Unverified output delivered since the gate shipped: 0.00000000%

Agent infrastructure for work that runs without you. Run the skills already on your Mac, reach what you have already connected, and prove every result before it ships — from your first one-cent run to your ten-thousandth.

Download for macOS › Read a blocked run ›

macOS 14 and Apple silicon · your own Claude account · nothing hosted, nothing to sign up for

GmailAsanaTogglStripeLinkedInNotion GitHubFirefliesApify

One registry, two surfaces — whatever is already in your Claude Code config is already here

Everything it did last night. One screen per question the company asks of itself — and every one of them is a view over the same ledger, so nothing on screen is a second source of truth that can drift.

ComplexityFileEdit ViewWindowHelp Mon 06:45
The Complexity morning desk: the company's position, standing jobs and the day's decisions

The morning desk, on this machine, this morning. Not a mockup.

The runtime

A runtime for work that has to survive being unattended. Scheduled, permissioned, budgeted and gated — because an agent you cannot audit is an agent you cannot leave running.

FIG 0.1

It runs when you do not

Twenty lines of YAML and a cron expression, using the skills already on your machine. Five append-only ledgers record every tool call, friction row and dollar.

FIG 0.2

It proves, or it holds

Every cited URL is checked against the URLs the run actually retrieved — a record the agent cannot edit afterwards. A blocked run is a governed outcome, not a crash.

FIG 0.3

It spends your account

Unset is the default and it is a stop, not a degraded mode. Nothing ambient is ever used — a key left in a shell profile years ago cannot pick up the bill.

verify.ts · assertions

It wrote good prose. It was refused anyway. A model asked whether any of this is made up will invent the evidence that clears it — so every check here is a script, and every check states what it proves and what it cannot.

The verification gate screen, showing which runs were held and why
r-4471 · checks1 failed
✗
Citations. 1 of 3 URLs never appears in events.jsonl. Proves the page was never opened. Cannot prove the claim is false.
✓
File paths. Both cited paths exist on disk.
~
Numbers — advisory. A figure can be correctly derived and never appear verbatim, so this never blocks alone.

A gate that overclaims is how people learn to ignore it.

So the gate is mechanical on principle. It checks the citations against the run's own event log, checks that every cited path exists, and treats numbers as advisory because a number can be correctly derived and never appear verbatim. Then it reports both halves — what it proved, and what it could not.

Risk limits

Ten limits, marked before you wake up. Eight of them are breached right now, and the app says so on the way in.

A limit is not a dashboard tile — it is a number with a ceiling, marked daily at 06:15 whether anyone looks or not. Cost per delivered outcome sits in the same ledger, because a cheap run that had to be run again was never cheap.

The risk limits screen: ten limits with their current marks, breaches shown against each ceiling
The connectors screen listing every MCP server and Nango connection available to a run

Connectors

Set it in Claude Code or set it here. It does not matter which — there is one registry and both read and write it.

The store is Claude Code's own mcpServers map, so after a connector lands there is no "Complexity connector" and no "Claude Code connector" — there is a connector. That file is treated as precious: an atomic write on a freshly-read copy, verified afterwards, with a timestamped backup either way.

Who pays

We cannot mark up tokens we never touch. Every mode builds the subprocess environment by deleting every credential variable, then setting back only what you chose on purpose.

unset — default
Nobody. Nothing runs until you connect your own account. A stop, not a degraded mode.
subscription
Your Claude Pro or Max plan. Plan usage, not metered tokens.
api-key
The Anthropic Console account that owns the key.
bedrock / vertex
Your own AWS or GCP account.
gateway
Whatever your proxy does.

A job is twenty lines

Nothing to learn that you do not already know. It is the skill you already wrote, plus when to run it and what it may touch.

A job's allow / ask / deny compiles into the SDK's own rule set, evaluated before the permission mode and before any allow rule — a deny there cannot be overridden by any mode. Run headless, ask fails closed and writes a friction row rather than running silently.

~/.complexity/jobs/ensi-weekly.yaml
# Your real weekly digest, wired to a skill you already have.
prompt:  "/ensi-weekly — cover the last 7 days"
skills:  [ensi-weekly, ensi-report]
budget:  { max_usd: 2.50 }
permissions:
  allow: [Read, Grep, WebSearch, WebFetch]
  ask:   [Write, Edit, Bash]
  deny:  ["mcp__gmail-*__send_email"]
  on_ask: deny
verify:  { mode: assertions }
deliver: [local, "file:~/Desktop/ensi-weekly.md"]
schedule:{ cron: "0 7 * * 1", tz: Europe/Prague }

Channel assurance

Triage from a taxi. Land the decision at a desk. The iPhone app is not the Mac app made smaller — a channel carries rights, and the phone's are deliberately lower, which is exactly what makes it safe to answer from one.

Desktop
May land anything, including irreversible actions.
Terminal (stdio)
May land anything. No listener at all, which is why it is the default on the node holding your keychain.
Phone
Proposals only. A downgrade, not a refusal.
Quiet hours 22:00–07:00
Irreversible requests still wake you. Successful runs never notify — a notification you always ignore trains you to ignore the ones that matter.
6:45▮▮▮

Approval · outbound email

ensi-weekly wants to send the digest to 4 recipients.

ProposeDeny

Held at the gate

gate-demo cited a URL that never appears in events.jsonl.

Overnight

6 runs · 5 delivered · $2.71 · 1 held.

Risk limit · 78%

Client concentration is approaching its ceiling.

Known gaps

What it does not do yet.

Published, because a product that hides its gaps has not earned the sentence at the top of this page.

  • The scheduler is not driven from the app. It lives in the CLI core.
  • Task artifacts are not gated. The gate runs for jobs, not for the files a typed ask writes — a dashboard can be real, self-describing and still under-collected.
  • verify: claims is not wired. It reports unavailable rather than quietly downgrading to something weaker.
  • No approvals UI yet, so on_ask: prompt has nowhere to prompt.

One price for the instrument. Nothing for the intelligence — you already pay Anthropic, and credentials never reach the renderer, so there is no second cut to take.

Download for macOS › iPhone · TestFlight ›

npm i -g complexity · 0.1.0 · Apple silicon · 102 tests passing