strokes. Text and fill layers stay editable after you make them. Select a region and one click runs Remove, Replace, Recolour, Adjust or Extend. A history panel walks every layer back to where it came from, and you can drag any media card from the chat straight onto the canvas. Export goes to PNG, JPEG, TIFF or a layered PSD. Live adjustments are fast enough to scrub. On an M2 Max, an adjustment layer goes from input to displayed frame in 3.5 ms at the median and 4.4 ms at the 95th percentile. A generated result places itself as a new layer, with undo, and it's still there after a restart. The agent edits the same document through sixteen image workbench tools, which replace beta 9's media project tools. ## Models, grouped by who made them The Models pane has two tabs now, Models and Search. Models is one list you can filter, grouped by the company that made each model, with its logo and a chip showing whether its credential is set. Create or edit a provider right from the model's row. Eleven cloud providers are new. Baseten, Cohere, DashScope, Hugging Face Inference, Hyperbolic, Moonshot, Nebius, Novita, SambaNova, Voyage and Z.ai. Cloudflare adds image generation with Qwen Image 3.0 Pro and video with FLUX 3. When a configured provider can animate an image, `image_to_video` uses it instead of refusing, from typed chat or by voice. On the local side, the embedded llama.cpp server moves to build b11669, about 400 upstream commits past what beta 9 shipped. Recommended models now download a pinned revision, so the model we tested is the model you get. The Gemma 4 presets switched to Google's own official quantized builds, because when a model's author publishes a GGUF, that's the one we use. Two free tools, `provider_list` and `provider_set`, let an agent see and change which provider each feature uses. ## What each chat turn cost Every typed chat turn in ModelPiper now shows what it used and what it cost, on by default. A turn that made several requests shows their sum. Hover and it splits into input, cached input, cache writes, output and reasoning. An estimate is marked ≈. A local model reads Free (on-device). A model with no published price says so by name instead of showing zero, and failed requests are counted, not hidden. Prices come from a reviewed table that ships with the app. ToolPiper never fetches them. ToolPiper keeps its own record of every request's usage as the provider reported it, so the number is still right after a reload. Turn it off with Show token usage and cost in Settings. Voice turns, ToolPiper's own chat window, Autopilot and the Home ask box don't show cost yet. ## Browser tools that read the page and share the browser Four new browser tools read a page the way a developer would. `browser_element_get` reads one element. `browser_style_get` explains why it looks the way it does. `browser_source_list` and `browser_source_get` list and read the page's stylesheets and scripts, source maps included. All four are on the Pro plan. Several agents and chats can now drive Chrome at the same time, each in its own tabs, without stepping on each other. Screen capture became region first. Set a region by hand or by asking, and every capture becomes an Asset you can find again. A recording shows an indicator while it runs, and you can stop it from there. ## Voice that stays out of your typing The voice keys no longer break ordinary typing, shortcuts or ⌘C. Your keyboard works as if ToolPiper weren't there until you actually talk. Voice calls go through the same tool pipeline as typed chat. The firewall, the Ask and the audit record all apply to a spoken request exactly as they do to a typed one. Replies stall less. In a paired test on an M1 Max with Gemma 4 12B, replies that paused for more than five seconds went from 6, 11 and 14 out of 20 on three tasks to none at all, and the 90th-percentile reply came back about 8.6 seconds sooner. ## A Home pane that gets you started Open ToolPiper and Home shows a Get started card, one step at a time. Bring your models, choose a language model sized to this Mac's memory, grant permissions through a guided flow, set up voice, try dictation, ask ToolPiper something, sign in. No modal, no forced download, and a dismiss button once you're done with it. ## What's free, and what moved Beta 10 has 463 tools, and 206 of the 463 are free. Everything a model runner does is still free. Running local models on every inference backend, chat, downloading and switching models, speech in the app and the MCP server itself cost nothing and need no account. So do web search, PDF and text tools, the system readers and most Mac system control, Search Console, the Claude Code installer, connecting to the browser and reading a page snapshot, and every new tool for chats, projects, workbenches, providers and documents. Cloud AI models need Pro in chat, voice and the API, as the pricing page has always said. Some paths in beta 9 skipped that check, so Free accounts could use cloud models in the app, and beta 10 closes them. A model server on this Mac, such as LM Studio or Ollama, counts as local and stays free. One on another machine counts as cloud. The line between free and paid moved in beta 10, and it follows one rule. The free tool makes the plan, and the paid tool makes the artifact. Pro, at $10 a month, covers the agent acting for you. Browser automation, the agent driving your Mac's apps, windows and keyboard, running commands, files, git, code search, the clipboard, screenshots and OCR, HTTP requests, Autopilot, project materials, and the GitHub, Hacker News and Reddit tools. The Studio plan, at $29 a month, covers making media. Image editing and generation, upscaling, video editing, text and image to video, 3D splats and scenes, and storyboards. Max, at $49 a month, adds automations, which run a chat instruction or a tool once, on an interval or on a cron schedule. Prices didn't change. Where some tools sit did, and some of what beta 9 gave away now asks for a plan. If you built a workflow on one of those, it tells you which plan it needs the first time you call it. In MCP hosts that support it, that arrives as a native Unlock with Pro prompt, and accepting opens the upgrade page. Upgrading got fixed too. The app reflects a new plan the moment the purchase completes, where before some buyers tapped Upgrade a second time because nothing seemed to change. Promo codes now work on plan changes, not only on a first checkout. ## Before you update ### You'll re-enter your credentials once Beta 10 stores credentials in a new format and doesn't convert beta 9's. On first launch, ToolPiper sets the old store aside, without deleting it, and starts fresh. Re-enter your API keys and reconnect any OAuth accounts, like Google Search Console. Knowledge-base collections stored only as JSON need to be created again. \[OWNER: the credential model also says "devices re-enrolled". Which devices, and does a normal user need to do anything?\] ### If you'd already set up security - **If you never chose a level,** a tool that destroys something now asks once when you run it from your own controls. When an automation an app armed calls it, it's refused until you choose Allow for that tool. Automations you armed yourself still run it once re-armed. An automation armed before beta 10 is disarmed once, at its next call that needs an Ask, and arming it again restores it. - **If you chose Standard or Guarded,** you'll see Default. Its built-in rules are no longer recorded there, and Guarded no longer stops command-running tools for your own controls or app-armed automations. - **No level refuses an outside app** for not declaring which tools it wants or why. An app that does declare a tool list is held to it at every level. - **ToolPiper chat and voice follow the level.** At Disabled they ask nothing of their own. At Balanced, a tool that runs commands or destroys something needs your password or Touch ID where it used to take a click or a spoken yes. - **At Balanced, your own controls** need the password or Touch ID for a tool that destroys something, runs commands or changes files, and an automation's call to one is refused until you choose Allow for it. - **During a timed pause,** a tool nobody made a choice for runs without asking from an outside agent, ToolPiper chat or voice, the way it already did from your own controls. A saved Ask or Deny and a firewall Ask rule still apply. ### Other things that moved - The ModelPiper web app moved to `http://127.0.0.1:9998/modelpiper/`. The old `/app/` address doesn't redirect, so update your bookmark. - modelpiper.com no longer talks to the ToolPiper on your Mac. modelpiper.com/chat is a page about chat now, and the site's Ask and Fit hand off to the app through `toolpiper://` links. - The visual pipeline builder is gone. Its pages redirect. - On team deployments, audit history and daily counts from beta 9 don't carry over. Recording starts fresh. ### For MCP clients and developers - The `media_project_*` tools became the workbench family. The layer tools are now `workbench_image_*`, and the `workbench_*` tools replace the project container tools. - The `schedule_*` tools are now `automation_*`. - The `outreach_project_*` tools from build 63 are retired. Outreach lives in projects now. - `GET` and `PUT /v1/tool-permissions` are retired. Use `/v1/tool-capabilities`, with its preview and commands. - `/v1/action-piper/*` and the pipeline routes are retired. - The voice WebSocket requires the `chat` scope, a chat-only voice client is offered no tools, and `stop` cancels only that connection's turn. ## What isn't done yet Benchmarking isn't public yet. Beta 9 said beta 10 would bring real measured numbers for real models on real Apple Silicon. The harness, the engine adapters and the ledger it writes are built. The baseline runs that make the numbers worth publishing haven't happened, and we don't publish numbers we haven't measured. Local image-to-video isn't registered yet. The Wan2.2 TI2V-5B engine is written and waits on its real-weight qualification. Through a cloud provider, it works today. Cost shows in typed chat only. Voice, ToolPiper's chat window, Autopilot and the Home ask box come later. The image workbench's region actions are at their first version and haven't had their full pass on a real generative model. Storyboards don't assemble into a finished video yet, and moving splats stay parked until they clear our quality bar. PiperMesh, for sharing compute between ToolPiper installs, is built and still closed. It opens in a later beta. Tell us what breaks. Which tool asked when it shouldn't have, which credential refused, which turn ended early. Update from inside ToolPiper, or download beta 10 at modelpiper.com/download. ## FAQ ### Does beta 10 run on macOS 26? Yes. Beta 10 runs on macOS 26 and macOS 27 on Apple Silicon. Beta 11 will require macOS 27, and on macOS 26 beta 10 keeps running and tells you the new version needs macOS 27. ### Do I have to download beta 10 by hand? Not from beta 9. It updates inside the app, rolling out over about 36 hours, and Check for Updates… skips the wait. Beta 8's updater can't install anything, so beta 8 users download it from modelpiper.com/download. ### Why do I have to re-enter my API keys? Beta 10 stores credentials in a new format and doesn't convert beta 9's. ToolPiper sets the old store aside without deleting it, and you re-enter your keys and reconnect OAuth accounts once. ### What's still free? Everything a model runner does: running local models, chat, model downloads, speech in the app and the MCP server. Cloud AI models in chat, voice and the API need Pro, as the pricing page has always said. 206 of the 463 tools are free, including web search, PDF and text tools, most Mac system control, and every tool for chats, projects and workbenches. ### Where did the Studio, Code and Testing pages go? Into one chat. Projects hold chats, and image, video, code, tests, outreach and API discovery open as workbench tabs in a pane beside the conversation. ### What's the difference between Default and Balanced? Both ask with a click before a tool changes something. Balanced also needs your password or Touch ID for a tool that runs commands or destroys something, where Default takes a click.