Box: a fork of Google AI Edge Gallery that bundles local LLMs, diffusion and speech on Android

What Box replaces, and for whom

Running a language model on a phone usually means either a cloud API call or a pile of separate apps: one for chat, one for transcription, one for image generation. Box collapses those into a single Android package. The README describes it as a fork of Google AI Edge Gallery, and the version badge records an upstream version of 1.0.15, so the lineage is explicit rather than implied. The repository topics list llamacpp, litert, gguf, rag, mcp-server, music-generation and visionai, which is a fair summary of the intended scope. The audience is narrow and identifiable: Android 14 or newer, hardware with an NPU or TPU that the app can address, and a preference for inference that never leaves the device. The README states the app runs a hard offline network mode, and the badge row lists SQLCipher with AES-256 alongside a biometric lock, so the privacy posture is enforced at the storage and network layers rather than promised in prose. If you are on Android 13 or below, this is not a candidate. If your workflow depends on a hosted model that improves every few weeks, a local suite is the wrong shape of tool entirely.

Two inference engines behind one interface

The engine badge reads LiteRT plus llama.cpp, and the GGUF badges for llama.cpp, stable-diffusion.cpp and whisper.cpp sit next to a LiteRT NPU badge. That combination tells you the architecture: LiteRT handles models converted for Google's runtime and can target the NPU or TPU, while llama.cpp handles GGUF files and, per the Vulkan badge, can offload to the GPU. The app therefore has at least two model-loading paths with different file formats and different hardware targets. Vision, document analysis over PDF and TXT, super-resolution upscaling, speech-to-speech voice mode, and music generation are listed as separate capabilities, each presumably backed by its own runtime or model family. The README names Bonsai, FLUX.2 klein and Z-Image for on-device diffusion, SenseVoice for multilingual speech recognition, and Supertonic for on-device text-to-speech. RAG and MCP server support appear as badges, which implies retrieval over local documents and some tool-calling surface, though the README excerpt does not describe how either is configured. That is a gap worth noting: the badge row asserts a feature set that the visible documentation does not explain.

Installing Box, and the APK split that catches people out

There is no build-from-source instruction in the supplied material. Distribution is via signed APKs from GitHub releases, with Obtainium as the recommended update path. The README gives the steps: open Obtainium, tap the plus button, paste https://github.com/jegly/Box, then set the APK filter regex. For the main build the regex is Main; for the custom ROM build it is custom-rom-support. After that, Obtainium detects future releases automatically. The README is explicit that users on LineageOS, GrapheneOS or CalyxOS should take the custom-rom-support APK, and the version table repeats the split: Main for stock Android on Pixel, Samsung and similar, Custom ROM for the no-Google-services cases. An in-app updater also exists under Settings, with Settings then Check for updates as the manual path. If you get the regex wrong you will either pull the wrong variant or pull nothing, and the failure will look like Obtainium being broken rather than a filter mismatch. The README also notes that as of v2.0.0 the in-app app version matches the Box release version, fixing an earlier mismatch where the UI showed the upstream Gallery build number 1.0.15 instead. That history matters if you are reading older forum posts about version confusion.

Hardware is the real gate, not the feature list

The badge row names Snapdragon NPU 8 Gen 2, 3 and Elite, Google Tensor G5 on Pixel 10, Tensor G6 on Pixel 11, MediaTek NPU, and Gemini Nano via ML Kit on NPU. Read that as a support matrix rather than a compatibility promise. NPU and TPU acceleration on Android is vendor-specific, and an app that lists four silicon families is telling you it has per-vendor code paths. Devices outside that list may still run GGUF models through llama.cpp on CPU or Vulkan GPU, but the accelerated path is what makes the suite practical for diffusion and speech, which are far heavier than text chat. The upstream version badge pinned at 1.0.15 suggests Box tracks a specific Gallery baseline rather than the current upstream head, so upstream fixes do not arrive automatically. Nothing in the supplied material states memory requirements for any model, which is the single most useful number a prospective user could have. You will have to determine model fit yourself before committing.

The licence field says NOASSERTION, and the README says Apache 2.0

The repository metadata reports NOASSERTION for the licence, while the README carries an Apache 2.0 badge linking to a LICENSE file. Those two signals disagree, and GitHub's NOASSERTION label means the licence could not be identified automatically from the file contents. That is a practical problem, not a technicality. If you intend to redistribute the APK, bundle it in a product, or reuse source from the repository, read the LICENSE file directly and confirm what it grants. The fork relationship adds a second layer: upstream Google AI Edge Gallery carries its own terms, and a fork does not erase them. None of this is legal advice; the point is that the automated licence signal is unreliable here and the human-readable one is a badge, which is not a licence text. For individual users installing an APK on a personal phone, the stakes are low. For anyone embedding Box in a shipped product, they are not.

Maintenance cadence and what upgrading costs you

Release dates in the supplied material cluster tightly: v3.3.4 on 2026-08-23, v3.3.5 on 2026-09-02, and 3.4.5 on 2026-09-03, with the last repository push on 2026-09-03. That is an active cadence, and it cuts both ways. Frequent releases mean fixes arrive quickly, and they also mean the Obtainium filter and the in-app updater are doing real work rather than being a convenience. Because the app ships model files separately from the APK, an app upgrade does not necessarily invalidate your downloaded models, but a runtime change to llama.cpp or LiteRT could affect how a given GGUF behaves. The README does not describe a model migration or compatibility policy. The version numbering is also slightly irregular: two releases use a v prefix and one does not, which is cosmetic but will matter if you script against release tags rather than the Obtainium filter. Budget for periodic re-testing of your specific models after upgrades rather than assuming continuity.

When a local suite loses to a served model

The obvious alternative is not another Android app but a server: run llama.cpp or vLLM on a machine you control and point a thin client at it. The difference is where the weights live and who pays for the compute. A served model can be larger than any phone can hold, can be swapped without reinstalling anything, and can be shared across devices and users. Box's advantage is the opposite property: the README's hard offline badge and SQLCipher storage mean prompts, documents and generated media stay on the handset, and the app works with no connectivity at all. That is a genuine constraint difference, not a preference. If your use case is a field worker transcribing interviews in a basement, or someone handling documents that cannot leave the device, the server approach fails on policy regardless of how good the model is. If your use case is batch summarisation of a large corpus, the phone fails on capacity. There is also a middle option worth naming: the upstream Google AI Edge Gallery, which Box forks. Choosing upstream means trading Box's added engines and privacy layers for a codebase closer to Google's own release track.

Editorial conclusion

Adopt Box if you have an Android 14+ device with a Snapdragon 8 Gen 2 or newer, a Tensor G5 or G6, or a MediaTek NPU, you want inference to stay on the handset, and you accept a fork whose licence file is not machine-readable. Do not adopt it if you are on older hardware, if you need a reproducible build from source rather than a signed APK, or if your models live in a serving stack you already operate. Verify first: which APK variant your ROM needs, whether the GGUF models you intend to load fit in your device's memory, and what the LICENSE file actually contains before you ship anything derived from it.

Official sources

1. Issues
2. jegly/Box on GitHub
3. Project website
4. README
5. Releases