Nxyz PDF0.1.2Get the build
Processes while a document is open2
nxyz-pdfnetworkoutbound, only when you ask a model

The editor. Draws the window, keeps the undo history, and asks a model a question when you tell it to.

nxyz-pdf-workerholds your documentnetworknone

The engine. Opens, renders, edits and saves the PDF. Every untrusted byte in the document is parsed here.

sandboxed, one plane below the editor

the one channel between them

A Unix socket in the app’s own support directory, nothing else. The worker is handed its token on stdin, never on a command line, and every connection says who it is before it may ask for anything.

Sandbox audit7 allowed/7 denied

  2. The worker has no network at all. Not restricted to a host, not proxied — the socket call fails.

nxyz-pdf-worker --sandbox-self-test · every result matches what the profile promises

The process that reads your PDF has no network.

Download for macOS

0.1.2 · 7.5 MB · macOS 14+ · Apple silicon
notarized by Apple · updates itself from here

Nxyz PDF is a PDF editor for macOS with a real engine, not a viewer. Every untrusted byte of your document is parsed in the helper process above, which sandboxes itself before it accepts anything — and cannot open a socket to the internet at all. Not a restricted one. None.

Nothing leaves this Mac unless you ask it to.

Four things could send something, and here they all are. Two of them send nothing at all. Every one of them runs in the editor, never in the worker, because the worker has no network to run them with.

Built inNothingThe assistant quotes the pages it read. No model, no request, no key. This is what you get with nothing configured.
A model on your MacNothingOllama on 127.0.0.1. The provider refuses any address that is not loopback, and refuses to follow a redirect off it.
The update checkThe version you haveThe app asks this page whether there is a newer build, and sends nothing but the version it already is. It asks you on first launch whether to do that on its own, and says no until you say otherwise. An update installs only if it carries the signature matching the key inside the copy you are already running.
Your own Anthropic keyThe pages in the scope you pickYour key lives in your login keychain and nowhere else. The adapter accepts api.anthropic.com and nothing else, redirects included. The panel names what will be sent before you send it.

What it does

  • Open, render and search a document, including one with two thousand pages.
  • Highlight, note, ink, stamp and free text, each one undoable.
  • Fill AcroForm fields through PDFium's own form filler, so check states and appearances stay in step.
  • Reorder, rotate, delete, extract and merge pages inside the open document — the password, metadata, form and outlines survive it.
  • Export, save a copy, and recover unsaved work after a crash.
  • Answer questions about the document with quotes, and refuse to invent a page number.

What it does not

  • No OCR. A scanned page stays a picture, and the assistant says so rather than guessing.
  • No redaction. Drawing a black box over text does not remove it, and this app will not pretend otherwise.
  • No certificate signing, and signed files stay read-only except Save a Copy.
  • No content editing of text already in the page.
  • XFA forms are not filled. AcroForm fields are.
  • Two declared engine gaps: fields on merged-in pages are not added to the form's field list, and a deleted radio group can leave its selection behind. Both are written up rather than hidden.
  • No accounts, no subscription, no managed service. Bring your own key or run a model locally.

An AI client can edit the document you have open.

Point a client at the adapter inside the app. It reaches the document only after you turn on a grant for that one document, it must carry the revision it expects, and every change it proposes waits for you to apply it. Claude Code and the Claude desktop app are verified against it.

claude_desktop_config.json
{
  "mcpServers": {
    "nxyz-pdf": {
      "command": "/Applications/Nxyz PDF.app/Contents/MacOS/nxyz-pdf-mcp"
    }
  }
}

  • Cannot open or close a document

    Only you do that, in the app.

  • Cannot grant itself access

    The toggle is in the editor and nowhere else.

  • Cannot reach your recovery checkpoints

    Those methods are not on its list at all.

  • Cannot apply a change twice

    Every mutation carries an operation id and a revision.

Every number here was measured, on one Mac, and says so.

Open the document725 msno stated target—
Answer an edit296 msno stated target—
Send the first progress line of a long operation12 ms1,000 msmet
Acknowledge a cancel0.4 ms1,000 msmet
Reply to the cancelled command, document unchanged7 ms1,000 msmet

Taken on the development Mac with a debug build, on a 2,000-page document, not on reference hardware. A compatibility corpus of 81 synthetic fixtures round-trips through PDFium, PDFKit, pypdf: 70 supported files pass, 9 are refused exactly as declared, 2 are known gaps written up in the open, and 0 fail.

Get the alpha

Notarized by Apple and stapled, so it opens with a double click and no warning. Drag it to Applications. After that it keeps itself current: it checks this same page for a newer build, and installs one only if the update carries the signature that matches the key inside the copy you already have.

Download for macOS

0.1.2 · 7.5 MB · macOS 14+ · Apple silicon
notarized by Apple · updates itself from here

No account, no code, no email. The only thing recorded is that a download happened.

File
NxyzPDF-0.1.2.dmg
Size
7,509,766 bytes
SHA-256
d6f717a11137029730ff1456a58939be9a4b632db29c40c0bc821772f06eb1af
Apple notarization
notarized 2026-09-12
Signed by
Developer ID Application: SEYFI CEM BASKIN (L48Q3FQ8YB)
Engine
PDFium 154.0.8035.0, no V8
Requires
macOS 14 or later, Apple silicon

Verify it yourself before you open it: shasum -a 256 NxyzPDF-0.1.2.dmg

9 downloads counted. That is the whole record — no addresses, no emails, nothing tied to a person.