{"slug": "show-hn-krate-ai-made-apps-as-permissioned-files-for-mac-windows-and-linux", "title": "Show HN: Krate, AI-made apps as permissioned files for Mac, Windows, and Linux", "summary": "Krate, an open-source tool in pre-alpha, lets users create AI-generated apps packaged as single .krate files that run on Mac, Windows, and Linux with user-permissioned access. The tool, built by developer Incy Yash Raj, aims to simplify sharing small AI-made apps by bundling the app and its requested system access into one cross-platform file that shows permissions before execution.", "body_md": "**Make apps with AI. Share them like documents.**\n\nOne app file that opens on Mac, Windows, and Linux.\n\nThe user sees what it wants to access before it runs.\n\n[Website](https://incyashraj.github.io/krate/)\n·\n[Try Notes](https://incyashraj.github.io/krate/docs/try-krate-notes.html)\n·\n[Make an app](https://incyashraj.github.io/krate/docs/pages/make-an-app-with-ai.html)\n·\n[Docs](https://incyashraj.github.io/krate/docs/quickstart.html)\n·\n[Releases](https://github.com/incyashraj/krate/releases)\n·\n[Discussions](https://github.com/incyashraj/krate/discussions)\n\nAI can make useful small apps for one person or one team. Sharing those apps is still hard.\n\nA browser link cannot handle every local use case. A normal desktop app can, but it is tied to an operating system and may reach more of the computer than the user expects.\n\nKrate uses a simpler app format:\n\n- The app and the access it requests go into one\n`.krate`\n\nfile. - The same file opens on Mac, Windows, and Linux.\n- Krate shows the requested access before the app runs.\n- The app receives only the access the user allows.\n\n```\nrequest\n   ↓\nchecklist.krate\n   ↓\nreview access\n   ↓\nopen on Mac, Windows, or Linux\n```\n\nKrate is open source and currently in pre-alpha.\n\nInstall the command line tool on macOS or Linux:\n\n```\ncurl -fsSL https://raw.githubusercontent.com/incyashraj/krate/main/scripts/install.sh | sh\n```\n\nCheck the installation:\n\n```\nkrate --version\n```\n\nRun the public Notes app:\n\n```\nkrate run \\\n  https://github.com/incyashraj/krate/releases/download/notes-v0.1.0/notes.krate \\\n  --native-window \\\n  --prompt\n```\n\nKrate fetches the file, shows what it requests, and runs it with the access you approve.\n\nFor a guided walkthrough, use\n[Try Krate Notes](https://incyashraj.github.io/krate/docs/try-krate-notes.html).\n\nDownload the `krate-app`\n\nzip for your Mac from the\n[current release](https://github.com/incyashraj/krate/releases/tag/v0.1.0-rc4).\nUnzip `Krate.app`\n\n, then download\n[ notes.krate](https://github.com/incyashraj/krate/releases/download/notes-v0.1.0/notes.krate).\n\nThe current app is not signed. On first open:\n\n- Right-click\n`Krate.app`\n\n. - Choose\n**Open**. - Double-click\n`notes.krate`\n\n.\n\nThe macOS permission window appears before the Notes app runs.\n\nDownload the newest `x86_64-pc-windows-msvc.zip`\n\nfrom\n[Releases](https://github.com/incyashraj/krate/releases), extract\n`krate.exe`\n\n, and place its folder on your `PATH`\n\n.\n\nThen:\n\n```\nkrate --version\nkrate run https://github.com/incyashraj/krate/releases/download/notes-v0.1.0/notes.krate --native-window --prompt\n```\n\nWindows file association support is available through\n[ scripts/install-krate-desktop.ps1](/incyashraj/krate/blob/main/scripts/install-krate-desktop.ps1).\n\nAfter installing `krate`\n\n, register `.krate`\n\nfiles for your current user:\n\n```\ngit clone https://github.com/incyashraj/krate\ncd krate\nscripts/install-krate-desktop.sh\n```\n\nYou can then open a `.krate`\n\nfile from your file manager.\n\nThe current release includes `krate create`\n\n. It turns a supported request into\na complete `.krate`\n\nfile:\n\n```\nkrate create \\\n  \"Make a checklist app that saves locally\" \\\n  --output checklist.krate\n```\n\nKrate writes the app, builds it, checks what system features it uses, packages it, and confirms that denied access is blocked before writing the file.\n\nThe public release has two built-in examples:\n\n- a checklist app with local saving;\n- a command line word-frequency app.\n\nCreating an app currently needs Rust, the `wasm32-wasip1`\n\ntarget, and\n`cargo-component`\n\n. Check your machine with:\n\n```\nkrate doctor\n```\n\nThe full guide is\n[Make and share a Krate app](https://incyashraj.github.io/krate/docs/pages/make-an-app-with-ai.html).\n\nThe built-in examples prove the complete path, but an AI coding agent can write the app from your request instead. With Claude Code installed and signed in:\n\n```\nkrate create \\\n  \"A grocery list app called My Groceries\" \\\n  --agent claude \\\n  --output groceries.krate\n```\n\nKrate hands the request to the agent, then builds, checks, packages, and\nverifies exactly as with the built-in path — a broken app is caught, not\nshipped. For any other tool, `--author-cmd \"<your command>\"`\n\nis the lower-level\nseam; it receives:\n\n| Variable | Meaning |\n|---|---|\n`KRATE_REQUEST` |\nThe user's request |\n`KRATE_APP_NAME` |\nThe generated app name |\n`KRATE_APP_DIR` |\nThe folder where the agent writes the app |\n\nEverything after authoring stays the same. Krate builds the result, refuses imports outside the Krate interfaces, packages the app, and verifies its requested access.\n\nThe public release can also return output that AI tools and scripts can read:\n\n```\nkrate run app.krate --json --auto-grant\n```\n\nThe output follows the `krate.run.v1`\n\nschema.\n\nA `.krate`\n\nfile contains:\n\n- a WebAssembly component;\n- the app name and version;\n- the access the app requests;\n- the reason for each request.\n\nOpening the file does not grant access by itself. Krate creates a session from the user's decision and connects only the approved operations to the computer.\n\nExamples:\n\n`fs.read:notes/**`\n\ncan read only inside the`notes`\n\nfolder;`fs.write:checklist/**`\n\ncan write only inside the`checklist`\n\nfolder;- no network request works unless network access was declared and granted;\n- a downloaded app receives no extra access because it came from a URL.\n\nInspect an app without running it:\n\n```\nkrate run app.krate --dump-caps\n```\n\nRun it and review each request:\n\n```\nkrate run app.krate --prompt\n```\n\n| Capability | Current state |\n|---|---|\nOne `.krate` file |\nWorking |\n| Mac, Windows, and Linux execution | Working |\n| Desktop windows on all three systems | Working |\n| Text input, editing, selection, and local saving | Working |\n| File and network capabilities | Working |\n| Permission checks before app execution | Working |\nRun a `.krate` file from an HTTPS URL |\nWorking |\n| Create a supported app from a request | Working |\n| Let an external AI command author the app | Working |\n| JSON output for agents and scripts | Working |\n| Convert an existing native app automatically | Not available yet |\n| Public app cloud, discovery, identity, and updates | Planned |\n\nThe public CI runs the project on Linux, macOS, and Windows. See\n[CI](https://github.com/incyashraj/krate/actions/workflows/ci.yml) and the\n[current status](/incyashraj/krate/blob/main/STATUS.md) for exact evidence.\n\n| macOS | Windows | Linux | |\n|---|---|---|---|\nRuns `.krate` apps |\nYes | Yes | Yes |\n| Opens desktop windows | Yes | Yes | Yes |\n| Notes editing and saving | Yes | Yes | Yes |\n`.krate` file registration |\n`Krate.app` |\nRegistration script | Registration script |\nPermission review in `v0.1.0-rc4` |\nNative window | Terminal | Terminal |\n\nThe current macOS path uses AppKit controls. Windows and Linux use Krate's drawn widget path inside a native window.\n\nDevelopment has already improved the Linux no-terminal permission path, but\nthat change is not part of `v0.1.0-rc4`\n\n. Release claims in this README describe\nthe public release unless a section clearly says otherwise.\n\nKrate gives an app no access to the user's files or network by default. It can use only the access approved for the current run.\n\nThat boundary is useful, but it does not make every app bug-free or prove that every author is trustworthy.\n\nKrate is pre-alpha:\n\n- use it for testing your own apps and the published examples;\n- do not treat it as ready for hostile third-party code;\n- expect file formats and interfaces to change before version 1.0;\n- report security problems privately through\n[SECURITY.md](/incyashraj/krate/blob/main/SECURITY.md).\n\nRead the current\n[threat model](https://incyashraj.github.io/krate/docs/phase2/threat-model-v0-2.html)\nfor technical detail.\n\n- Krate does not convert an existing Swift, Electron, Tauri, or native app.\n- The built-in author currently creates a small supported set of applications.\n- A coding agent must use the current Krate APIs.\n- The public macOS app is not code-signed yet.\n- Permission review and desktop polish differ between operating systems.\n- Krate Cloud does not exist yet.\n- Signing, publisher identity, public discovery, managed updates, and a transparency log are planned work.\n\nThese limits are part of the product status, not hidden footnotes.\n\nA browser is the right answer for many applications.\n\nSome useful local apps need desktop windows, local files, keyboard shortcuts, devices, or operating system behavior that a browser cannot provide cleanly. Normal native apps can do those things, but sharing them means packaging for each system. The person opening one also has to trust code they did not write.\n\nKrate is for the space between those two choices.\n\nKrate is written in Rust and uses:\n\n[Wasmtime](https://wasmtime.dev/)to execute WebAssembly components;- the\n[WebAssembly Component Model](https://component-model.bytecodealliance.org/); - WIT interfaces for portable app behavior;\n- host adapters for macOS, Windows, and Linux;\n- a capability policy that checks every supported host operation.\n\nThe portability is how one file works across operating systems. The capability model is how the user controls what that file can reach.\n\n```\napps/       Sample apps and apps used to test Krate\ncrates/     Runtime, CLI, policy, adapters, authoring, and SDK code\ndocs/       Website, book, design records, and technical documentation\nPlan/       Current and future implementation plans\nscripts/    Build, install, test, evidence, and release tools\ntest/       Integration fixtures and cross-language tests\nwit/        Krate interface definitions\n```\n\nRequirements:\n\n- the Rust toolchain selected by\n`rust-toolchain.toml`\n\n; - Git;\n- platform build tools;\n`cargo-component`\n\nwhen building Krate apps.\n\n```\ngit clone https://github.com/incyashraj/krate\ncd krate\n\ncargo build --workspace\ncargo test --workspace\ncargo clippy --all-targets --all-features -- -D warnings\ncargo fmt --all -- --check\n```\n\nBuild the release CLI:\n\n```\ncargo build --release -p krate-cli\ntarget/release/krate --version\n```\n\n| Start here | Link |\n|---|---|\n| Plain guide for making an app |\n|\n\n[Try Krate Notes](https://incyashraj.github.io/krate/docs/try-krate-notes.html)[Quickstart](https://incyashraj.github.io/krate/docs/quickstart.html)[Vision](https://incyashraj.github.io/krate/docs/vision.html)[Roadmap](https://incyashraj.github.io/krate/docs/roadmap.html)[Build log](https://incyashraj.github.io/krate/docs/build-log.html)[Status](/incyashraj/krate/blob/main/STATUS.md)The immediate priority is external use:\n\n- watch new users install, create, open, and share an app;\n- repair the points where they get stuck;\n- expand the apps an AI agent can author;\n- make the permission experience clear on every operating system.\n\nLater work includes:\n\n- tools that help port existing source code to Krate interfaces;\n- signing and publisher identity;\n- Krate Cloud for publishing, finding, sharing, and updating apps;\n- organization policies and audit records;\n- more operating systems and device types.\n\nSee the full [roadmap](https://incyashraj.github.io/krate/docs/roadmap.html).\n\nContributions are welcome across code, documentation, design, examples, and testing.\n\nStart with:\n\nFor a larger change, open an issue or discussion before writing the full implementation.\n\n- Stage: pre-alpha\n- Current public release:\n`v0.1.0-rc4`\n\n- Company: Krate Labs\n- Maintainer:\n[Yashraj Pardeshi](https://github.com/incyashraj) - License: MIT OR Apache-2.0\n\nKrate was previously named Layer36. The rename is complete in the repository, commands, interfaces, and documentation.\n\nChoose either:\n\nContributions use the same dual license.\n\nKrate builds on work from the\n[Bytecode Alliance](https://bytecodealliance.org/),\n[Wasmtime](https://wasmtime.dev/), the Rust community, and the wider\nWebAssembly community.", "url": "https://wpnews.pro/news/show-hn-krate-ai-made-apps-as-permissioned-files-for-mac-windows-and-linux", "canonical_source": "https://github.com/incyashraj/krate", "published_at": "2026-07-28 05:53:57+00:00", "updated_at": "2026-07-28 06:22:32.932050+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-products"], "entities": ["Krate", "Incy Yash Raj", "Claude Code", "Rust"], "alternates": {"html": "https://wpnews.pro/news/show-hn-krate-ai-made-apps-as-permissioned-files-for-mac-windows-and-linux", "markdown": "https://wpnews.pro/news/show-hn-krate-ai-made-apps-as-permissioned-files-for-mac-windows-and-linux.md", "text": "https://wpnews.pro/news/show-hn-krate-ai-made-apps-as-permissioned-files-for-mac-windows-and-linux.txt", "jsonld": "https://wpnews.pro/news/show-hn-krate-ai-made-apps-as-permissioned-files-for-mac-windows-and-linux.jsonld"}}