Product method · current build 0.1.1

How Pelion Posture works

The short version

Pelion reads camera frames in memory on your Mac.

It derives posture angles and a relative estimated neck-load signal.

Each frame is then discarded. The estimate is not a diagnosis.

Optional local MCP exposes approved derived numbers to clients.

Camera pixels never cross that boundary.

Preview of the Pelion Posture on-device walkthrough
Preview the product flow, then watch the 50-second captioned walkthrough.
  • Frames stay on this Mac
  • Neck load is an estimate
  • All-day monitoring is free
  • MCP is local and opt-in
Three-step flow

Baseline, local analysis, understandable feedback

1. Calibrate

Sit upright for ten seconds. Pelion saves that pose as your personal baseline instead of assuming one textbook-perfect posture.

2. Monitor locally

The camera frame is analysed in memory on your Mac. Pelion derives angles and an estimated neck-load signal, then discards the frame.

3. Understand and adjust

The visible signal changes relative to your baseline. Use the direction and trend as feedback—not as a diagnosis or a direct force measurement.

Current product walkthrough

Calibration, local feedback and the MCP boundary

A 50-second silent, captioned walkthrough assembled from the current app UI, controlled synthetic MCP data and Pelion's original data-flow diagram. No face, personal posture reading or private prompt appears.
Original architecture diagram

Camera pixels stop before the optional MCP boundary

The diagram separates the app's visual input from the derived numbers that can be written locally. It also separates visible product feedback from MCP: ordinary posture monitoring does not require MCP, and MCP is off by default.

Pelion data flow: camera frame to on-device pose analysis and derived posture estimate; camera pixels stop before a local snapshot and optional stdio MCP connection to an approved client.

Equivalent text path

  1. A camera frame enters on-device pose analysis.
  2. The app derives posture angles and a relative neck-load estimate.
  3. One branch becomes visible feedback inside Pelion.
  4. Only while MCP is enabled, another branch writes one derived, image-free snapshot to a private local file.
  5. A client-launched stdio MCP process may read that file. It opens no listening port, and tuning changes remain pending until approved inside the app.
Estimate, not diagnosis

What Pelion measures—and what the number means

Pelion observes a camera-derived angle relative to the upright posture you calibrated. It then interpolates a load estimate from the angle values published by Hansraj (2014). The angle is an observation; the load is a model output. Neither tells Pelion why you are in that position or whether it causes pain.

Pelion posture signals and limits
SignalWhat it isImportant limit
Forward tiltDegrees from your calibrated upright baselineA camera-derived angle; accuracy depends on a visible side view and confidence gating.
Estimated neck loadA relative kilogram estimateInterpolated from the Hansraj (2014) angle-to-load model; not measured by a force sensor.
ConfidenceModel confidence for the current derived readingLow-confidence inputs are gated rather than presented as equally reliable.
Today summaryLocal monitored time, healthy percentage, peak and nudgesAggregated numbers stored on the Mac; no camera frames are retained.

See the interactive neck-load model and its research limitations. If you have persistent pain, weakness, numbness, balance changes or another worrying symptom, use appropriate clinical care rather than a posture app to investigate it.

Reproducible original data

Measured on the current public build

Observed result

On one Apple M5 Mac, five isolated repetitions completed with 0 failures across 25 fresh MCP processes. A current derived snapshot read had a 0.761 ms median and a 0.6722.497 ms full observed range. These local timings do not generalize to every Mac.

Environment

Mac17,2 · Apple M5 · 32 GiB · macOS 26.5.2 (25F84)

Protocol

5 pre-registered repetitions; fresh process for enabled, absent, disabled, stale and quit states; full range retained.

Network boundary

Maximum MCP-process socket count observed: 0. Timed on 2026-07-29.

Selected MCP response timings from five runs
Measured eventMedianFull observed range
Process start to initialize response16.186 ms median16.066–855.288 ms full observed range
Current derived snapshot read0.761 ms median0.672–2.497 ms full observed range
Today summary read0.191 ms median0.151–0.616 ms full observed range
Tuning request to pending response0.416 ms median0.354–1.089 ms full observed range

Download the complete normalized JSON dataset or CSV table. The fixed protocol SHA-256 is 22db7d94578f8eaeac684eeeeaa1f2861592a850cdf7d4cbb66efb806c467da1. All failures would remain in the result; there were none.

Optional local-agent boundary

What an MCP client can—and cannot—read

MCP is disabled until you turn it on. When enabled, the app rewrites one private local snapshot at most once a second. The bundled server reads that derived snapshot and responds to the client process over stdio. It does not receive a camera buffer.

Sanitized synthetic response

{
  "state": "watch",
  "neck_load_kg": 15.2,
  "neck_load_display": "15 kg",
  "forward_tilt_deg": 23,
  "confidence": 0.94,
  "updated_at": "<synthetic timestamp>"
}

The boundary in plain language

  • Derived numbers can cross; camera pixels cannot.
  • No listening port and no server-originated network request.
  • Stale readings are reported as unavailable, not current.
  • Tuning requests stay pending until you approve them.
MCP capability and privacy boundary
BoundaryCurrent factDetail
Resources7 local resourcesCurrent posture, today, fatigue, settings, derived frame, date buckets and config.
Readable dataDerived numbers and local summariesNo camera image, video stream, raw pixel buffer or remote history service.
TransportstdioThe client launches the executable. There is no listening network port.
Tuning changesPending user approvalA request appears in the app; the MCP server does not silently apply it.
Public binaryApple Silicon and IntelThe app and bundled MCP executable in version 0.1.1 both support Apple Silicon and Intel.

Use the MCP setup guide and complete resource/tool contract for client configuration and availability details.

Privacy, method and limitations

What this page demonstrates—and what it does not

Privacy boundary

The app's camera processing, website demo and optional MCP snapshot are separate boundaries. The Mac app also sends anonymous usage analytics by default unless you opt out; those events do not include images.

Read the complete privacy lifecycle →

What Pelion measured

The controlled experiment measured local MCP response boundaries against synthetic snapshots from the public signed artifact. It checked state handling, approval behavior and socket count.

What Pelion did not measure

No camera latency, CPU, memory, posture-model accuracy or clinical outcome was measured. One M5 Mac and five repetitions are not a benchmark for every machine.

Accessible text alternative

Video transcript

  1. How Pelion Posture works. All-day monitoring is free, and camera processing stays on your Mac.
  2. First, sit upright for ten seconds. That becomes your baseline, not a textbook-perfect spine.
  3. Pelion monitors locally and shows a relative estimated neck load. It cannot diagnose pain or injury.
  4. Moving forward changes the estimate; returning upright lowers it. These example values are synthetic.
  5. Camera images stop before MCP. Only derived posture can cross the optional local-agent boundary.
  6. MCP is off by default, uses standard input and output, and opens no listening port. This public MCP binary is Apple-Silicon-only.
  7. An agent can read derived numbers, not pixels. This is a controlled synthetic response.
  8. A tuning request waits for approval in the app. It is not silently applied, and Pro agent tools are not open yet.
  9. On one M5 Mac across five runs, the current snapshot read median was 0.761 milliseconds, with a 0.672 to 2.497 millisecond range. Process start to initialize had a 16.2 millisecond median and a 16.1 to 855.3 millisecond range. These local timings do not generalize to every machine.

Frequently asked questions

Does Pelion upload camera video?

No. The Mac app analyses each camera frame locally in memory, derives posture numbers and discards the frame. Camera images do not enter the MCP snapshot. The app does send anonymous usage analytics by default unless you switch that off, but those events never contain images.

Is all-day posture monitoring really free?

Yes. Real-time posture monitoring has no daily time limit in the free app. Pelion Pro is a separate Guard and Recovery layer that is not open yet; it is not required to keep monitoring all day.

Is Pelion a medical device?

No. Pelion is a posture-feedback tool, not a medical device. Its neck-load number is an estimate from a published model, not a clinical measurement, and it cannot diagnose pain, injury or disease.

Does the MCP server listen on a network port?

No. It uses local standard input and output. Your MCP client launches it as a process, and the server itself makes no network request or opens a listening port.

Can an AI agent directly change my Pelion settings?

Not silently. A supported tuning tool creates a pending request that you approve or reject inside Pelion. The Pro agent-behaviour tools are not open yet and return a structured error instead of changing anything.

All-day monitoring is free

Download without an account or daily monitoring limit. Then inspect the exact pricing, privacy, MCP, neck-load method and publisher facts behind the product.

Version 0.1.0 · macOS 14+