Clockwork Download for Mac

Put your agents on a schedule.

Book Claude Code, Codex, OpenCode or Hermes like a meeting. Clockwork runs it sandboxed and files a readable report.

Download for Mac How it works

agent shift, doneagent shift, bookedyour calendar, over ICSwaiting for youExample week. Costs are illustrative.

One day, with the agents on the calendar.

07:00Monday

You book it like a meeting.

Pick a profile, a repository, a budget in dollars and a time. One-off, recurring, or fired by a webhook. Chain a second agent to run after the first.

The Clockwork composer: task name, prompt, repository, engine, budget and schedule
02:00Tuesday

It works the night shift, inside a sandbox.

Your own CLI login does the work, in its own git worktree, under a macOS Seatbelt profile. Your checkout is never touched.

  • A fresh worktree and branch cut from your base branch
  • Writes denied outside that worktree
  • SSH keys, cloud credentials, GnuPG and shell history unreadable
  • A dollar cap, a turn cap and a wall-clock timeout
  • Risky actions pause the run and ask you
  • No answer in about two minutes means no
08:30Tuesday

You read a report, not a scrollback.

Every run files the same document into your inbox. Credentials are masked, best effort, before it is stored. Every report and transcript is full-text searchable.

Summary
What it did, what it skipped, and why.
Branch
The branch it worked on and the diffstat, so review starts from a diff.
Cost
Dollars spent, turns used, wall-clock time, against the caps you set.
Approvals
Every ask, every answer, and what auto-denied.
Transcript
The full session, searchable.
Weeklyand on

It comes back next week without being asked.

Recurrence is real calendar recurrence: RRULE or cron in your own time zone, daylight-saving handled, a policy for missed runs, and one run per repository at a time.

every Monday 07:00Tue and Thu 01:30weekdays 08:30first of the month 03:000 22 * * 5if missed: run late within 6hif missed: skipif missed: ask meoverlap: skip or queue

Thirteen specialists ship with it.

Each one is an operating contract: a mission, hard limits, and a fixed shape for the report. These are the names you will see in the app.

Engineering
GeneralistThe balanced default for any repository chore.
Dep SurgeonPatch and minor bumps proven by tests. Majors get notes, not upgrades.
Test DoctorSorts flaky from broken and never weakens an assertion.
Bug HunterRoot cause with file and line before any fix.
Code ReviewerRead-only, severity-rated findings with evidence.
Refactor EngineerBehaviour-preserving steps, tests green after each.
Performance EngineerBaseline, one change, measure again.
Security AuditorReport-only defensive scan, secrets masked.
Release EngineerVersion, changelog and build readiness checks.
Operations and docs
CI InvestigatorInfra flake or real regression, decided from the logs.
Repo Health MonitorA morning digest: stale branches, drift, advisories.
Docs ScribeFixes documentation drift from evidence in the code.
Changelog WriterEntries derived from the diffs, never invented.

Write your own in the app: pick skills, a permission mode, budget defaults and a system prompt.

This is the app, at version 0.4.0.

Clockwork month view with recurring agent jobs booked across September
The agent library with all thirteen built-in profiles
The tasks list with schedules, budgets and run-now controls

The month view. Every booking on one grid, colour-coded by profile.

The agent library, and every task with its next run and budget.

What a run can touch, and what it cannot.

Inside a run

  • yesIts own worktree and branch, cut from your base branch
  • yesThe CLI you already log into, with your subscription
  • yesA dollar cap, a turn cap and a timeout, enforced by the supervisor
  • yesApprovals that pause the run and wait for you
  • yesA safety journal that records every deny-list hit

Never reachable

  • noYour checkout, or your main branch
  • noFiles under .ssh, .aws, .gnupg, or your shell history
  • noWrites anywhere outside the run's worktree
  • noA silent approval. Unanswered asks fail closed.
  • noA server of ours. There is none: no account, no cloud, no telemetry.

The sandbox profile, the credential deny-list and the run-environment allowlist are published under Apache-2.0 with the tests that prove them, in packages/runner. What they do not prove is that a downloaded build matches the source; releases come from CI with published checksums, and reproducible builds are not yet supported. Jobs run when your Mac is awake; for true overnight work, use an always-on machine.

The spec sheet.

Everything below ships in version 0.4.0. Where something is still in beta, the row says so.

Engines
Claude Code, Codex CLI, OpenCode and Hermes Agent, on the logins you already have. Switch per task.
Your own keys
OpenAI-compatible providers too: Anthropic, OpenAI, Google, OpenRouter, xAI, Mistral, DeepSeek, Ollama and custom gateways. Keys live in the macOS Keychain and are billed by the provider.
Triggers
The calendar: RRULE or cron, expanded in the schedule's own IANA zone with daylight-saving rules that are tested. Or an event: HMAC-verified webhooks and GitHub sources fire tasks. Two triggers on the free tier.
No double fire
Each occurrence is claimed in the same transaction that creates the run, so a crash, a restart or a second scheduler cannot run it twice. Sleeping through several occurrences yields one catch-up run.
Where it runs
A macOS Seatbelt sandbox around a fresh git worktree, or an ephemeral Docker container with no network by default and CPU, memory and process caps.
Chains
Sequence agents: scan, fix, test, open a PR. Each stage waits for its upstream and receives that report as {{previous.report}}.
Budgets
A dollar cap, a turn cap and a wall-clock timeout, enforced by the supervisor outside the model. Cost and reliability analytics by task, provider and day.
Approvals
Risky actions pause the run and ask. Silence for two minutes is a no. A plan mode exists for jobs that read untrusted input.
Delivery
macOS notifications. Telegram and an HMAC-signed webhook that fronts Slack, Discord, ntfy or anything else are shipped and in beta.
Your data
SQLite in one folder in your home directory. The API listens on loopback only. Thirty days of history on the free tier. Verified at one thousand scheduled tasks.
Requires
macOS 14 or newer on Apple silicon, Node 22, and at least one engine CLI on your PATH. The download is 3.4 MB.

Install in four commands.

$ brew tap vimoxshah/clockwork
$ brew trust vimoxshah/clockwork
$ brew install --cask clockwork
$ xattr -dr com.apple.quarantine /Applications/Clockwork.app

# or by hand: download the DMG, then
$ shasum -a 256 -c checksums-sha256.txt
# expected for 0.4.0:
# 75dd370e40412222ad731bd23f9f6fc1200c1af7196914a767639301afd8e93a  Clockwork_0.4.0_aarch64.dmg
$ open -a Clockwork

Clockwork is not notarised by Apple yet. The build is unsigned, so macOS quarantines it and the last command clears that flag. Homebrew verifies the checksum first. The download buttons on this page fetch the DMG directly from the GitHub release; verify it against checksums-sha256.txt before you clear anything. Older builds are on the releases page.

brew trust is needed because Homebrew refuses casks from third-party taps by default. You are saying you trust this one.

Free for personal use. Paid tiers exist, and are not for sale yet.

Every line below is read from the same feature registry the daemon ships, and a test in the repository holds this page to it. No account, no card and no telemetry on any tier.

Free

$0personal, non-commercial use

  • Claude Code, Codex CLI, OpenCode and Hermes Agent
  • Your own API keys, sealed in the macOS Keychain
  • Custom OpenAI-compatible endpoints
  • Recurring schedules with RRULE or cron
  • Quiet hours for notifications
  • Human approval gates that fail closed
  • Dollar, turn and wall-clock caps
  • Agent chains
  • Ephemeral Docker execution
  • Webhook delivery to Slack, Discord, ntfy or anything
  • Two event triggers
  • 90 days of cost and reliability analytics
  • 30 days of run history

Pro

Builtnot priced yet

  • One year of run history
  • 30-day audit log
  • Policy engine: engine allow-lists, cost ceilings, approval thresholds
  • 50 event triggers
  • Analytics past the 90-day window

Teams

Builtnot priced yet

  • Two years of run history
  • Audit log across the retention window
  • Policy engine
  • Event triggers without a count cap

Commercial use of any tier needs a written licence. Ask for one, or ask to be told when Pro and Teams go on sale.

Questions

Do I need an API key?

No. Clockwork drives the CLI you already log into: Claude Code, Codex, OpenCode or Hermes. You can also bring your own API keys; they are stored in the macOS Keychain and billed by the provider, never marked up.

Does it run while my Mac is asleep?

No. Runs execute only while the Mac is awake. When the Mac is plugged in, Clockwork arms a power assertion before a scheduled run; a closed lid on battery defeats it, and the report says so. A missed run follows the policy you chose: run late, skip, or ask. For true overnight work, use an always-on Mac.

Why does macOS say the app is damaged?

The build is not notarised, so Gatekeeper refuses it until the quarantine flag is cleared. Verify the checksum first, then run the xattr command from the install section.

Where does my data live?

In a folder in your home directory, in SQLite. The daemon listens on the loopback interface only. Nothing is sent anywhere unless you configure a delivery target yourself.

Can an agent touch my main branch?

No. Each run works in its own worktree on its own branch. A global deny-list that no profile can override blocks force-pushes to protected branches and package publishing, and journals every attempt.

What does it cost?

Nothing for personal, non-commercial use. Commercial use needs a licence; email for one. Provider usage is always a separate bill.

Give your agents a work week.

Download for Mac Read the source

Apple silicon, macOS 14 or newer, 3.4 MB. Version 0.4.0.