Maximum privacy

Kato, fully local — inference via Ollama

Kato's memory files live on your Mac: the journal is on-device and encrypted at rest, and the memory itself is plain files you own. Their content is what travels. By default the distilling — turning raw observation into commitments and briefs — and the drafting that reads back your notes both run on a hosted Claude model, because that's where the quality is. What goes is secret-scrubbed, every call is in the egress ledger, and a sealed space is excluded from all of it.

If you want the distilling on your Mac too, Kato can run against a local model through Ollama. This is the maximum-privacy configuration. It is not the maximum-quality one — the honest numbers are below.

Setup

# 1. install Ollama and pull a model
brew install ollama
ollama pull qwen3.5:9b

Then tell Kato to use it. Which command you need depends on how you run Kato, and the difference matters: the menu-bar app is launched by macOS, not by your shell, so it does not inherit variables you export in Terminal.

The menu-bar app

Set the variables on your login session with launchctl, then restart Kato — quit it from the menu bar and open it again. Anything launched after this inherits them.

launchctl setenv KATO_OLLAMA 1
launchctl setenv KATO_OLLAMA_MODEL qwen3.5:9b

# quit Kato from the menu bar, then reopen it

Check it worked in the app itself: open the Kato menu and read the line under the title. It shows the source every call routes through — local (ollama · qwen3.5:9b) when the local brain is answering, thinking with Kato Pro when it is not. That line is read from the same precedence the calls use, so it cannot tell you a comfortable lie.

To go back to the hosted brain: launchctl unsetenv KATO_OLLAMA (and KATO_OLLAMA_MODEL), then restart Kato.

This does not survive a restart. launchctl setenv lives for the login session. To make it stick, add a login item that re-runs it — save this as ~/Library/LaunchAgents/com.installkato.env.plist and run launchctl load ~/Library/LaunchAgents/com.installkato.env.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"><dict>
  <key>Label</key><string>com.installkato.env</string>
  <key>ProgramArguments</key><array>
    <string>/bin/sh</string><string>-c</string>
    <string>launchctl setenv KATO_OLLAMA 1
launchctl setenv KATO_OLLAMA_MODEL qwen3.5:9b</string>
  </array>
  <key>RunAtLoad</key><true/>
</dict></plist>

The `kato` command line

A normal shell environment, so a prefix on the command is enough — no launchctl:

KATO_OLLAMA=1 KATO_OLLAMA_MODEL=qwen3.5:9b kato brief <workspace>

The knobs, exactly as the code reads them:

env var	meaning	default
`KATO_OLLAMA=1`	opt in to the Ollama provider (or set the model var; either enables it)	off
`KATO_OLLAMA_MODEL`	which pulled model to use	`llama3.2:3b`
`KATO_OLLAMA_HOST`	the Ollama server	`http://localhost:11434`

Ollama is strictly opt-in: without one of the first two vars set, Kato never constructs the provider at all.

One thing to know about precedence, and it is the most important line on this page. The real order is kato-hosted → anthropic → ollama → apple-fm (with your own key first if you prefer BYOK), and kato-hosted exists whenever your workspace holds a verified Kato Pro license. So Ollama is reached only when there is no hosted license and no Anthropic key.

Today a Kato Pro subscriber cannot switch the menu-bar app's brain to a local model. There is no Ollama control in the app, and a paid license wins the precedence before Ollama is ever considered. Two facts sit beside that, and neither is a workaround. The kato CLI has no hosted path at all — the app wires that seam at launch and the CLI never routes it — so the command form on this page runs local for anyone, subscriber or not. And if the hosted brain fails three times in a row, its circuit opens for about ten minutes and hosted leaves the running until it closes. We would rather say that than let you find it out after paying; a local-first preference is a product decision, not a setting we have hidden. The menu bar tells you the truth either way — the active source reads local (ollama · qwen3.5:9b) when the local brain is the one answering.

Thinking models (qwen3 and friends) reason out loud by default, which is slow and buys nothing for schema-following extraction. Kato sends think: false automatically — measured at 25s → 1.5s per call. Nothing to configure.

What to expect, honestly

We measure this instead of guessing. The 2026-08-04 eval — golden corpus, same referee as the hosted lanes:

67.8%

qwen3.5:9b's quality relative to hosted Haiku — the best local result we've measured, still below the 85% bar we hold for making local a default. Against Sonnet, which is what the shipping default actually runs, the same corpus puts it near 59%. Both numbers, both baselines named.

Concretely: expect more missed commitments, more misfiled items, and occasional schema slips that hosted Claude doesn't make. Local is the maximum-privacy trade, not the quality path. If the brief is how you run your day, hosted is still our recommendation. Either way your memory files stay on your Mac — what changes is where their content is read.

To re-run the eval on your own corpus and your own hardware:

kato eval-distill <workspace-dir> --stage golden|label|run|score|report

It reads real (redacted) blocks from your journal, runs local vs hosted side by side, and scores them — the same instrument that produced the number above.

What still leaves the Mac

With Ollama on localhost and no API key configured, two things egress to installkato.com:

Update check — fetches a signed updates/manifest.json. The request carries no identifiers: the bare URL, nothing else, and the manifest is Ed25519-verified against a key pinned in the app.
License refresh (Pro) — periodically re-verifies your subscription and picks up a fresh token. Sends only the current license token, nothing from memory.

There is a third, in every configuration including this one: the first time you record a call, Kato downloads the transcription model once from huggingface.co. After that it is on your disk and inference is local.

That's the whole list, and it's enforced mechanically, not by promise: CI runs an egress guard over the brain library (scripts/egress-guard.sh against scripts/egress-allowlist.txt), and only four files in that library may touch the network — the hosted adapter, the Anthropic adapter, the Ollama adapter and the eval harness. Update check and license refresh are pure seams inside the brain; the actual network call is injected from the app shell and lands in the same egress ledger as LLM calls.

One caveat worth naming: KATO_OLLAMA_HOST can point at a remote machine, so Kato treats the Ollama path as egress and guards it like any other. On the localhost default, "local" means local.