We ship continuously.

Open a cluster, set how many seats it has, and share a join code — teammates claim a seat with their own GPU, like filling a game lobby. Once every seat is filled you pick a model and it loads across every node; then everyone chats against the shared fleet. Two kinds: Replica puts a full copy on each node so more people are served at once (in-flight batching — validated at 8 concurrent users at ~4× the throughput of a single stream), and Tensor-parallel splits one bigger model across two nodes. If a node drops, a tensor-parallel cluster stops cleanly and tells everyone; a replica cluster keeps serving on the machines that remain. It’s opt-in by design — a cluster is created deliberately, never formed behind your back. Find it under the new Lobby tab.

When the agent runs unattended (an autonomous run, or with per-call approval turned off), a destructive connector action — delete, close, deactivate, cancel, or an update that sets a record to a terminal state — is now refused unless the agent actually read that record first. Small local models sometimes invent record ids (they’ll write to issue #123 after listing #41/#42/#44); this stops an invented or unverified id from ever reaching an irreversible write. It’s a plain refusal — the gate never rewrites the call or picks a different record for you, so it can only prevent a bad change, never cause one. Attended chats are unaffected (you still approve writes as before), it applies across every connector from one place, and you can turn it off with BMRT_GROUNDING_GATE=0.

When a local model uses tools, each call now shows as an audit card above the answer: the tool name, a badge for which toolset it came from (a built-in tool vs. which connected MCP connector), the exact arguments it was called with (expandable, verbatim), and the result — plus whether it succeeded or errored, how long it took, and whether it was allowed or blocked. The cards now persist, so reopening a conversation shows the full tool trail instead of losing it. Together with the tamper-evident audit log, this makes the agent’s actions fully inspectable rather than a black box.

The ServiceNow connector now accepts a human-facing incident number (like INC0010004) anywhere a system ID is expected and resolves it automatically. Small on-box models naturally refer to records by their number, so this lets them look up, update, and comment on incidents reliably without a separate ID-lookup step — making local IT-automation workflows work end to end. In our testing this took a small local model from 4/5 to a clean sweep on a real incident-ops task. A genuine record ID still works unchanged, and a wrong number still errors rather than acting on the wrong record.

Two additions for private, on-box work. New bmrt rag commands point the CLI at a folder of your own files and let you ask questions about them entirely on your machine — bmrt rag add ./docs then bmrt rag ask "…" — with the answer citing its source and saying “I don’t have that” instead of guessing when it isn’t in your files. And a new bmrt attest command (plus an /api/airgap/attest endpoint) shows exactly what can and can’t leave the box: your seal status, every outbound path, and a live count of internet connections — a one-command proof for anyone who needs “nothing leaves this machine.”

Private RAG now combines meaning-based search with keyword matching, so when you ask questions over your own documents it reliably surfaces the right source even in large libraries where similarly-worded files could otherwise bury it. In testing on a 5,000-document set, the correct source was found in cases the previous meaning-only search missed — with no added download and no change to smaller collections. It still tells you “I don’t have that” rather than guessing when the answer isn’t in your documents.

Two engine-reliability fixes for demanding, long-running work. First, if a model ever runs out of GPU memory mid-task, it no longer freezes while still reporting “ready” — the node now reports the problem honestly and recovers on its own, no restart needed (extending the self-healing from v0.23.1 to the out-of-memory case). Second, long-context requests that could previously exhaust GPU memory now fit reliably: the runtime sizes its memory to the context that actually works and scales down gracefully on smaller cards instead of failing. Your model’s reported usable context now reflects what genuinely runs on your hardware.

Internal plumbing so individual models can opt into alternate KV-cache settings in future builds. No change to how any current model runs — the default keeps every model’s existing KV-cache behavior. This lays groundwork for memory-saving KV options as the engine gains support for them.

Business integrations — Salesforce, ServiceNow, Workday, Snowflake and the full Security, Finance, HR, Analytics and Healthcare catalog — now require an Enterprise seat. Developer and personal connectors (GitHub, Postgres, Gmail, Slack, arXiv and more), the OpenAI/Anthropic-compatible API, bring-your-own-model, and every local feature stay free. Connectors you already run are preserved and resume the moment you upgrade — nothing is deleted.

A model worker that crashes mid-session now recovers on its own: the node reaps the stuck VRAM and reloads, instead of silently wedging while still reporting “ready.” The node’s status is now honest — a dead worker shows an error rather than a false ready — and a new one-click Reload recovers a stuck worker on demand. Loading a model on lower-VRAM GPUs no longer flashes terminal windows (the kernel-compile steps run hidden, like the installer). And auto-update no longer refuses a valid signed update after a signing-certificate rotation.

The tensor-parallel transport plugin — the component that pools VRAM across machines — is now built against the shipped CUDA 13 runtime, so it loads correctly on the current stack instead of failing to initialise. Its collective-reduce buffers were also hardened against oversized transfers. Single-GPU use is unchanged; full cross-machine serving is still being finalised.

Models built on recurrent (linear-attention) architectures — Qwen 3.5 and the Nemotron Nano family — could return subtly wrong answers or repeat themselves on longer replies. The decode fast path these models share with ordinary transformers turned out to be unsafe for them; it is now switched off automatically for those models only. Every other model keeps the fast path unchanged. Qwen 3.5 4B trades some speed for answers you can trust. The dashboard also no longer reports a model as loaded after it has been unloaded.

Updating no longer fails when a model is already loaded — the installer now shuts down the model worker before refreshing dependencies. Installs that stopped part-way could leave the inference engine unpacked; that path is fixed, and every build now carries its version so a mismatched daemon can’t ship unnoticed.

Anything that runs on your own machine is free, for good: the OpenAI- and Anthropic-compatible /v1 API, bring-your-own-model from any Hugging Face repo, custom MCP servers, and all 318 integrations. Point Cline, Continue, Aider or the OpenAI SDK straight at localhost:8080/v1 — no plan, no account, no meter. Connectors an earlier plan had paused resume on their own.

Paid tiers now cover only what involves other people or our servers: pooling GPUs across machines, reaching your box from outside your LAN, and org/seat management — Enterprise, $50/seat/month, self-serve. Existing Pro and Team licenses keep everything they bought.

A run of builds working toward the Qwen 3.5 linear-attention hybrid running on a packaged, single-GPU install — routing the single-GPU path and pointing the runtime at the kernel compiler it already ships so Qwen 3.5’s custom kernels can build at load. Still a preview in the model list, not yet marked verified while we validate it end-to-end on a real install. No effect on any other model.

Engine fix so Qwen 3.5 (16-bit and 4-bit) doesn’t try to set up multi-GPU communication that doesn’t exist on a single card. One step toward the preview running on a packaged install. No effect on any other model.

Adds 4-bit (int4) loading for Qwen 3.5, the Gated-DeltaNet linear-attention hybrid. The 4-bit build keeps the model coherent while running about 1.6× faster than 16-bit and fitting in roughly 5 GB instead of nearly 9 — so it runs comfortably on a 12 GB card with room for a long context. Shipping as a preview in the model list while we finish validation. Under the hood this fixes the engine so 4-bit weights load correctly on this new architecture class; the fix is inert for every other model, so nothing else changes.

Two quality fixes. Some models ship a mislabeled tokenizer that made their replies come out with missing spaces or stray symbols — the daemon now detects and repairs that automatically on load, so text is always clean. And a Gemma 3 4B build that produced incoherent output was removed from the model list until a corrected version is available. This build also clarifies Bring your own model scope (paste any supported open-weight model from HuggingFace — FP16 or 4-bit AWQ, no GGUF) and makes model-download failures actionable with a clear pointer to Downloads.

If a model failed to load (for example, one too large for the card), the daemon could keep serving the model you already had — but internally lost track of it, so chat stopped responding and every later model load was refused until a restart. Switching models is now bulletproof: a failed load rolls back cleanly to whatever was running, and loading a different model always works. Also: turning Memory off now truly stops your saved notes from being added to prompts (previously it only paused new capture).

The in-app update check now uses Bare Metal’s own version service instead of GitHub’s public API, which throttles at 60 checks/hour per network address. That throttling could make machines — especially several nodes behind one office network — silently stop seeing new releases. Updates now check reliably; GitHub stays the download host and an automatic fallback.

Under the hood, the Gmail, Calendar, Drive and Microsoft 365 connectors now use PKCE on their sign-in flow — the groundwork for one-click account linking that won’t need per-user setup down the line. This release also folds in updated legal terms (data-processing, liability, and AI-output responsibility clauses).

The on-device Google connector now includes Google Drive — the agent can search and read your Drive files, with Google Docs, Sheets and Slides automatically exported to text. Read-only and your token stays on your GPU host. The “connect” screen for Google now spells out the one-time OAuth setup step by step instead of a one-line hint.

The agent-write toggle now lives in the header right next to Egress Mode, and Egress Mode also gets its own row in the Security menu — so you can flip the machine’s write access and air-gap posture in one click without digging through settings.

The Gmail, Calendar and Microsoft 365 shortcuts in the sidebar now switch to a green Connected once you've linked them, instead of always reading “Connect.” The state tracks the live connection, so it stays honest as you connect and disconnect services.

The built-in calculator now understands the natural-language math small models actually write — “15% of 2840”, “17 percent of 240”, thousands separators like 2,840 — instead of erroring out, and it trims floating-point noise so answers come back clean. On the model catalog, the Agent badge now keys off a single source of truth, so a card only shows “Agent” when the model can genuinely call tools — two mislabeled models corrected.

Each model now advertises which coding-harness tier it should be driven with, published by the runtime itself — so Bare Metal Code gives smaller models a trimmed, focused tool set instead of the full heavyweight harness they tend to stumble under, without guessing from the model name. One source of truth in the catalog, so the app and the runtime never drift.

The model catalog now uses a bit more of the screen on wider windows, so the filter row (including the new Installed filter) sits on a single line instead of spilling a lone chip onto a second row — and the card shelves below get more breathing room to match.

When the agent uses a tool, the raw result (like a list of emails) now collapses behind a one‑line summary you can click to expand — so you read the agent’s answer, not a page of JSON. And when you ask about your latest email, it now fetches just a few instead of two dozen. The full result is still one click away whenever you want to see exactly what the agent read.

The in‑app agent got much better at actually calling a tool instead of describing it. Before, asking something like “what’s the subject of my latest email?” could get a reply that told you to use the Gmail tool rather than the agent just doing it. Now the agent is told plainly it can act, and its tool decisions are made more decisively — so it reads your mail, checks the weather, or runs a search on the first ask. In our tests this took a small model from missing that request to handling it every time, with no loss in answer quality.

The catalog now has an Installed filter next to Fits my GPU. One click narrows the list to the models already downloaded on your machine, so you can jump straight to what’s ready to run instead of scrolling past the full catalog. The other filters — Agents, Reasoning, Coding, Vision, precision tiers — work exactly as before.

Hitting New session when no model is loaded used to drop you into a blank chat that couldn’t reply. Now it takes you straight to the model picker with a clear “Load a model” prompt — pick one and your session starts, still filed into whatever project you were in. If a model is already loaded, nothing changes: you go right into a fresh chat.

New sessions now land where you expect. Every project has its own + button to start a chat inside it, and the main New session button remembers the project you’re currently in — shown by a highlighted heading with a dot so you always know where the next chat will go. Want to keep one loose? The Unfiled group has its own + for a quick un‑filed chat. As always, projects and chats stay on your machine.

Loading a model too large for your GPU used to be costly: the app would unload the model you already had, spend several minutes retrying the one that couldn’t fit, and leave you with nothing running. Now it recognizes when a model can’t fit (its weights plus working memory exceed the card), stops immediately instead of retrying, and keeps your current model loaded — restoring it automatically if a switch had already begun. Switching models is safe again: one that doesn’t fit costs you nothing.

Two fixes to connecting Gmail (and any integration). First, connectors and their saved keys no longer get dropped when you update — previously a connector that was briefly restarting during an update could be erased from your saved list, so you’d have to re-enter your app password. It now stays put across restarts and updates. Second, connecting now confirms it worked: you get a clear “Connected — N tools, saved on this device” message once the connector is actually running, instead of a vanishing toast.

Fixed the Gmail connector failing to read mail on big inboxes: fetching recent messages used to scan the entire mailbox at once, which overflowed on accounts with tens of thousands of emails and made the agent report it couldn’t access your mail. It now pulls just the messages it needs. Reading, searching and sending all work regardless of inbox size.

Connecting Gmail is now a simple guided step under Integrations → Gmail (Google Workspace) — and it’s included on the free plan. Click Gmail, follow the three steps to create a Google app password, paste it in, and your agent can read, search and send your mail. No Google Cloud project, no OAuth developer setup. Your credentials and mailbox stay on your GPU host — never stored on our servers.

Your on‑box agent can now read, search and send email — add your account under Integrations → Email with an app password and it works with Gmail, Outlook, Yahoo, iCloud, Fastmail and more. Server settings auto‑detect from your address, so there’s nothing to look up. Reading a message never marks it as read, and sending always asks you first. As always, your credentials and mailbox stay on your GPU host — they are never stored on our servers.

Group related conversations into projects right in the Sessions sidebar. Create a project, then drag any chat onto it to file it away — or use the folder button on a conversation to move it. Projects collapse to keep a long list tidy, span both single‑ and dual‑GPU modes, and deleting a project keeps its chats (they simply return to Unfiled, never deleted). As always, everything stays on your machine — projects are saved locally alongside your chat history.

When a reply cited sources from a web search, those links used to vanish if you left the conversation and came back (or reloaded the app) — they were shown live but never saved with the chat. Now they’re stored alongside the reply and reappear right where they were when you reopen the conversation. Chats you had before this update can’t recover sources that were never saved, but every reply from here on keeps its citations.

A new optional safety layer lets you block a tool from running with certain inputs — not just switch a tool on or off, but stop a permitted tool from doing something you didn’t intend (say, a connected integration running a destructive command). Rules are checked at the single point every tool call flows through, so they cover built‑in tools, your connected integrations, and multi‑step workflows alike. It’s off by default — nothing changes until you add a rule — and any blocked call is logged. Most useful for keeping auto‑approved integrations on a short leash.

Your assistant now quietly learns the durable facts you mention in conversation — your name, where you work, your pets, your preferences — and saves them to a local Memory panel on your own GPU. It works across every chat mode (the smart agent, multi‑model, and plain), recalls them in later conversations, and cleanly updates or replaces a fact when you correct it (fix a typo and the old value is retired, not lost). Multiple facts in one message are each captured, and it works on reasoning models too. Everything stays on your machine — nothing leaves your GPU — with per‑item undo, approve, and delete so you stay in control.

A follow‑up to the cleaner‑updates fix: we reworked how the app runs its background helpers (updates, restarts, housekeeping) so that none of them can ever flash a command window — not just today, but going forward. A build‑time check now blocks any future change that could reintroduce one. Purely under the hood; nothing to do on your end.

Memory used to have two settings — an on/off Auto‑remember switch and a separate Memory approval picker — and when the switch was off, the picker just sat there doing nothing. We’ve merged them into a single control you tap to cycle: Off (never learn from chats), Review (save everything but hold it for your approval), Confident (keep clear facts, queue the guesses), and Auto (remember right away — undo or delete anytime). Your existing choice carries over automatically. Same control, less to think about.

When the app updated itself, a few small black command windows would pop up minimized while the new version installed. They were harmless, but distracting. Now the whole update runs silently in the background — you just see the app come back on the new version. No windows, no flicker.

Auto‑remember used to catch only a handful of fixed phrasings. Now the app reads each chat with your local model — after the reply, on your GPU, never sent anywhere — and picks up durable facts however you say them: “my favorite color is blue,” “I work at Disney,” “I live in Palm Springs,” “I’m allergic to peanuts.” It stays conservative (passing moments and questions are ignored), and everything still flows through your Memory approval setting — Auto, Confident, or Review — so you keep full control. No extra memory use and no slowdown to your chats.

Two fixes to the new memory features: the app now remembers possessive names like “my dog’s name is Coco” or “my wife’s name is Sarah,” not just your own name. And a bug where the app would snap you back to your last conversation a few seconds after you opened the Memory view (or Integrations, Agents, etc.) is fixed — those views now stay put until you leave them yourself.

The app now remembers durable facts from your chats automatically — your name, the tools you use, your preferences — so you don’t have to repeat yourself. Everything it learns is visible in the Memory section, where you can edit, turn off, or delete any item. A new Memory approval setting lets you pick how it works: Auto (remember right away, undo or delete anytime), Confident (remember clear facts, hold guesses for review), or Review (approve everything first). Casual phrasing like “I’m Alex” is picked up now too, and the memory store stays fast even with thousands of saved items.

Your Hugging Face token and Team Sharing now open straight from the app menu (under Hugging Face and Sharing) instead of being buried in Account Settings. Same settings, easier to find — and Account Settings is now just your profile, subscription, devices, API keys, and security.

The “What’s new” link on the update banner led to a “not found” page instead of the release notes. It now opens the changelog correctly.

Hardened the on‑box control API against a class of browser attack: a malicious web page you happen to have open could quietly send commands to the app running on your machine (start or delete a model, trigger an update, seal the box) without your knowledge. The app now verifies every such command genuinely comes from your own app — not from another website or a spoofed address — and rejects the rest. Nothing changes for normal use.

Launching the app a second time — a double‑click after it was already running at startup — could quietly start a second copy that couldn’t serve requests but still held on to your GPU, competing for video memory in the background. The app now detects an instance that’s already running and steps aside cleanly, so only one copy ever touches your GPU.

Updating from inside the app used to leave it “reconnecting” for a couple of minutes after the installer ran — the app closed and didn’t come back until a background safety net kicked in. Now a silent update relaunches the app the moment it finishes, so it reconnects in seconds. We also collapsed to a single update prompt (one click to install, no more dead‑end “download” link) and clean up the downloaded installer afterward.

The System menu now works in the installed app. Model Storage, Downloads, Docs and Account opened to a “Not Found” error on the local app — those pages had no on‑box route. They’re now served right on your machine: managing and deleting downloaded models, watching downloads, and browsing the model catalog all work fully offline. Account settings (API keys, billing, sharing, 2FA) connect to your account when you’re online.

A cleaner identity across the board: a new engraved nameplate wordmark in the installer and app header, a new window icon and favicon, and the app is now locked to dark mode while we finish light mode. DeepSeek R1 Distill (Llama 8B, int4) loads and answers again — it had started failing on the very first message. And installs are now signed under our company name, Bare Metal AI, Inc.

Fixed a startup crash in the installed app that could stop a model from loading.

Fixed the “confirm your email” step in the installed app: the Verify and Resend buttons now actually send and check your code — previously they did nothing on the on‑box app, so no code ever arrived. Also tidied the code box so the “6‑digit code” hint no longer gets cut off.

The free tier just got a lot bigger: every messaging channel is now free — Slack, Discord, Telegram, WhatsApp, Teams, Zoom, Webex, Twilio & RingCentral — along with local memory and Google Drive & Calendar. Setup is also smoother: it now asks for permission once instead of twice, and re‑running it on a machine that already has BareMetalRT lets you Repair, Update, or Uninstall right from the installer instead of reinstalling from scratch. With the firewall on, the GPU worker no longer trips a Windows Firewall prompt. The guided tour now plays its talking‑head video right on your machine — bundled in, so it still works fully offline. And Auto‑routing is now labelled Beta while we keep tuning how it picks the best model for each prompt. Uninstalling now fully removes the app and its GPU runtime — reclaiming the disk space earlier versions left behind (your downloaded models are kept).

Behind‑the‑scenes hardening ahead of launch: tighter access controls on shared demo hardware, and the inference engine now automatically recovers from a stalled worker instead of needing a restart — so chat stays responsive even if a model hiccups.

First launch now offers a short guided tour that walks you through the app — your GPU, the model catalog, memory, agents, integrations and more — with a friendly narrator. It runs entirely on your machine: no video is streamed and nothing is fetched, so it works the same offline or air‑gapped, narrated by your system voice. It shows once, and there's a new Settings ▸ Welcome Tour switch to replay it any time or turn it off entirely.

Loading a single model split across two GPUs is more robust: a slower second card is now given as long as it needs to finish loading, instead of being cut off on a fixed timer — which previously could leave the two cards out of sync and fail the load. This release also bundles the open‑source (Apache‑2.0) license and attribution for the inference engine that ships inside the product.

Bare Metal RT now loads models saved in the compressed‑tensors 4‑bit format — the “W4A16” format from llm‑compressor / Neural Magic that has become the most common way int4 models are published on Hugging Face. Checkpoints that used to refuse to load — standard architectures like Qwen, Llama, and Mistral published as *-quantized.w4a16 — now run directly, at a fraction of the download size and video memory of the full‑precision model. Validated end‑to‑end on a 12 GB card.

Auto-remember is now a switch you can flip in the app (Settings ▸ Auto-remember). The app learns durable facts from your chats and saves them to Memory — inferred items still wait in a review list for your approval — and now you can turn that off (or back on) in one click, instead of an advanced setting. Still on by default; nothing leaves your machine. Egress Mode also moves to an always-visible header button next to the light/dark toggle, so sealing a node is one click from anywhere in the app.

Talk to your model even when the GPU is completely full of your chat model. Speech‑to‑text (Whisper) now runs on the CPU by default, using ~0 GB of video memory, so voice no longer switches off on 8 GB cards the way it used to. When the full on‑GPU voice stack won't fit alongside your model, voice automatically drops into a CPU mode — real on‑device transcription plus your browser's speech — instead of turning off. It defaults to a fast Whisper model that transcribes a sentence in well under a second; on a roomier card the transcriber can run on the GPU instead for the highest accuracy.

Fixes a bug where the in-app updater would download and verify a new build but not actually install it — it was passing the installer the wrong silent-install flags after the move to the new installer format. One-click "Update now" now applies cleanly and the node comes back on the new version. Note: a node has to be on this build (or newer) for the fix to take effect — update it once by hand, and every update after that is hands-free.

A milestone release. The headline is Egress Mode (Settings ▸ Security): set it to Sealed and the node makes zero unsolicited outbound connections — background update checks stop and it unlinks from the cloud (heartbeat, relay, and license/token fetches all cease). It's one-way: re-opening egress takes an operator restart, so a user or a compromised agent can't quietly re-open the network — and a sealed node stays sealed across restarts. Pairs with a separate Agent write access control, so you can run an autonomous agent that acts on local files while the box is fully contained — or seal it strictly read-only. Built for air-gapped, regulated, and classified sites; a header 🔒 Sealed badge keeps the posture visible, and your security team can verify it from the no-egress attestation. 0.14 also closes out the recent run of agent memory (recall, auto-capture, MCP) and native serving by default — the chapter that takes the local agent from "runs your model" to "remembers, acts, and stays put."

The facts the app remembers about you are now available as tools. Turn on the new Memory integration and the agent can search and recall what it knows, and save or update a memory with your approval — so it can act on what you've told it, not just read it at the start of a chat. Search is smart: it finds relevant facts by meaning, not just exact words. And with one "Connect apps" config you can use the same memory from Claude Code, Cursor, or any MCP client. It all runs on your GPU host against the local app — nothing leaves your machine.

Memory is now fully auditable. Every saved fact shows where it came from (learned from a chat or pinned by you) and what kind it is — a durable fact, an event, or current-task context. When the app learns something mid-chat, a small "remembered" note appears with View and Undo, so nothing is saved silently. Things it picks up on its own land in a review list you approve or dismiss. Ask "which memories did this reply use?" on any answer and see exactly what was pulled in. And because the store is just plain markdown, you can open it in Obsidian to browse the graph of how facts connect. Everything stays on your GPU host.

Your saved memory now scales without losing anything. Instead of dropping older notes once the list outgrows what fits in a prompt, the app keeps everything on your device and pulls in just the notes relevant to each question. It can also remember things for you: say "remember that…" and it's saved; mention a preference in passing and it's added to a review list you approve before it's ever used. When a fact changes — a new preference, a corrected name — the old one is retired, never deleted, so your history stays intact. Everything stays on your GPU host, and nothing it picks up on its own is used until you approve it.

A new model-serving engine is now the default. It frees GPU memory cleanly every time you switch models, serves concurrent requests with real batching instead of one at a time, and self-heals — if the serving worker crashes it restarts automatically instead of leaving chat stuck.

Presence (preview): a photoreal voice avatar you can talk to, now served by the app at /presence with expression controls. Smoother install: the app auto-starts and opens itself after setup, and in-place upgrades are cleaner (the running app is shut down first). Security: before a machine is linked to your account, other devices on your network can no longer load/delete models, write memory, or read the on-device audit log — refused until the machine is claimed (your own machine and linked GPUs are unaffected). And cancelling a running agent now interrupts it mid-answer instead of only at tool steps.

When the assistant used more than one tool in a single step (say a calculation and a web search), all but the first could silently fail — now they all run. A prompt too large for your GPU returns a clear message instead of repeatedly crashing and reloading the model. Plus a broad hardening pass on the on-device API: size limits on document, embedding and image inputs; the audit log is no longer readable by other machines on your network; and saved memory is included even when an app sends its own system prompt.

Voice now uses the fast Kokoro voice on every GPU, so spoken replies start sooner and sound consistent across machines. The desktop tray icon is refreshed to the BareMetalRT brand mark. Behind the scenes we hardened billing & account security ahead of paid-plan launch — stronger payment-webhook handling and tighter multi-tenant isolation for SSO/SCIM.

BareMetalRT now ships as a modern Windows Installer (MSI) package with a branded setup experience, replacing the previous installer. Installing, updating and uninstalling are cleaner and fully integrated with Add/Remove Programs, and existing installs upgrade in place automatically. The installer is code-signed and self-contained, so it runs on a clean machine with nothing extra to download first.

The on-box code editor's AI agent gains a repository map — it builds a structured view of your codebase (files, symbols, layout) and seeds the agent with it, so edits and answers are grounded in your actual project, not just the file that's open. It's exposed locally via a new /v1/repomap endpoint — computed entirely on your node, nothing leaves your machine. This build also slims the runtime bundle for faster, cleaner installs.

The on-box app now has a built-in System page — open it from the menu to see your GPU, VRAM, driver and CUDA versions, the active model, and live temperature, utilization, power and memory usage, all served locally with nothing leaving your machine. This release also hardens GPU detection on fresh installs and adds smoother Solo/Fleet switching with automatic offline handling when a node disconnects.

Introducing the local code editor: a new Code button opens a full editor in your browser, served from your own node. It pairs a Monaco editor (the same engine as VS Code) with a file explorer and an AI agent that reads, edits, and runs your code using your node's local model — nothing leaves your machine. It has a proper IDE layout (activity bar, tabs, breadcrumb, minimap, status bar) finished in the Bare Metal RT look. Best on focused, single-file tasks today; larger multi-file work benefits from a bigger model and GPU. The Code button appears when a coding model is loaded on the node. Shown in local mode.

Fixed a separate load-warmup hang where AutoAWQ int4 models could stall after loading weights on consumer Ada/Ampere GPUs (the kernel auto-tuner is now skipped on those cards, where it isn't needed). Local coding models also call tools more consistently — tool-calling turns are decoded deterministically, so an agent reliably acts instead of occasionally replying in prose.

A recent engine update had dropped support for AutoAWQ int4 checkpoints, so int4 code models — including Qwen2.5-Coder-7B and the rest of the int4 catalog — failed to load with an "unsupported quantization" error. The engine now ships a unified build with AutoAWQ restored (FP8 support preserved), so those models load and run again. This release also makes tool calls from small local models far more reliable — the server normalizes slightly-off tool-call formats into standard calls and honors required tool calls, so agentic coding flows work — and the model-loading bar now tracks real load stages with a pinned GPU-usage readout.

Loads now retry instead of failing on a transient hiccup (a VRAM blip, a slow import, a flaky download), and GPU memory is no longer leaked between loads — a worker that times out or crashes is reaped, so the next load doesn't fail for lack of VRAM. The node also reports its real state: after an unload or unexpected drop it shows idle instead of a stale ready, a crashed worker self-heals, a broken tokenizer surfaces as a real error, and a corrupt model registry is backed up and fails loud instead of silently wiping your downloads. Preview: a new native serving path with rock-solid model swapping is being trialed here, and becomes the default in v0.13.28.

A new premium logo across the installer — the glowing mark with the "Bare Metal AI" wordmark and "Your PC is the data center" tagline — and a brighter app icon that's actually visible at taskbar size. A few lines on the System Check page that ran off the right edge now wrap correctly.

The daemon takes a couple of seconds to register and detect the GPU after you link it; the app used to paint "No GPU connected" until its next 10-second poll, so it looked broken until you refreshed. It now polls quickly until the GPU comes up, so the card fills in on its own within a second or two.

An unlinked machine no longer opens (or repeatedly re-opens) stray cloud browser tabs — the on-box app shows a single "Connect this GPU" screen, and that's the one place you link from. The claim token refreshes on demand so signing in works no matter how long you take (a 5-minute expiry used to break it), and a linked machine can't be claimed twice — a deliberate re-link replaces its key in place instead of stacking duplicates.

Linking a new machine now uses the same premium two-pane layout as the login screen — the branded panel (pulsing mark, trust points) beside a clean call to action — instead of the previous plain prompt.

Fixed a regression that could stop the sign-in step from linking a brand-new GPU to your account. Connecting a fresh machine works as expected again.

The local app now shows the real account this machine is linked to — it previously showed a placeholder. There's still no separate login: the machine's own credential is the identity.

If an update is interrupted partway, the app now relaunches itself automatically instead of getting stuck — a failed update self-heals.

Fixed missing fonts and icons so the on-machine app renders pixel-for-pixel with the web version.

The desktop app now serves the full chat experience straight from your own machine, with no account required — your conversations and models never leave your PC. This release also adds an enterprise managed mode so IT can enforce model and sharing policies on each device.

New installs now require authentication on the control API by default. Local and on-device traffic stays friction-free, and multi-GPU fleets keep working out of the box through trusted-peer handling — everything else needs an API key.

Added 26 new model cards in an FP8 precision lane — roughly half the memory of full precision at near-full quality, with faster math on Ada and Blackwell tensor cores. Covers Qwen, Llama, DeepSeek distills, Phi-4, Gemma 3, and Mistral Small, with a new FP8 filter to surface them on a compatible GPU.

A refreshed install wizard matching the rest of the product, plus a streamlined System Check that only asks for an up-to-date NVIDIA driver — no separate CUDA or TensorRT downloads, the app ships everything it needs. Installs no longer flash a console window.

Business-intelligence connectors can now kick off refresh and run actions, not just read data.

Added a dedicated AI category to the integrations catalog, a read/write badge on each connector so you can see at a glance what it can do, and a spotlight for featured integrations. The catalog now spans 318 connectors.

A fifth wave added 17 more integrations (now 312 total), plus clearer read vs read & write badges so you can see at a glance what each connector is allowed to do.

The engine can now run dense FP8 checkpoints — roughly half the memory of FP16 with comparable output quality — on RTX 40-series (Ada) and 50-series (Blackwell) hardware. The first FP8 models follow as they're validated on that hardware.

Added 12 more connectors and enabled write access on 5 more, bringing the catalog to 295.

Connectors can now read and write, not just read — plus new Close, Keap, and Copper CRM integrations.

A big batch of connectors spanning databases, ads, social, CRM, finance, and DevOps tools.

Fixed an installer dependency step that could fail, and stopped a stray console window from briefly appearing during a background update.

Added 15 BI and data integrations, growing the connector catalog to 262.

Hardened the installer so a fresh install or update always sets up a GPU compute stack that matches the engine. Previously, if the step that installs PyTorch was interrupted, a machine could be left in a mismatched state where the engine couldn't load any model. The installer now puts the correct build in place up front, removing that window.

When the app updates itself, the installer now runs fully in the background — no stray console window sitting open on screen for the length of the install. The update applies silently and the app relaunches itself when it's done, exactly as before.

The local control API can now bind to a specific host or interface instead of only localhost — set it to a private LAN address to serve a fleet, or keep it pinned to 127.0.0.1 to stay strictly on-box. A built-in safeguard refuses to expose the API on a public interface without an explicit API-key lock, so widening access is always a deliberate, secured choice. Aimed at enterprise and multi-node deployments; single-machine installs are unchanged.

If a node's inference engine is in a bad or mismatched state — for example after a partial update left its GPU libraries out of sync — the fleet now detects it and fences it off so chats are never routed to a machine that can't actually serve them. The unhealthy node reports its status, refuses model loads with a clear error instead of a silent hang, and the orchestrator skips it when picking a node. It rejoins on its own once its engine is healthy again.

A wide set of AutoAWQ int4 checkpoints saved in bfloat16 — including the well-traveled DeepSeek-R1-Distill AWQ models — previously failed to load and could leave GPU memory stuck. They now load and run cleanly. The DeepSeek-R1-Distill catalog entries (7B, Llama-8B, 14B, 32B) point at the canonical community AWQ repos; 7B and Llama-8B are validated coherent at roughly 75 tokens/sec on an RTX 4070 SUPER.

If the app ever closed unexpectedly — a crash, a forced quit, or a power event — the model could keep holding onto GPU memory in the background, and the next model would fail to load with an out-of-memory error until you rebooted. The app now reliably releases all GPU memory the moment it exits, for any reason, so the next model always loads cleanly. Recommended update for every node.

The app now has a Software Update button in Settings to check for and install the latest release whenever you want, plus an Auto-update on/off switch. Turning auto-update off stops all background update checks — a one-click, UI-native way to keep a node fully offline (handy for air-gapped sites), while you can still update manually at any time.

The Windows installer and app icon now display the current Bare Metal AI logo. A build-pipeline issue had been regenerating the installer artwork from an older design on every build, so refreshed branding never reached the shipped installer; the setup screens and desktop icon now match the current brand. No functional change.

BareMetalRT now loads AutoAWQ int4 checkpoints directly — the most common community 4-bit format on Hugging Face — so a huge range of pre-quantized models run on your GPU without any re-quantization or extra conversion. Validated on coding and general-purpose models (Qwen2.5-Coder-7B, Hermes-3-8B); existing models are unaffected.

The one-click in-app updater could download and verify a new release but fail to finish installing it on some setups — the app would close but not come back, needing a manual reinstall. Fixed: the signed installer now runs fully detached from the running app, so it can replace files and relaunch the app on its own every time. Signature verification and the consent prompt are unchanged.

On smaller cards (e.g. 8 GB), a long prompt could exhaust the GPU's KV cache mid-reply and leave the chat spinning on “thinking” with no feedback. Three fixes land here: the usable context window is now sized to your GPU so a request can't oversubscribe memory; a stalled generation now surfaces a clear message in seconds instead of a multi-minute hang; and voice no longer co-loads when it would starve the chat model of the memory it needs to run. The GPU card also now shows the effective context window for the loaded model, so the usable size is honest per card.

A new air-gap mode puts the daemon into a strict no-egress posture for classified, regulated, or disconnected sites. With it on, the daemon makes zero unsolicited outbound internet connections: the in-app update check (the only autonomous phone-home) is fully disabled — no background poll, no on-demand check, no installer download — so nothing reaches out without an operator asking. Updates are applied the air-gapped way: drop in the signed installer and run it. Licensing was already offline (Ed25519, no phone-home), and fleet traffic stays on your LAN. Off by default — normal installs keep the in-app update banner. Since 0.14, this is a one-click Egress Mode toggle in Settings ▸ Security.

The inference engine was updated to TensorRT-LLM 1.3.0rc18, broadening the range of model architectures we can run. New vision-language models are now in the catalog as Preview — Qwen3-VL (2B / 4B / 8B), Phi-4 Multimodal, and Pixtral — attach an image and ask about it. Wider coverage, including mixture-of-experts models and Blackwell (sm120) GPUs, is in progress and moves from Preview to Available as we validate it on hardware.

Sign in with your organization's identity provider — OIDC (Okta, Microsoft Entra ID, Auth0, PingOne, Keycloak, ADFS) and SAML 2.0, with SCIM 2.0 auto-provisioning/deprovisioning and role-based access (admin / user / viewer) mapped from your IdP groups. Authorization Code + PKCE, JWKS-validated tokens, signed SAML assertions; the orchestrator is the relying party, so it works on-prem and air-gapped against your own IdP. Off by default — the local and demo experience is unchanged. Architecture & security →

New per-seat Team plans (with a 14-day free trial) and seat sharing — each seat can invite up to four teammates to chat on its GPU. This build adds the daemon-side enforcement: shared guests are chat-only (no connectors, agents, or API keys), enforced locally on your node. Also ships offline, signed license verification (Ed25519 — no phone-home) for licensed and air-gapped deployments, and a Share Access shortcut in the tray. See plans & pricing →

Chat over your own documents — entirely on the GPU you own. Create a knowledge base in the composer, add your files, and the model answers grounded in your text with bracketed [n] citations. The chunker, the embeddings (all-MiniLM-L6-v2), the vector index, and the source text all stay on your host — no cloud index, no third-party service in the retrieval path. New /api/rag/* endpoints, and any chat can be grounded by passing a collection. Retrieval docs →

A cosmetic installer refresh: the setup wizard now carries the current Bare Metal AI logo and wordmark, the license page shows an up-to-date revision date, and the dependency-setup console runs minimized so it no longer pops up and steals focus at the end of installation (progress still streams to the taskbar window and install-deps.log). No runtime changes — identical engine and daemon to v0.12.7.

A focused fix-and-harden release. Workflows, Agents and Routines are now fully wired in the hosted app — creating, scheduling and running them works end-to-end (previously these tabs could silently fail to save). Security hardening across the board: an opt-in API-key lock for the local control API so only the machine owner can change it over a network, a launcher allowlist for connector servers that blocks arbitrary process execution, salted password hashing (scrypt) with transparent upgrade on next sign-in, stricter session-revocation handling, and full request isolation on the OpenAI-compatible /v1 endpoint so concurrent calls never cross streams. Plus correctness fixes: mid-run cancellation is honored immediately, agent run and workflow files are written atomically, and connector SQL read-only guards are tighter.

The connector catalog jumps to 230+ integrations across 14 categories, with deep first-party coverage for the systems enterprises actually run: Workday, SAP, NetSuite, Dynamics 365, ServiceNow, Splunk, CrowdStrike, Okta, Microsoft Entra ID, Power BI, Snowflake and many more — plus vertical packs for finance (SEC EDGAR, Plaid, OpenFIGI), healthcare (Epic, Oracle Health/Cerner, and any FHIR R4 server), government & defense (Esri ArcGIS, SAM.gov, USAspending), and legal & insurance (Clio, iManage, Guidewire). GitHub, Slack, Jira, HubSpot and Notion are now first-party bundled — no Node.js required. Every connector runs as a stdlib server on your GPU host: credentials and data never leave the machine, reads are silent, and anything side-effecting pauses for your approval. A new industry filter narrows the catalog to your vertical in one click.

The three hyperscaler connectors join the read/write family. Connect AWS, Azure or Google Cloud read-only by default, or opt into read & write to let an agent provision and control resources: create an S3/GCS bucket and upload objects, start/stop EC2 and Compute instances, create an Azure resource group, start/stop VMs and tag resources. Writes are curated and conservative — no destructive deletes — and every one is side-effecting, so it pauses for your approval before it runs (auto-approved only inside an autonomous agent run). Real request signing (SigV4 for AWS, OAuth bearer for Azure/GCP) on your GPU host; keys never leave the machine. 26 connectors can now act.

Workflows are no longer a prompt in disguise. Build a process as a funnel of steps that runs the same way every time: Input → deterministic tool Actions → AI reasoning nodes → Output. The engine walks the funnel in order and pipes each step's result into the next with {{n1}} placeholders — control flow is enforced on your GPU host, not improvised by the model, so every run is repeatable and auditable. Define the process properly with named fields (goal, owner, inputs, outputs), pick the model it runs on (it loads automatically before the run), and read-only mode refuses any side-effecting action. New funnel editor with add/reorder nodes, a per-tool parameter picker, and a built-in docs panel.

Connectors can now do things, not just read them. Five new ones ship — SAP (OData), Tableau, DocuSign, WhatsApp and Microsoft Teams — bringing the catalog to 102. And 23 connectors now let you choose access when you connect them: read-only (the safe default) or read & write — create a ServiceNow incident, reply to a Zendesk ticket, post to Teams, trigger a dbt or Airflow job, send a document for signature, and more. Every write is side-effecting, so it pauses for your approval before it runs (auto-approved only inside an autonomous agent run). Everything still runs on your GPU host with your own tokens.

A new Workflows tab: name a procedure, write its steps in plain language, and pick which integrations it may use. Running it launches an agent scoped to only those integrations — so it stays focused even with 100+ connected — and every run is recorded so the workflow improves over time. Schedule any workflow to run daily on the existing Routines engine. It's the glue between your tools and your tasks: describe the job, the agent does it, entirely on your GPU host.

The integrations catalog jumps to over 100 — 97 live and growing. New bundled connectors cover the cloud (AWS, Azure, Google Cloud), the data stack (Snowflake, Databricks, dbt, Fivetran, Airbyte, Airflow, Elasticsearch, Metabase), engineering (Datadog, Grafana, PagerDuty, Jenkins, Bitbucket, Azure DevOps, Snyk, SonarQube), and the enterprise (ServiceNow, Confluence, Box, Zendesk, Microsoft 365 incl. SharePoint, Salesforce) — plus CRM, support and productivity tools. Each runs on your GPU host as a read-only connector: you add your own token, and your credentials and data never leave your machine for our cloud.

Paste any Hugging Face model link and BareMetalRT now reads the model's card, checks it runs on your hardware, and adds it to your catalog — no waiting for us to add it. Supported architectures load straight onto the local PyTorch path and chat, all on your own GPU. This release also bundles 42 ready-made skills — reusable instruction recipes like code reviewer, commit-message writer, SQL helper, changelog drafter and research assistant — that you can hand to the agent in one click, alongside the growing one-click integrations catalog.

The local PyTorch inference path now captures each decode step into a CUDA graph, so the GPU no longer sits idle between token launches. On an RTX 4070 SUPER, Qwen3-4B (4-bit) generation jumps from ~19 to ~79 tokens/sec — about 4× faster — closing most of the gap to the older compiled-engine backend. No setup or config change; responses just come back quicker.

Agents can now use several tools in a single turn, with read-only tools running in parallel for faster answers. A new Agents tab lets you launch headless agent runs — give a goal and a permission mode (read-only, or autonomous to use side-effecting tools) and watch them work in a read-only fleet view; runs execute on your own GPU, one at a time on the engine, and are stored locally. Routines schedule recurring agent runs — every few hours or daily at a set time — that fire on your machine, always-on with no cloud bill. Everything stays on your hardware.

Cross-machine tensor parallelism — running a single model split across two machines' GPUs — now works straight from the installer with no manual setup, so you can run models too big for one card. Validated end-to-end across two RTX GPUs: a clean install on each box loads and chats coherently over the network. The catalog also flags gated models your Hugging Face account can't download yet and prompts you to accept the license in one click, instead of only finding out when a download fails.

A deep stress-test followed by a fix-and-verify loop run until no critical bug remained. Patched two cross-site-scripting holes in chat rendering; a crashed model now auto-recovers instead of erroring out; model loads are serialized to stop out-of-memory crashes; downloads now really stop on Pause/Cancel; and a Mistral 7B bug that returned blank replies is fixed. Voice recovers gracefully instead of going silently dead, non-English and emoji replies render correctly, and the installer is now a one-command, self-checking build. Validated end-to-end on an RTX 3060 Ti.

Near-instant model swaps via a pre-warmed standby pool, fully headless background workers (no stray console windows), runtime free-VRAM gating that prevents out-of-memory crashes when voice is resident, and the new bmrt command-line tool — all bundled in the installer.

int8 Orpheus voice delivers crisp audio on 8 GB GPUs, and Kokoro-82M TTS keeps low-VRAM nodes responsive.

Point your existing tools at your own GPU. A drop-in /v1 API for both OpenAI and Anthropic clients, plus fast embeddings served by a persistent worker.

Fused FMHA attention and chunked prefill unlock long prompts without blowing past memory.

Run larger models on less VRAM with W4A16-AWQ quantization (Qwen3-4B), tuned for both Ada and Ampere RTX cards.

On-device Whisper speech-to-text and a remote voice bridge — talk to your GPU from anywhere, with audio that never leaves your hardware.

The PyExecutor backend opens up a much broader catalog: Qwen 3 (0.6B / 1.7B / 4B) and DeepSeek-R1-Distill reasoning, all on a single GPU.

Paged KV-cache attention, multi-user concurrency (serve a whole household from one GPU), and per-model tuning controls.

Real-time multi-GPU transport status and peer-latency monitoring surfaced directly in the web UI.

Bring your own Hugging Face token, encrypted per user, to pull gated models.

2× faster generation via incremental KV-cache, async multi-GPU sync for tighter latency, and an 8K default context window.

Tensor parallelism over ordinary networking — run a 14 GB model split across two consumer cards on a home network.

Server-driven tensor-parallel engine builds and VRAM / KV-cache stability work for heterogeneous consumer GPUs.

Data-center-grade inference on the GPU you already own — no cloud, no API fees.