Poolside

You will choose this for one reason and get the rest as a bonus. The trait that decides it in daily use is that it meets you where you already work: a terminal agent, a desktop application and extensions for the editors your team actually has, so nobody is asked to change tools in order to adopt a policy. Inside a regulated shop, that is the difference between a rollout and a memo nobody reads.

Pick it when data residency is the constraint. Pick Claude Code if it is not, because you will find a livelier ecosystem and a simpler bill.

Look at what the protection depends on. Tool commands execute inside a container that requires a working local engine, and network restriction is applied by a proxy sitting beside it. Both are correct designs and both fail open in the ordinary ways: an engine that is not running, a policy that was never set, a proxy that is bypassed by a tool speaking a protocol it does not inspect. The dependency chain is longer than the marketing implies.

What it does right: web search and fetch are documented as what they are, and the row records no browser automation rather than implying it.

Two observations. 1. A company that trains models normally publishes numbers, and this one publishes none, so a reader has capability descriptions and no comparison against anything. That is not damning; it is unfalsifiable, which is a different and more frustrating condition. 2. The one quantitative claim is structural rather than performative: a one-million-token window on the flagship model against 256,000 on the two smaller ones.

A context figure is a specification and not a result. Anyone evaluating this should generate their own numbers, because the vendor has declined to supply the argument.

The strategy is coherent and expensive. Owning the model family removes the reseller problem that flattens margins across this category, and aiming at customers who require the software to run inside their own infrastructure targets exactly the buyers a frontier lab serves badly. That is a defensible position rather than a wrapper. Free platform access with preview models is the land grab that fills the top of that funnel.

The risk is burn against a slow enterprise sales cycle. Likely acquirer: a defence or infrastructure vendor buying the on-premises story. Position: strong for the regulated buyer, and watch the funding news more closely than the changelog.

This is the first row this quarter that answers my hardest question before I ask it: inference can be self-managed inside our infrastructure or fully air-gapped, on the orchestration platforms my team already runs, which means the data protection review is about our own network rather than a vendor's promises. Automation is covered too, with a documented unattended command and a supported continuous integration path.

What I do not have is a number, because enterprise pricing goes through sales, and the desktop client is macOS with Windows in beta. Approved with conditions: a self-managed deployment, a fixed-term price, and an SSO commitment in writing.

I did not expect to write this. The command-line tool is closed, which normally ends my interest, and then the weights turn out to be published under open licences, so the part that is genuinely hard to reproduce is the part they gave away. Documented guides cover running those models locally through Ollama or vLLM, and MCP servers attach as a client.

So a fork of the client is impossible and independence from the vendor's inference is documented, which is a stranger trade than it sounds and mostly a good one. I would run the weights and stay sceptical of the wrapper.