Download

Paste anything. Bolt handles it locally.

Free for individuals on macOS. No account needed, and it works offline.

Download for macOS

Apple Silicon · 160 MB v0.1.159

macOS Apple Silicon macOS Intel Windows Linux

or

Try demo mode, no install Sample data, nothing to configure
  • Notarized by Apple
  • EV code signing on Windows
  • Independently assessed under Google CASA

Verify it yourself Signed installers on GitHub

Other ways to install Homebrew, shell script, PowerShell

macOS, Homebrew

brew tap sparclehq/tap brew install --cask sparclehq/tap/bolt

Naming the cask in full trusts the tap as part of the install, so no separate brew trust step is needed.

macOS and Linux, shell script

curl -fsSL https://sparcle.app/install.sh | sh

Auto-detects the platform. Read it first at sparcle.app/install.sh.

Windows, PowerShell

irm https://sparcle.app/install.ps1 | iex

Read it first at sparcle.app/install.ps1. A winget package is planned.

On a managed laptop or a locked-down network?

  • You need IT approval first

    What leaves the endpoint, every permission Bolt asks for, how it is signed, and what we do not have yet, on one page written for a security reviewer. Send your IT team this page.

  • The download is blocked

    The exact hostnames Bolt needs, why each one, and the steps for Palo Alto, Zscaler, Umbrella, Netskope and Fortinet. Send your network team the allowlist.

Deploying for a team? The same app runs centrally deployed, governed and audited. See what your org gets ↓

For your organization

Deploy centrally for governance.

The paid org tiers are the same product, run inside your VPC or on-prem, with the controls IT and security need to make AI safe at scale.

Governance and audit

  • Every action signed with Ed25519 and chained with Merkle: Aeira queries, privileged admin actions, tool calls, LLM calls
  • Verify it offline with a standalone binary, so you do not have to trust us
  • Streams to Splunk, Microsoft Sentinel or syslog as it happens, or to your own forwarder as JSON
  • Per-tenant CMK envelopes, crypto-shred for right-to-erasure
  • SIG Lite, threat model, DPA and MSA drafts ready for security review

AI-DLP at the boundary

  • Detect, mask, tokenize and restore on our own local engine, on-device and at your org boundary
  • Masked before the LLM adapter is invoked, not after the fact
  • Internal tools still operate on unmasked values, so productivity does not regress. Results are re-masked on the way back
  • Remembered values pass the same chokepoint, so a stored identifier reaches the model as a token
  • 28 built-in policy packs, plus your own recognizers

Identity at the edge

  • SSO via Microsoft Entra, Okta, Google Workspace, OneLogin, Auth0 or any OIDC provider
  • SCIM 2.0 provisioning for joiner, mover and leaver
  • IDP-bound ACLs propagated to every query and every downstream tool call
  • No service-account fan-out: the user's identity is the authorization primitive end to end
  • Device trust is a first-class policy axis, so an untrusted endpoint gets a stricter rule (EDR and XDR adapters are on the roadmap)

Agent gateway and MCP hub

  • Your own OpenAI-compatible endpoint, so existing tools point at Bolt unchanged and inherit masking
  • Speaks A2A, ACP and MCP. Agent Gateway is live for Claude; other agent CLIs are on the roadmap
  • Admin-curated MCP connector catalog. Users get the integrations IT approved, nothing else
  • Per-tenant token vault with envelope encryption. Agent allowlist with capability scoping
  • Your own skills and agents ship as signed .boltpack bundles, verified before install

LLM control and cost

  • BYO LLM: Azure OpenAI, AWS Bedrock, Google Vertex, Anthropic, OpenAI, on-prem Llama, anything OpenAI-compatible
  • Zero token markup
  • Per-org, per-team and per-user token telemetry with dashboards
  • Model routing by sensitivity tier
  • Privacy-tier gating: no-train providers, on-prem-only models for regulated workloads

Self-hosted deployment

  • Docker compose (docker-compose.ha.yml) for single-host deployments
  • Helm chart for multi-node, HA and multi-cluster production scale
  • Runs inside your VPC, on-prem datacenter or cloud account
  • Air-gapped at the Federated Aeira tier
  • Sparcle has no inbound or outbound access to your deployment. Architecture designed for HIPAA, GDPR and DPDPA workflows
See pricing → Start with $5K Discovery → Architecture →

FAQ

Questions?

Do I need an account to use Bolt?

No. Bolt runs entirely on your machine with no login required to get started. Add an AI API key (or connect Google / Microsoft for full productivity), and start using it.

Is Bolt really free?

Yes, for individuals. Download, install, and use Bolt on your own device with no time limit. The paid tiers on the pricing page are for organizations that need central deployment, governance, audit, SCIM, and IT-managed installs.

What AI keys work?

Any OpenAI-compatible API: OpenAI, Anthropic, Google Gemini (has a free tier), Ollama (local), Groq, Together, or your own endpoint.

Does Bolt send my data anywhere?

No. Bolt runs fully on your device. AI requests go directly from your machine to your chosen provider; nothing routes through Sparcle.

How do I launch Bolt?

Press Cmd+Shift+K on macOS or Ctrl+Shift+K on Windows/Linux. Or configure your own shortcut. Bolt appears as a non-disruptive overlay on top of your focused app.

Can I connect Gmail, Calendar, Drive, Tasks, and Contacts?

Yes. Sign in with Google or Microsoft from the settings, and per-feature connect cards walk you through each scope on demand. Your data stays on this device; sensitive values are masked before any LLM call.

What is demo mode?

Bolt includes a one-click demo that loads sample data (emails, meetings, tasks) so you can explore everything instantly, no credentials needed. It resets when you quit the app.