Keep Qwen Code Local macOS Guide
Run Qwen Code against a model on your Mac and keep the whole coding session on that Mac. This guide picks a model host, sets up the controls that stop background reporting, cloud fallback, and unreviewed tools, and verifies that only the reviewed local paths stay open. Choose a strict, controlled-tool, or trusted-automation profile to match how strict you need each session to be.
Outcome: a private local model workflow with normal coding tools still workingIntroduction
This is a standalone macOS implementation guide. It uses the Qwen Code controls, Apple Silicon launcher design, authenticated local proxy, capability-preserving Seatbelt profile, focused tests, and model-host guidance described in this report. Read the evidence status and risk model first, then choose a host in section 1 and an operating profile in section 2.
Qwen Code is an open-source terminal coding assistant. It can read and edit a project, run commands under the selected approval policy, and ask a language model for help. A model host is the separate program, such as Ollama or LM Studio, that loads the model and gives Qwen Code a local API address. This edition covers both hosts.
A model stored on your Mac does not automatically make the whole session private. The assistant can still report usage, check for updates, inherit cloud credentials, load external tools, record prompts, or launch child processes that open their own connections. This guide treats the assistant, host, launcher, tool brokers, temporary files, and macOS boundary as one system.
One model route
Accept one loopback endpoint and refuse cloud-provider fallbacks.
No routine reporting
Disable usage statistics, telemetry, prompt logs, chat records, and request logs.
Controlled tools
Admit reviewed MCP servers and browser capabilities through exact, session-scoped broker routes.
Clean exit
Own the model host, proxies, brokers, browser profiles, and private temporary directory until shutdown.
Evidence and Validation Status
This edition documents a reference implementation that was exercised end to end. It still requires validation on the Mac where it will run.
| Area | Status | How to read it |
|---|---|---|
| Qwen and source-hardened Ollama | The documented path includes source references, a launcher, the macOS containment profile, focused tests, and exercised local and broker workflows. | Use it as a reference implementation, then repeat the source, route, process, logging, network, and cleanup checks on the target Mac. |
| Standard Ollama | Configuration and acceptance guidance are included, but the installed release and its helpers remain separate trust boundaries. | Validate the exact release, settings, listeners, credentials, logs, and outbound behavior. |
| LM Studio | Compatibility guidance for a closed-source model-host process. | Validate the exact version, model, server, authentication, logs, helpers, and network behavior. |
The technical appendix keeps the reference values and evidence limits. They describe the reviewed starting point, not a guarantee about another Mac.
Why a Local Model Is Not Enough
A model that runs on your computer still shares that computer with the coding agent, the program that serves the model, optional add-on tools, updater services, log files, credentials, and every command the agent launches. Any one of those can send information off the machine while the model itself stays local. Keeping the session private is a full-system job, not a single model choice.
Three moving parts do most of the work in every setup here, and they will keep coming up:
- Model host. The program that loads the model file into memory and answers requests over a small local API. Ollama and LM Studio are the two hosts covered in this report.
- Coding agent. Qwen Code itself: the terminal program that reads your prompt, calls the model host, runs shell commands, and edits files.
- Boundary. The combination of operating-system firewall, sandbox, credentials, and file-access rules that keeps the agent from reaching places it should not go.
The layers most people count on for privacy each protect something, and each leave gaps. The gaps are the reason this report exists.
| Layer | What it protects | What it does not protect |
|---|---|---|
| Private repository | Limits who can retrieve the repository from its remote host. | It does not make every branch, dependency, instruction file, or saved credential safe. |
| Local model | Keeps inference and prompts on the computer when the route is truly local. | It does not control the coding agent, shell commands, add-on tools, browsers, or updates. |
| Strict private profile | A starting configuration that blocks unreviewed repository instructions, hooks, extensions, skills, and unapproved third-party tool servers from loading on their own. | It does not, by itself, restrict file access or network access. Those need separate operating-system controls. |
| Network and file limits | Restrict where the process can connect, what it can read, and what it can change. | They do not decide whether an action still needs human approval. |
| Approval mode | Controls when a person must confirm a tool action. | Automatic approval does not create a network or file boundary. |
- read and send SSH keys, access tokens, source code, and personal documents;
- copy secrets into repository files, terminal output, prompts, logs, or browser requests;
- use saved GitHub or cloud credentials to act as the signed-in user;
- create harmful commits or pushes;
- delete or overwrite files the account can change; and
- hide malicious changes in dependencies, scripts, source files, or build output.
A browser or an add-on tool with internet access is another exit path. Any such tool needs its own allowlist of destinations, its own temporary profile, its own session credential, its own action approval, and its own cleanup step.
A private repository lowers the chance of hostile instructions arriving, but it cannot eliminate a compromised dependency, a malicious branch, a copied instruction file, an old hook, a stolen credential, an instruction hidden inside a webpage, or the agent misunderstanding an honest request.