Your agent’s armored cockpit.
Sealed Apple Silicon.
Every TabTab node ships on brand-new Apple Silicon — pre-configured, Tailscale-joined, and SSH-disabled. Pick the anchor, the companion, or both.
Head to head.
Spec for spec.
Both machines run the same TabTabOS. Same brain. Different body.
The anchor.
Mac mini M4 Pro · 48 GB
Lives at the shop. Runs the director and heavy brains. Indexes the vault overnight. Active cooling for sustained inference.
Thermal sustenance
Active cooling allows sustained multi-hour inference runs — massive vector embeddings, overnight vault indexing — without thermal throttling.
Maximum compute density
No screen, no battery, no keyboard. Every gram is inference power. Ideal for running 30B+ parameter models at full context locally.
Always-on architecture
Designed for a closet or under a desk. Runs headless 24/7, SSH-disabled, Tailscale-only. The silent anchor of your org chart.
The companion.
MacBook Air M4 · 24 GB
Rides in the truck. Runs on-device agents. Syncs with the Bench over Tailscale. Battery lasts 18 hours.
Built-in UPS
The battery is an Uninterruptible Power Supply. If the office loses power, your agent stays online. 18 hours of inference without a wall outlet.
Hardware-level security
Touch ID and the Secure Enclave provide a physical hardware gate for credential management that a headless server cannot replicate.
Immediate interface
Built-in screen and keyboard for first-mile troubleshooting before the Tailscale tunnel is active. No Bluetooth pairing dance.
Whichever you pick, both units ship with the same defensive architecture.
The security "sandwich".
Four layers deep.
Every TabTab node ships with defense-in-depth security that eliminates the most common attack vectors in AI deployments.
Hardware seal
SSH disabled. No open ports. Tailscale loopback binding only. The node is invisible to the internet.
Dirty data protocol
Infrastructure email accounts isolate inbound data. Verified sender lists prevent prompt injection from malicious emails.
Bicameral architecture
The Steward handles strategy via SOUL.md. The Builder handles execution. They communicate through a strict JSON Synapse — no free-form LLM-to-LLM chatter.
Mesh encryption
WireGuard encryption via Tailscale. All node-to-node traffic is end-to-end encrypted. Zero data traverses the public internet.
The architecture spectrum.
Where TabTab sits.
- Full control
- No support
- Weeks of setup
- You are the sysadmin
- Pre-configured hardware
- White-glove onboarding
- Local-first, your data
- Sealed + supported
- Noisy neighbors
- Root password trust
- Latency to your files
- Monthly hosting fees
- Zero hardware
- Data leaves premises
- Per-token pricing
- Vendor lock-in