Features & how it works

Iron Rain is a native Apple (macOS + iOS) Agent Development Environment. It runs real coding agents on your Mac and lets you launch, watch, steer, and approve them from your Mac or iPhone, from anywhere — end-to-end encrypted, your hardware, your keys.

How it fits together

Two pieces: a native Apple app (macOS + iOS) and a lightweight Mac daemon. The daemon runs coding agents on your Mac, against your code, using your subscriptions and keys. The app connects to the daemon to start sessions, stream their work, steer them mid-run, review diffs, and approve sensitive tool calls — over the LAN at home and through an end-to-end-encrypted relay when you're away. Nothing runs in someone else's cloud. There is no per-seat compute and no middleman that can read your sessions.

Providers & models

The daemon auto-detects the agents you already have and lists them in the new-session picker. You pick a provider per session, and pick or switch the model inside it.

• opencode — driven over its HTTP/SSE API (the daemon auto-detects or starts a local opencode serve).
• claude-code — runs on your Claude subscription through a bundled Agent SDK sidecar; no API key to wire up.
• pi — driven over its JSONL protocol.
• Custom CLI agents — codex, gemini, aider and friends run as terminal agents when they're installed and signed in.

Model selection is per session: pick a model when you start, switch it mid-session, and configure provider-specific options. Iron Rain probes provider quotas and can hot-swap between multiple accounts when one is throttled.

An agent only works if its own tool is installed and authenticated. If a session fails to start, Iron Rain tells you why instead of doing nothing.

MCP servers

Model Context Protocol servers give agents extra tools — your issue tracker, your database, a browser. Iron Rain owns the registry so you configure a server once instead of once per agent.

• Import what you already have. Iron Rain reads the MCP servers your agents are already configured with (Claude Code’s project and user config, opencode’s) and offers them for import. Nothing is adopted automatically — a server definition is a command that will run with your credentials, so you confirm it.
• Supervised once. Enabled servers run behind a local gateway and are injected into every agent, so the same server isn’t started separately by each one with its own copy of your keys. Turn on exclusive mode and your agents stop loading their own MCP config entirely.
• Browse and install. Search the public MCP registry and add a server from a pre-filled form. Test any server to connect for real and see the tools it actually offers.
• Local and hosted. Both stdio servers and hosted HTTP endpoints, across both the current and previous protocol revisions.
• Credentials stay put. Server keys live on your Mac at owner-only permissions and are never sent to a client — the app shows which keys are set, never their values.

Remote & security model

Iron Rain works off your home network with zero setup, and the security model is the same wherever you are.

• End-to-end encrypted. The channel key is derived from X25519 ECDH between the app's and daemon's keypairs; traffic is sealed with ChaCha20-Poly1305. Only your paired devices can read a session.
• Stateless relay. When you're away, the daemon holds an outbound connection to a relay — Cloudflare Durable Objects as primary, Fly as fallback — that forwards only ciphertext. No inbound ports open on your Mac.
• Races LAN + relays. At home the app connects directly over the LAN for the lowest latency and falls back to the relay automatically when you leave. You never switch modes by hand.
• APNs push. Session events reach your phone even when the app is closed.

Sharing a session

Sharing is off by default: every device you’ve paired is yours and has full control. Turn it on when you want someone else to see what an agent is doing.

• Invites carry their own credential. A share link has its own secret and its own role, so inviting someone never means handing over the pairing secret for your Mac. Links expire and can be revoked, which un-links anyone who used them.
• Watch by default, steer by grant. A guest arrives watch-only. Granting them steering lets them prompt and interrupt, and it is revocable at any time. An invite can never grant ownership.
• Approvals stay with the owner. Someone steering can ask the agent to act, but only you authorize a tool call — those run with your credentials, on your machine. Every prompt and interrupt is attributed to whoever sent it.

Approvals & guardrails

When an agent wants to run a shell command, write a file, or push a commit, it pauses for you.

• Lock-screen approvals. A push arrives; tap through to approve or deny the tool call without unlocking into the app. The agent continues from exactly where it stopped.
• See what you’re approving. The card shows the tool’s real arguments, not a truncated summary.
• Scoped “always allow”. Saying always can mean this command shape (git status *), this folder, or this project — rather than a blanket yes to every shell call forever. Every standing rule is listed in one place and can be revoked; deny rules always beat allow rules.
• Session modes. Code is normal, Ask is read-only (edits and commands are refused), and Architect plans first. Modes are enforced by the daemon, so they apply to every agent equally — including the ones with no permission model of their own — and a standing allow rule cannot punch through a read-only mode.
• MCP tools obey the same rules. A tool call through an MCP server is gated by the same modes and rules as a native one, and is attributed to the session that made it.
• Spending guardrails. Set a cost budget per session; the run stops before it overspends. Live cost and token meters show spend as it happens.

Chat, tools & sub-agents

The chat surface is native, not a log tail.

• Native composer with slash-command keyboard completion, per-session drafts, autocorrect, and no smart-quotes when you're typing code.
• Streaming markdown and thinking rendered as it arrives.
• Rich inline tool cards — each tool call shows its command plus expandable output, consistently across opencode, claude-code, and pi.
• Collapsible sub-agents — delegated sub-agents stream their own work inline, so a fan-out or a delegated task reads as a nested thread you can expand.

Generative UI

Agents can render native UI inline instead of dumping text. Through the iron:ui skill — installed into each agent — a run can emit native tables, checklists, callouts, diffs, and tappable choices that appear directly in the conversation. It works across every harness, down to a plain CLI agent, so the same prompt gets a real interface no matter which provider ran it.

Tickets: Jira & Linear

Full two-way editing for both trackers, not just a read-only list.

• Edit assignee, labels, sprint or cycle, estimate, due date, and comments straight from the app.
• A real-status Kanban board with drag-drop transitions, ticket creation, and sprint / attachment handling.
• Issue → PR loops — turn an assigned issue into an agent session and land a pull request, with provider-aware "Open in" for Jira and Linear.

IDE & code surface

A native code surface scoped to the active session and project:

• Syntax-highlighted editor and a file tree.
• LSP — diagnostics, hover docs, go-to-definition, completion, and rename, powered by the language servers on your Mac.
• A native diff review you comment on to steer: leave a comment on a line and it goes back to the agent as a prompt. Correct a mistake without opening a terminal.

Orchestration

Run more than one agent, and keep long jobs on the rails.

• Parallel fan-out. Launch N agents on the same prompt in isolated worktrees, let them race, then keep one. When they finish you get a comparison built from what each agent says it did plus a real diffstat — no extra model call needed. Optionally ask for a recommendation: a fresh agent reads every attempt and suggests one, advisory only.
• Divided fan-out. Instead of racing the same prompt, give each agent its own subtask and run them in parallel, each on its own branch so they stay reviewable separately.
• Scoped sub-agents. Delegate a bounded piece of work to a sub-agent that streams back inline.
• Heartbeat. An autonomous supervisor nudges a session toward completion inside a cost budget, and stops it before problems compound.
• Checkpoints. Snapshot a worktree and roll back to it if a pass goes wrong.
• Loops. Recurring autonomous ticket workflows — watch for new to-do tickets and have an agent plan, build, and open a PR, hands-free.

Workspaces & remotes

• Cross-repo workspaces. Run one job across several repos in one coordinated flow, finishing with a PR per repo.
• Git worktrees give each session an isolated branch; worktrees now share node_modules instead of reinstalling per tree.
• SSH remotes. Run and inspect a worktree on a remote box, with port-forward, without leaving the app.
• Design Mode. An in-app browser element picker drops the selected element's HTML/CSS straight into your prompt.

Command Deck

Five destinations — Sessions, Loops, Fleet, Issues, and Activity — with a fleet dashboard that shows every session across every paired Mac, an activity feed and a "needs you" inbox for anything waiting on your approval or input, and a Cmd-K palette to jump anywhere.

Resilience & observability

• Write-ahead transcript so a session's history survives a crash or restart.
• No-response watchdog with self-heal that recovers a session when the agent stream drops mid-turn, plus one-tap session recovery.
• Cost and token meters and provider quota probing, with multi-account credential hot-swap when one account is throttled.

Privacy

Iron Rain runs entirely on your hardware and uses your own agent subscriptions and keys. The phone-to-Mac link is end-to-end encrypted, and there is no analytics or tracking by default. Optional diagnostics are scrubbed and strictly opt-in. Read the full privacy policy — it's short and plain-English.

Install

Mac (app + daemon), one line:

curl -fsSL https://howlerops.github.io/iron-rain/install.sh | sh

This installs the Iron Rain Mac app and daemon and launches the app. The app auto-starts the daemon, which auto-detects your installed agents and shows a pairing QR to scan from your phone.

iPhone / iPad: Iron Rain for iOS is in beta via TestFlight — see joining the TestFlight. For the full setup, pairing, remote access, and daemon CLI reference, see Support.

More questions? See Support or open an issue on GitHub.