nuroai

eliot-9b

README

License: apache-2.0

Why Eliot

Most language models are trained to chat. Eliot is trained to act.

Instead of seeing pixels, Eliot sees the same semantic surface that assistive technologies use on macOS: roles, labels, values, app names, and element IDs. That makes the model fast to prompt, easier to inspect, and much easier to wrap in deterministic safety logic than screenshot-only computer-use systems.

Eliot is especially tuned for Apple-platform workflows:

Table with columns: Capability, What it means
Capability	What it means
macOS Accessibility control	Operates through structured UI trees rather than raw screenshots.
One tool call per turn	Predictable agent loop for harnesses and product integrations.
Apple Silicon path	A separate MLX 4-bit build is available for resident local Mac use.
Harness-first safety	Destructive, external, credential, payment, network, and write actions must be intercepted by the runtime.
Local-first design	Built for assistants that can run close to user data instead of shipping every screen state to a remote service.

Model Lineage

text
Qwen/Qwen3.5-9B
  -> Eliot QLoRA v1.2
  -> merged BF16 checkpoint
  -> Eliot 9B

Eliot is fine-tuned from Qwen/Qwen3.5-9B using a Mac-agent dataset made from deterministic synthetic episodes, sanitized macOS Accessibility-tree contexts, and compatible replay data. The training target is structured tool use, confirmation behavior, failure recovery, and honest task completion inside a guarded desktop harness.

Downloads

Table with columns: Artifact, Repo, Best For
Artifact	Repo	Best For
Full BF16 checkpoint	`nuroai/eliot-9b`	GPU serving, vLLM, research, further conversion.
MLX 4-bit build	`nuroai/eliot-9b-mlx-4bit`	Apple Silicon Macs and local resident assistant use.

Download the full model:

bash
huggingface-cli download nuroai/eliot-9b --local-dir eliot-9b

Run the Apple Silicon build:

bash
pip install mlx-lm
mlx_lm.server --model nuroai/eliot-9b-mlx-4bit --port 8081 --host localhost

Serving With vLLM

bash
vllm serve nuroai/eliot-9b \
  --served-model-name eliot-9b \
  --max-model-len 32768 \
  --enable-auto-tool-choice \
  --tool-call-parser qwen3_coder \
  --reasoning-parser qwen3

The GH200/vLLM validation path served this merged checkpoint as BF16 with no quantization.

Transformers Quick Start

python
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "nuroai/eliot-9b"

tokenizer = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(
    model_id,
    torch_dtype=torch.bfloat16,
    device_map="auto",
)

messages = [
    {
        "role": "system",
        "content": "You are Eliot, an on-device computer-use agent. Respond with exactly one tool call per turn."
    },
    {
        "role": "user",
        "content": "TASK: Open Notes and create a note called Project Ideas.\nAPP: Finder\nUI:\n[1] menu item File\n[2] button Search\nRESULT: none"
    },
]

prompt = tokenizer.apply_chat_template(
    messages,
    tokenize=False,
    add_generation_prompt=True,
    enable_thinking=False,
)
inputs = tokenizer(prompt, return_tensors="pt").to(model.device)

with torch.no_grad():
    output = model.generate(**inputs, max_new_tokens=256, do_sample=False)

print(tokenizer.decode(output[0][inputs["input_ids"].shape[-1]:], skip_special_tokens=False))

Action Interface

Eliot is intended to be used with a harness that supplies the current task, frontmost app, Accessibility tree, and previous action result. The model then emits exactly one tool call.

Table with columns: Tool, Purpose
Tool	Purpose
`click`	Click, press, or select an accessible UI element.
`type`	Focus an element and replace or enter text.
`open_app`	Launch or foreground a macOS app.
`read`	Read accessible text or values.
`run_shell`	Use local shell only when allowed by policy.
`web_search`

The recommended system prompt is included as eliot_system_prompt.txt.

Evaluation Snapshot

Representative held-out MacBench and live-gate results from the v1.2 release process:

Table with columns: Check, Result
Check	Result
MacBench action match, BF16	97.7%
Destructive confirmation	100.0%
Abstention handling	100.0%
Error recovery	100.0%
Live destructive confirmation, shipping quantization	100.0%
Guarded destructive interception	100.0%
Benign over-ask, live held-out set	1 / 4

These numbers measure the model and reference harness on structured Mac-agent tasks. They are not a claim that the model can safely operate a computer without a deterministic safety layer.

Safety Model

Eliot is not the safety boundary.

The model is trained to ask before destructive actions, but real deployments must enforce policy outside the model. A production harness should intercept destructive, external, credential, payment, network, file-write, send, delete, and shell actions before execution. The reference Eliot/OpenSiri harness follows this design: the model proposes an action, the guard decides whether it can run, needs approval, or must be denied.

Do not deploy Eliot as an unguarded remote-control agent.

Intended Use

Eliot is intended for:

macOS assistant research and prototyping.
Local-first desktop automation.
Tool-calling and computer-use harness development.
Apple Silicon assistant experiments using the MLX 4-bit build.
Evaluation of Accessibility-tree-based agent interfaces.

Out-of-scope uses include stealth automation, credential extraction, unauthorized access, bypassing user consent, spam, payment automation without approval, or any deployment where user data is acted on without clear visibility and control.

License And Attribution

Eliot is released under Apache 2.0. The base model is Qwen/Qwen3.5-9B, also Apache 2.0.

Eliot is an independent project by Nuro AI Labs. It is designed for Apple-platform and macOS workflows, but it is not created by, endorsed by, sponsored by, or affiliated with Apple Inc.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Model Details

Model Provider