desktop agent · macOS & Windows
Amallo runs in your menu bar or tray and hands local Ollama an OpenAI-compatible base URL and key. Point Cursor, Aider or anything else that speaks that API at it and reach your own models from anywhere, no port to forward.
OpenAI-compatible endpoint
https://relay.41tunnels.com/v1
api key
41t_9f2c…
local backend
http://127.0.0.1:11434
connected clients
97 connections left on the current Relay server
The first thing Amallo's window shows you is a base URL and a 41t_… key. Point Cursor, Aider, Open WebUI or a compose file at them and nothing else needs configuring. Streaming works.
One dialled connection, parked and kept alive. No inbound port, no router rule, fine behind NAT and CGNAT.
Ollama stays bound to localhost. Everything reaching it passes Amallo's auth first, and gets the CORS headers browsers need.
Connect over WebSocket instead and keys are negotiated between Amallo and the client: P-256 ECDH + AES-256-GCM, with Relay carrying ciphertext it has no key for. The OpenAI endpoint trades that away; a third-party client has no shared secret to encrypt with.
The code carries Relay URL, pair ID and pre-shared key. Scan once and the client is connected for good.
At home, skip Relay: a bearer token and Amallo's own address are enough, 127.0.0.1:11435, or 0.0.0.0 for the whole network.
Regenerating the API key hands every client holding the old one a 401 and tears down whatever it had in flight. Your paired chat rides the same connection and is not interrupted.
Signed updates over the Tauri updater, checked against a key that ships with the app. Nothing installs without a valid signature.
The whole agent is on GitHub: audit the crypto path, build your own binary, open an issue.
No Linux build yet — build it from source with Rust and Tauri.
free · open source · no usage bills