Local mode keeps the control plane out
Muniment Desktop keeps account-free threads local by separating control-plane access, Pi provider credentials, process variables, and run records.
An account-free thread needs a local authority boundary, not just a signed-out screen. Our Muniment Desktop note draws that boundary through credentials, process variables, and records.
The thread does not borrow cloud authority
The signed-out screen offers Use local mode. That choice opens the thread surface without a Muniment account.
Local mode does not contact the Muniment control plane for authentication or model access. Pi runs on the device, and the desktop passes no Muniment virtual key to it.
A separate Sign in for cloud features action leaves local mode. Features that need the control plane retain their sign-in boundary.
Pi owns provider access
Open the sidebar’s Local mode section from the thread surface. Select Anthropic, Google, or OpenAI. Enter the key in Provider API key, then select Save key. The desktop writes the key to Pi’s ~/.pi/agent/auth.json store with Pi’s file lock.
Pi can also use provider credentials that the Pi CLI saved in the same store.
Local mode removes inherited provider credential and endpoint variables from the Pi process environment.
The run journal stays local
Local mode writes run input, model output, tool activity, and completion records to the local run journal. A completed local run records its elapsed time and no cloud receipt. These records use the same event shapes as cloud-backed runs.
The note establishes that record shape and local destination without claiming a public result.
No visitor can install Muniment Desktop today. This article therefore reports product behavior from our note, not a result that visitors can measure.
On 2026-09-05, the note moved provider access to the sidebar and added Anthropic and OpenAI.
The source is our Muniment Desktop docs/public-evidence/local-mode.md note pinned to commit c4a94196e60aae669399a13c363c21.
Local mode earns its name when credentials, process inputs, and run records stay on the local side of the control-plane boundary.