Skip to content
self.md

■ SIGNALS // RADAR SIGNAL

the tool caller got small enough to disappear

Needle 2 packages tool calling into a 14 MB local binary, moving the agent permission question into much smaller devices.

Published Updated Read 3 min
■ [!] ON THIS PAGE ▼

self.md radar — 2026-08-13

Needle 2 puts tool calling inside a 14 MB binary and says a full session stays around 28 MB of RAM. That is small enough for the agent question to leave the workstation and start showing up in the devices that were previously too boring to host it.

1. the tool caller got small enough to disappear

sources:

what happened:

Cactus Compute’s Needle 2 is a 45-million-parameter model for tool calls, device use, and structured extraction. Its model card describes a 14 MB engine, about 28 MB peak session RAM, local inference with no runtime network call, and support across phones, Raspberry Pi, WebAssembly, and small embedded hardware. The call interface is constrained by a byte-level grammar compiled from the declared schema; with a larger tool catalogue, its retrieval layer exposes only the five selected tools for a turn. The underlying paper argues that its attention-only architecture can stay close to matched transformer loss when the parameter budget is reallocated into depth, while paying most of the remaining cost on facts that must live in the weights.

the collision:

The useful change is not that another model fits on a cheap device. A system able to choose a tool is an actor at the edge of a room: thermostat, camera, accessibility aid, field tablet, whatever somebody decided to wire up. Schema-constrained output can stop malformed arguments; it does not answer who chose the tool, what it may touch, or whether the person nearby can see it act. As the model shrinks, the permission boundary has to become more visible, not less.

question left open:

What must an on-device tool caller show a person before “tiny enough to disappear” turns into “too ordinary to question”?

left on the table

  • Grok 4.6 has fresh long-running-agent claims and a published benchmark table, but the launch does not yet provide decision-grade evidence that those claims survive outside the vendor’s own harness.
  • Tailscale’s SQLite post is an unusually good recovery record: 19 corruptions, transaction replay, live tracing, and a 16-year-old race. It was cut because the lesson about logs and forensic visibility would repeat last week’s agent-log fieldnote rather than move the Radar.
  • Pi Agent Harness is a credible counterpoint because it states plainly that it has no built-in permission system, but it is an existing project rather than a fresh enough shift for today’s main slot.
on-device-ai tool-calling agent-boundaries