2026Built — internal infrastructure & unreleased
local-agent-mcp
An MCP server that lets Claude Code hand work to a model on your own machine — and a sandbox tight enough that letting it is reasonable.
- Role
- Sole author — design, implementation, tests
- Stack
- Python
- MCP
- Ollama
Status
Unreleased. The source is on GitHub.
Decisions
Resolve the path, don’t compare the string
Every path is resolved with realpath on both the base and the candidate, then compared with commonpath, so symlinks and ../ escapes are resolved before the check instead of after.
A hard three-turn cap
The agent loop is capped at three turns and returns control to the caller unconditionally, whether or not the local model thinks it is done.
A parsed allowlist, no shell
Commands are parsed instead of handed to a shell, and matched on the program rather than the raw string. That replaced a first version that glob-matched the whole command under shell=True, which let a chained command through.
What it cost
- Path resolution: slower than a prefix string check.
- Turn cap: a task that needs a fourth turn fails, and the caller has to split it.
- No shell: no pipes or redirects.