ModelDeck

One menu bar icon that always knows how much Claude Code and Codex you have left.

A native macOS menu bar app + local daemon that tracks usage limits across all of your Claude Code and Codex CLI accounts — live "% left" meters, reset countdowns, and optional account switching.

Local-first. No cloud backend. No telemetry. Your provider credentials are never copied, stored, or transmitted by ModelDeck. The only secrets ModelDeck creates are its own local Keychain items — the token that guards the daemon's API and, if you use the managed proxy, a client key per profile — and they contain nothing of yours. The only optional outbound calls of ModelDeck's own are the daily update check (reads this repository's public releases feed) and the update download you approve (fetches the release asset) — update checks are off unless you enable them.

Download · modeldeck.ai

All screenshots show a demo-seeded instance with placeholder accounts.

Why

If you run AI coding agents seriously, you probably don't have one account — you have a work Claude Max plan, a personal Pro plan, a Codex subscription, maybe a spare for side projects. Each one has its own 5-hour session window, weekly limit, and model-scoped caps, all resetting on different clocks.

Today the only way to know where you stand is to interrupt what you're doing and check each account by hand — usually right after an agent run dies mid-task because a limit you forgot about ran out.

ModelDeck puts all of it in your menu bar:

• See every limit at once. Every account, every window (5-hour session, weekly, model-scoped like "Weekly · Fable"), as a live "% left" meter with its next reset time.
• Get warned before you hit the wall. The menu bar icon shows a gold percentage when any account drops below your threshold, red when critical, and a macOS notification fires exactly once at the crossing — no nagging.
• Account switching is offered when you add a second login — with one login per provider, ModelDeck never touches that provider’s home folder.

Features

• Multi-account usage deck — a popover with one card per account: worst-window headline bar, plan tier ("Max (20x)", "Pro"), and expandable detail rows for every rate-limit window with right-aligned reset times ("Resets Wed 5:59 PM PDT") in your time zone.
• Both providers, side by side — Claude Code and Codex CLI columns with their brand marks, or a single-column layout if you prefer. Sort by next reset, lowest remaining, or provider.
• Model-scoped weekly limits — per-model caps are parsed and shown as first-class meters, not buried in a tooltip.
• Account activation with honest states — each provider has one active account for new terminal sessions. Activation atomically swaps isolated per-account profile homes, then verifies the result and reports it truthfully (effective / identity-mismatch / identity-unverified) instead of assuming success. Running sessions are never stopped, logged out, or touched.
• Duplicate-token warning — if two accounts of either provider end up sharing the same credential (a missed /login ceremony, a copied profile), the deck flags them with a warning marker and banner instead of silently counting the same limit twice.
• Isolated profile homes — every account lives in its own owner-only config home (CLAUDE_CONFIG_DIR / CODEX_HOME), macOS Keychain-aware, so identities never bleed into each other.
• Transition-only notifications — a banner when an account crosses your remaining-% threshold, silence otherwise. Thresholds configurable.
• Menu bar at-a-glance state — plain glyph when healthy, gold "% left" beside it when anything is low, red at critical, back to plain on recovery. Or pin one account (or "the active account") from Settings or a card's right-click menu and its percentage stays in the menu bar continuously.
• Guided add-account flow — three steps: name it, sign in through the provider's own browser login, confirm the identity ModelDeck read back. ModelDeck never sees your password or token.
• CLI health — installed vs. latest versions of Claude Code and Codex CLI, with auth-state chips per account ("Healthy" / "Sign in again").
• Launch at login and one-click updates — start with your Mac, and optionally check the public releases feed daily for new versions. When one is found, Update Now downloads, verifies (EdDSA + Apple signature), installs, and relaunches in one click; an "Install updates automatically" toggle (on by default once checks are enabled) installs quietly on the next relaunch instead. Turn checks off and ModelDeck never phones out.

Privacy: local-first, by design

This is the point of the tool, so it's worth being explicit:

Install

Requirements: macOS 14+ and the Claude Code and/or Codex CLIs you want to track. (Node.js is only needed if you build from source.)

1. Download the app

Get the latest signed, notarized DMG from the Releases page, open it, and drag ModelDeck to Applications.

2. Launch it

The DMG is self-contained: on first launch ModelDeck asks your consent to register its bundled background service (the local daemon that does the actual usage reads, listening on 127.0.0.1:3867 only) and sets up its Keychain token — one approval, no Terminal.

3. Add accounts

Open Settings → Accounts → Add Account and follow the three-step flow for each account — e.g. "Work", "Personal", "Side Project". Each gets its own isolated profile home and signs in through the provider's own login flow.

Uninstall

Removing the app keeps its data for a reinstall. Optional data deletion below also removes managed profile homes and their sign-ins. Quit provider sessions first and keep a backup of any profiles you want to retain.

If you installed the DMG

1. Quit ModelDeck (menu bar icon → right-click → Quit ModelDeck).
2. Drag ModelDeck from Applications to the Trash. The background service and the launch-at-login entry live inside the app bundle, so removing the app removes them too — no Terminal needed.
3. Optionally, delete the data ModelDeck kept (skip this if you might reinstall — it's what makes a reinstall pick up where you left off):
   • ~/Library/Application Support/ModelDeck — settings, usage history, and isolated per-account profile homes, including codex-profiles and its migration backups. Deleting it removes those managed sign-ins; activation symlinks such as ~/.codex may then point at a missing home. The migration leaves the empty ~/.codex-profiles directory for you to remove. If you use MODELDECK_DATA_DIR, MODELDECK_DB_PATH, or MODELDECK_CODEX_PROFILES_DIR, remove those configured locations instead.
   • ~/Library/Preferences/app.modeldeck.mac.plist, ~/Library/Caches/app.modeldeck.mac, and (if you ever ran the from-source launch agent) ~/Library/LaunchAgents/ai.hermes.modeldeck.plist.

If you installed via Homebrew

brew uninstall modeldeck

removes the app and leaves your data in place for a reinstall. To delete the data as well (same caveat about managed account profiles as above):

brew uninstall --zap modeldeck

Keychain items (both install methods)

Neither the Trash nor --zap can remove Keychain items, so two kinds may remain — both are ModelDeck's own locally generated secrets, containing nothing of yours. Open Keychain Access, search for modeldeck and cli-proxy-api-client, and delete what turns up; or from Terminal:

security delete-generic-password -s modeldeck -a mutation-token

The cli-proxy-api-client.* items exist only if you used the managed proxy feature, one per profile; delete each with security delete-generic-password -s "cli-proxy-api-client.<profile>" -a "".

How it works

flowchart LR
    A["Menu bar app<br/>(Swift