Cadabra 2.1

Requirements: macOS 14.6 or later (Apple silicon). AgentVM boxes need macOS 27 or later and the separate AgentVM app.

Cadabra 2.1 is about where an agent's work happens and what it can reach. An agent or a model's tools can now run in an AgentVM box, a separate macOS in a virtual machine, instead of on your Mac. On your Mac, the sandbox around the tools is easier to live with: sandbox packs grant the folders a kind of work needs in one click, and a folder or a pack can be allowed while a conversation is running.

Highlights

AgentVM boxes

An AgentVM box is a separate macOS running in a virtual machine on this Mac. What an agent does there stays there, apart from the one project folder you share with it.

• External agents in a box. In Select ACP Agent, Runs in offers this Mac, each kept box, and a new disposable box from each image. In a box, the agent and every tool it starts run inside the box.
• A local model's tools in a box. In Agentic Session Tools, Where tools run offers the same choices. The model itself stays on this Mac; every tool call it makes runs in the box. A pane of its own sets which tools run there, whether the project is read-only, and whether the box gets the internet.
• Cadabra's tools for a boxed agent. An external agent in a box can use Cadabra's MCP (Model Context Protocol) servers, as one on this Mac does.
• The box line. A chat window that uses a box shows the box, how the project is shared, how many hosts were reached and refused, and how many files changed.
• Network window. Lists the hosts the box reached and those it was refused, with the reason. A refused host can be allowed in the running box, or for the agent in every new disposable box.
• Keys. An agent in a box cannot read the keys on this Mac. Keys... in Select ACP Agent stores an API key in your login Keychain and gives the agent the one key you choose. For an agent that logs in through a browser, it opens Terminal in a kept box to log in there once.
• AgentVM Boxes monitor (Tools menu): lists the boxes with their states and starts, stops and shows the selected one.
• Images and boxes are made in the AgentVM app, a separate application from github.com/abra-code/AgentVMApp/releases. Where Cadabra needs it and it is not set up, a Set Up AgentVM... button opens the app or its download page.
• Help > AgentVM Boxes Help explains all of it.

On a macOS older than 27, Cadabra works as before and everything runs on this Mac.

Review and undo what a session changed

• Cadabra can take a snapshot of the project before a session starts (Snapshot the project first in Agentic Session Tools; on by default for a box, off for this Mac).
• Review Changes lists what the session changed, shows each file's differences, and undoes one change or all of them. It opens from Changes... in the chat window and from a conversation in the history.
• Changes that could run something on this Mac later are flagged and listed first: a git hook, an install script, a link that leads out of the project.

Sandbox packs

On this Mac the Local server (files and shell) runs in a sandbox that allows the project and a list of folders. A build tool that reads its own files from elsewhere then fails. A sandbox pack is a named set of folders for one kind of work.

• Choose Packs... in Agentic Session Tools lists every pack with a checkbox, beside a preview of the folders it grants on this Mac. The two folder tables now say where each folder comes from: you, the session, or a pack.
• Eight packs come with Cadabra: Make and C or C++ builds, CMake builds, Xcode and Swift builds, Node.js and npm, Python with pip and uv, Android Studio and Gradle, Homebrew tools, and Git settings. A pack whose tool is not on this Mac is shown as not installed.
• Record a Pack... runs a command of yours, finds the folders it needs, and saves them as a pack of your own after you review them. A recording can start on top of packs you already ticked.
• Reveal User Packs shows the folder of your own packs in the Finder.
• Packs cannot grant the folders that hold keys, mail, messages, browser data or Cadabra's own data.
• Help > Sandbox Packs Help, also behind the question mark buttons where packs are used.

Allowing a folder or a pack during a conversation

• Allow a Folder... in a chat window lets the tools use one more folder, read-only or read and write, without starting the conversation again. The conversation and the loaded model stay.
• When a tool call is refused a folder, the window offers to allow it, with the folder chooser opened there.
• Allow Packs... beside it opens the pack list. The chosen packs apply to the conversation from your next message, and to every new conversation.
• A folder allowed this way stays with the conversation until its window closes and cannot be taken away again. To run with fewer folders, start a new conversation.
• Both are for a local model with tools on this Mac. They are not offered for tools in an AgentVM box or for an external agent.

The engines run in a sandbox

• With Run Engine in Sandbox on in Select Local Model, llama-server may read only its own folder and the model file, use the graphics processor and listen on its port: no other file, no outgoing connection, no other program.
• The bundled mlx-agent gets a sandbox of the same kind when no tools run on this Mac. With tools on this Mac it runs as before, since the tool servers confine themselves.

Other changes

• A start window at launch with four buttons: Select Local Model, Select ACP Agent, New Chat and Download Models. Launch used to open the Local Models list.
• MCP Servers is now a catalog: it lists all four servers and their tools whatever is turned on and wherever tools run. A server that fails to answer gets a warning sign.
• Date & Time is served by a small native program, time-mcp, in place of a Python package. It needs no network, so Allow Network off no longer turns it off.
• Agentic Session Tools asks before you add a folder by hand that holds keys or other applications' data.
• The system's program folders (/bin, /sbin, /usr/bin, /usr/sbin) can always be read by the tools, on this Mac and in a box. Tools such as cmake fail when they cannot list them.
• Memory warnings count the memory of running AgentVM boxes.
• Leftover pdfutil processes of a crashed agent are now cleaned up, as replay and the bundled Python already were.
• Icon-only buttons have mouse-over help.
• replay sandbox tool updated to 2.2.2.
• The search server (duckduckgo-mcp-server) updated to 0.7.0, on version 2 of the Python mcp package (2.3.0). Search results keep full web addresses.

Upgrading

From 2.0 or 2.0.1: replace the old Cadabra.app with the new one. Downloaded models, settings and chat history are untouched. No sandbox pack is ticked after the upgrade, so the tools on this Mac can use the same folders as before until you choose one.

To use AgentVM boxes, install the AgentVM app on macOS 27 or later and make an image there first. Cadabra 2.1 needs agent-vm 0.6.14 or later, which the AgentVM app installs and updates.

Known limitations

• macOS runs at most two macOS virtual machines at a time, so at most two boxes run at once. A box uses the memory it was given for as long as it runs.
• Sandbox packs apply to tools on this Mac only. In an AgentVM box, the box is the boundary.
• The Android Studio pack needs JAVA_HOME set to Android Studio's Java in the command, and a Gradle daemon started outside the conversation is not confined by the sandbox; use --no-daemon.
• A pack grants only the folders that exist when the conversation starts. A cache folder that a tool creates on its first run is not covered until the next conversation.
• Apple Foundation Models has a 4k-token context window. Enabled MCP servers use up a large part of it with tool definitions before the conversation starts, so tools are practical with Foundation Models only when very few servers are enabled.