The challenge
What the system needed to solve
Give a local model enough tools to perform real engineering work without exposing a privileged control plane to the LAN or internet.
The build
Engineering decisions
01
Configured a persistent local agent service with scoped access to the homelab repository, terminal, GitHub, Kubernetes, and a managed browser.
02
Bound the administration interface to loopback and documented the boundary between model inference, tool execution, and operator approval.
03
Integrated the official Penpot MCP service for direct access to the active design workspace.
04
Ran acceptance tasks that required reading code, querying source control, inspecting the cluster, and using browser automation together.
Architecture
How the pieces connect
- 1Local operator
- 2Loopback agent controller
- 3Local Ollama model
- 4Scoped repository/terminal/browser/MCP tools
- 5Auditable target systems
Results
What changed
- A private model can complete multi-tool maintenance and development tasks with repository context.
- Browser and design access are reusable capabilities rather than one-off scripts.
- Privilege boundaries and failure recovery are documented alongside the workstation setup.