When you're deep in the AI agent game, you start noticing patterns. One of them? The tools you depend on are never quite yours. Developer Zandrey got tired of that asymmetry and built Recowork—a fully functional Claude Desktop alternative that puts control back where it belongs: on your own machine.

Why Build Your Own Desktop Agent

The inspiration came from genuine usage. "I like the Claude Desktop application and use it a lot, both for my work and in a personal capacity," Zandrey wrote. After GLM-5.2 dropped, curiosity took over. Could you replicate that agentic harness—chat, code execution, and something Zandrey calls 'Cowork'—from scratch? The answer, apparently, is yes. Recowork accepts a goal, plans the approach, calls tools, and chains steps together until the job is done. In one demo, it fetched Hacker News frontpage stories, sorted them by score, saved results to markdown, and drafted a Twitter thread—all from a single prompt.

Locking Agents in Boxes

Here's where things get interesting for anyone paranoid about AI safety on desktop. Zandrey implemented two distinct security layers. First: containers. Unlike the famously permissive OpenClaw setup, Recowork keeps agents sandboxed inside isolated environments—initially OrbStack, later migrated to Apple's container machines from WWDC'26. Second layer is an approval gate called canUseTool that intercepts every write and exec operation before it touches the filesystem. Users see exactly what command wants to run and can veto it on the spot. This isn't just security theater—it's how you actually keep a capable agent from wrecking your home directory when prompted wrong.

Apple's Container Machines Enter the Stack

The migration to Apple's native container runtime eliminated OrbStack as a dependency entirely, saving disk space without measurable performance impact according to Zandrey's informal testing. The catch? It requires macOS Golden Gate, which shipped at WWDC'26—so this is bleeding-edge territory for developers already upgraded to Apple's latest OS release.

GLM-5.2: Chinese Models Actually Deliver

The real surprise wasn't the infrastructure—it was the model economics. Zandrey ran "hundreds of threads" testing Recowork's capabilities against GLM-5.2 and saw roughly $1 in total spend. For comparison, Claude Code with Opus 4.8 handled most of the application development itself, but Zandrey is blunt about implications: "If you are poor, GLM-5.2 is a great choice for you. I am not poor...but it is still fascinating how effective Chinese models are." The model even demonstrated graceful recovery—attempting Python, discovering it wasn't available in the container, then switching to Node's BigInt to validate a 10,000-line Fibonacci sequence without missing a beat.

MCPs and Inference Providers on the Horizon

The Claude Agent SDK provides solid built-in tools out of the box, and Zandrey plans to extend functionality through Model Context Protocol integrations—though that work hasn't landed yet. For inference, Baseten handles routing. The choice wasn't accidental: Zandrey bought Philip Kiely's 'Inference Engineering' (Kiely works at Baseten), set up an account while reading, and found the experience solid enough to bet a production project on.

Key Takeaways

  • Recowork demonstrates that Claude Desktop-style agentic workflows are replicable with commodity tools and open-source components
  • Apple container machines from WWDC'26 provide viable Docker-free sandboxing for desktop AI agents
  • GLM-5.2's cost profile (~$1 per hundreds of tasks) makes Chinese inference providers genuinely competitive for high-volume workloads
  • Two-layer security—container isolation plus manual approval gates—is the minimum viable approach for secure local agents

The Bottom Line

This is exactly the kind of project that signals where AI tooling is heading: decentralized, self-hosted, and hackable. When a developer with decent but not exceptional resources can clone a flagship product's core functionality in their spare time, the writing's on the wall for vendors hoping to keep users locked into monthly subscriptions for capabilities you could run locally for pennies.