Key Takeaways
- Created by Jeetu Maker; the GitHub repository shows no other human contributor
- The specification is at 1.0; the maker describes the implementation as pre-1.0
- No second host, independent audit or outside user base has been found
- The desktop app runs on macOS only; Windows and Linux are planned after 1.0
📍 In One Sentence
Snug Protocol defines how an AI-built app, the program that runs it and the user's data file work together, so that the app and its data can move between compatible programs.
💬 In Plain Terms
Think of an app that an assistant writes for you but that is saved as an ordinary file you control, instead of living inside the assistant's own service.
What Is Snug Protocol?
Snug is a protocol, not an AI model and not a single app. It describes how a small web app, a host program and an AI agent talk to each other and where the app's data is kept. The project's premise is that an app an AI assistant builds for you normally stays tied, with its data, to the platform that made it. The code is in the snug repository on GitHub.
- The app: a small, self-contained HTML app with its own interface and logic, built by an AI agent from a plain-language description
- The host: a program that runs the app in a sandbox and mediates its AI requests, storage and network access; the project ships two, a macOS app and a browser Playground
- The user file: one SQLite file ending in .snug that holds apps, their data, chats and settings, and that can be exported whole and moved between compatible hosts
How the Pieces Fit Together
Apps and the host exchange versioned JSON messages, called envelopes. The documentation calls the AI agent the app's "mind" and the app its "body": the app draws the screen and keeps the state, and the agent supplies intelligence when asked.
- Runtime AI: the host supplies the model while the app runs, so switching models does not mean rebuilding the app, according to the project
- Isolated storage: each app gets its own database namespace inside the user file
- The specification: six parts, covering the wire protocol, the portable user database, connected apps, runtime contracts and the app chat surface, linked-device connections, and conformance. This review did not examine the runtime contracts in detail
- For developers: the documentation has guides for building a host and for embedding Snug in another product; neither was tested here
Local and Hosted Models
The host chooses the model, so Snug can run on local or hosted inference. The download page says the macOS app needs either an Anthropic or OpenAI API key or a local OpenAI-compatible endpoint, and it names a local model served through Ollama as an option.
- Local path: an OpenAI-compatible local endpoint keeps inference on your own machine; no hardware or Ollama version requirement is published
- Hosted path: a cloud model receives whatever an app sends it for inference
- Credentials: keys are stored in your own .snug file and attached by your machine rather than by a Snug server, according to the download page
- Other services: the project's site says an app that reads a bank account still goes through an aggregator, so "no app backend" does not mean no external service
Security Design and Its Limits
Snug documents its security design in a public threat model, but that document is the project's own and no independent audit was found. The points below are what the document states, not what was tested.
- Sandbox: app iframes use
sandbox="allow-scripts"with an opaque origin and a content policy ofconnect-src 'none', so an app cannot open its own network connections - Credential custody: credential-shaped headers are refused at the protocol layer, and responses and errors are scrubbed before they reach the app
- Network ceiling: apps reach only hosts the user approved, redirects are not followed, and requests that change data need confirmation before a credential is read
- File protection: the user file is plaintext by default; AES-256-GCM encryption applies only when the user turns protection on
- Accepted risks: the document lists residual risks, among them that third parties' messages can reach an LLM when an app reads a messaging store, and that one integrity check catches a partial copy but not another process running as the same user
- Windows: the document records known defects on Windows, a platform the project does not ship
Get It
Snug's code is MIT-licensed and the project states no price for the macOS app, a universal .dmg for Apple silicon and Intel; the Playground runs in a browser.
Item | Where to get it |
|---|---|
| macOS app | Snug.dmg, version 0.1.3 |
| Browser Playground | playground.snugprotocol.org |
| Website | snugprotocol.org |
| Privacy policy | snugprotocol.org/privacy |
| Source code | GitHub, MIT |
| Specification | Spec 1.0 |
| Windows, Linux | Planned after 1.0 |
Verified on 17 October 2026: macOS app 0.1.3, released 5 September 2026; the repository itself was last updated on 15 October 2026. The download page states no price, no minimum macOS version and no signing details for the app. The project calls the Playground a demo that keeps data in the browser, not a private deployment.
How Mature Is It?
The specification is published and versioned, but the surrounding ecosystem is a single project. The repository was created on 31 July 2026.
Area | Finding |
|---|---|
| Specification | Version 1.0 published |
| Implementation | macOS app 0.1.3; pre-1.0 per the maker |
| Contributors | One human account, plus a dependency bot |
| GitHub activity | 2 stars, 0 forks, 11 open issues |
| Other hosts | None found beyond the project's own |
| Security audit | None found; threat model is self-published |
GitHub counts were read on 17 October 2026 and will change.
What We Could Not Verify
Everything above comes from the project's own documents and its GitHub pages. These points could not be confirmed.
- Hands-on behavior: PromptQuorum has not installed or run the macOS app or the Playground
- Adoption: no second host implementation and no third-party users were found
- Security: no independent audit or penetration test, and the long threat model was read only in part
- Project-reported claims: figures on savings or speed from the project's own material were not tested
- Portability in practice: the format is specified for moving between hosts, but no move between two independent hosts could be checked
What Could Hold It Back
These are open questions about any new portability layer, not findings about Snug specifically.
- Portability needs a second host. A portable file helps only when other developers build compatible hosts and keep the required behavior
- The host still matters. Models, integrations and device access come from the host, so the same app can behave differently on two of them
- A sandbox limits damage, not mistakes. A generated app can still produce wrong results
- Small local models. They may handle simple tasks and struggle with complex reasoning or specialised workflows
Who Should Look at Snug?
The question is whether an early protocol from one developer is worth following or trying.
Worth a look if you
- Want AI-built personal tools that you keep as a file you control
- Build AI products and want to study an embeddable design
- Run a Mac and are comfortable with pre-1.0 software
Wait if you
- Need Windows or Linux today
- Need independently audited security before connecting financial or other sensitive accounts
- Need a tool with a team behind it and a track record
Frequently Asked Questions
Can I try Snug without installing anything?
Yes. The browser Playground works as a demo, and the project says it keeps data in the browser and lets you export it, but it is not a private deployment.
Does Snug make my data fully private?
No claim of that kind is made. An app needs no backend of its own, but a hosted model sees what the app sends it and account connections can involve an intermediary.
Can I move a .snug file to another host?
The format is specified for that purpose, but the only hosts found so far are the project's own, so a move between independent implementations has not been shown.
Is Snug an industry standard?
No evidence supports that yet. It is better described as an emerging open protocol with one maintainer and a published 1.0 specification.
Can developers embed Snug in their own product?
The documentation includes guides for building a host and embedding Snug, and the repository publishes TypeScript packages; this review did not test them.