Locara is a framework, runtime, and distribution layer for fully-local & secure LLM applications. Models, database, and tools run on the device. Capabilities are kernel-enforced. Telemetry is zero by construction.
"name": "transcribe", "modalities": [ "speech-to-text", "text-to-text" ], "capabilities": { "device.microphone": true, "models": [ "whisper-base.en@sha256:…", "qwen2.5-1.5b@sha256:…" ] }
Built for developers who treat privacy and security as architecture, not policy.
Capabilities, models, and modalities live in a single
locara.json. The runtime kernel-enforces every
declaration: an app can't open the microphone unless it asked
for it, can't load a model that wasn't pinned, can't reach the
network unless the manifest says so.
"capabilities": { "net": false, "fs": { "user-selected": true, "app-data": "read-write" }, "device": { "microphone": true }, "models": [ "whisper-base.en@sha256:…" ] }
The SDK gives apps typed access to the local model registry, a vector store, transcription, and voice-to-voice — all mediated by the manifest's capability grants. The same surface works for hand-written and agent-generated apps.
SDK reference →// streams tokens, respects capability check const reply = await llm.chatStream({ messages, model: 'qwen2.5-1.5b-instruct-q4_k_m', }) for await (const tok of reply) { ui.append(tok) }
Models live in a content-addressed cache. The database is a per-app SQLite file with a vector extension. Tools run inside a Wasmtime sandbox. There is no online — so there is no data leak.
Read the manifesto →
Every capability is declared in the manifest. Every model
is pinned by SHA-256. Every tool runs in a Wasmtime
sandbox. Every .locapp is signed by Locara CI
with a provenance attestation. The threat model is
published, the spec is open, and the runtime refuses
anything that isn't on the list.
Closed-catalog modalities. Strongly-typed SDK. Copy-in components. Manifests are the agent's primary surface — declare what you want, and the framework expands the rest.
Docs for agents →"Build a Locara app that transcribes meetings, finds the 5 most-discussed topics, and shows them as a tag cloud."
A Locara app is composed from six independent primitives —
models, inference, a local database, the toolkit, the
interface, and the OS bridges. Each ships with batteries
included. The manifest above declares which to
wire in; the capability kernel enforces it at runtime; the
signed .locapp is what they package into when
you ship.
Picking primitives is the work — Locara handles the wiring. Below: three reference apps, side by side, with the exact primitive choices each one makes.
Local-only audio transcription with semantic search across recordings.
Local OCR + semantic search across your documents and images.
Live, full-duplex voice agent. Speak; the model speaks back.
Same primitives. Different recipe. The shipped .locapp
is just the assembled output — what changes between apps is the
composition above the contract.
Every input/output transformation a foundation model can perform — mapped to representative open-weight models, the infrastructure Locara needs around them, and what's shipped vs. missing.
Local-only audio transcription with semantic search across your recordings.
Local OCR + semantic search across your documents and images. Drop a folder. Ask a question.
Scaffold a new app in under a minute. The CLI walks you through manifest, capabilities, and a working chat loop.
locara init transcribe my-app
— gives you a working manifest, an empty SDK consumer,
and a Tauri shell. Editable with any editor.
Browse the catalogue. Pick a modality (e.g.
speech-to-text). The CLI fetches the
content-addressed model and pins it in the manifest.
Call llm.chat, transcribe.fromMic,
embed.embed. Every call is capability-checked
against your manifest at runtime.
locara build produces a signed
.locapp. Sideload, distribute, or publish to
the registry when it opens.
Locara exists because privacy needs to be architectural, not legal. We're building the framework, the runtime, and the catalogue so that a local-first app is the default path, not the heroic one.
Read the manifesto →