Stop renting the compute
your users already own.

The shape

Compute comes to the app, outbound.

Your web app stays hosted. The user runs a daemon that connects out to your backend, claims only their own jobs, and runs them on whatever model they've got. There's nothing to open on their network — and jobs are typed data, never code.

   your web app  ──enqueue──▶  your backend  (@byollm/server)
                                      │
                                      │   your job queue — Supabase, Postgres, memory…
                                      ▼
   user's device  ──outbound poll──▶  claim ─▶ run locally ─▶ result
     (byollm)                                    │
                                          Ollama · MLX · claude CLI
  

For developers

A three-line integration.

Mount one route, point it at a store, and enqueue. You never see the user's model or credentials — you get a result back.

// app/api/byollm/[...route]/route.ts
import { createHandler } from "@byollm/server/next";
import { store } from "@/lib/byollm";

export const { POST } = createHandler({
  store,
  verificationUrl: "https://your-app.com/settings/runners",
});

// enqueue from anywhere in your app
const job = await app.enqueue({
  kind: "llm.generate",
  audience: "private",   // their device only
  owner: userId,
  payload: { prompt },
});

const { outcome } = await job.result({
  onNoRunner: promptUserToConnect,  // never hangs
});

A server is byollm-compatible when the conformance kit passes against it. That's the whole versioning story — no framework version to chase.

For users

One command. Your models. Your rules.

You decide what runs, and where. A local model means the prompt never leaves your machine; a service you already pay for means the job goes where you already send it, on your account. And byollm never holds your key.

Providers

Nineteen providers. Three ways to bring your own.

A provider is where a request goes; a model is which weights answer it. Providers are registry entries over one audited transport — adding one is a single line — and every one arrives with a cost class your config can't override.

Anthropic appears twice, in two cost classes — a platform key bills per token, a Claude plan covers one person's work. The axis asks who pays and under what terms, not which company answers.

Not listed? openai-http reaches anything OpenAI-compatible — its cost class is detected from where it points, and remote is never free.

The audience model

Share your GPU — safely, and only if you want to.

Every job carries an audience and every backend an offer scope. A job runs on a device only when both agree. Cost class comes from the protocol, not your config — point a backend at a remote endpoint and it is metered whatever you call it, because "free" is derived from where the request goes.

Security

Breakout isn't detected. It's impossible.

The daemon runs prompts on the owner's computer, so every payload is treated as hostile input. The design makes escape structurally impossible rather than trying to spot it.

We're precise about the boundary: BYOLLM makes breakout impossible; prompt injection — steering the model's words — is the model's problem, bounded here because the model has no tools and the output is inert. We don't promise more than we can keep.

Packages

Six small pieces.