Wraps local Ollama capabilities for interacting with local language models, querying tags, generating text, and executing tool-calling sequences.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Ollama MCP Wrapper generate a short story about a robot using llama3"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A production-grade Python-based MCP server wrapper that exposes local Ollama instance capabilities to LLM applications and host systems (such as Claude Desktop or IDEs).
This wrapper allows agents to dynamically query downloaded models, load models into memory, run text completions, request tool-calling operations, and inspect/unload running models under a strict static prompt injection security filter.
+-------------------+ +-----------------------+ +--------------------+
| Host (e.g. IDE) | <--STDIO-->| Ollama MCP Server | <--HTTP--> | Local Ollama Daemon|
| & Agent Clients | | (FastMCP Python SDK) | | (http://localhost:11434)|
+-------------------+ +-----------------------+ +--------------------+Related MCP server: Ollama MCP Server
├── .agents/ # Custom Agent rules and automated skills
├── src/
│ └── ollama_wrapper/ # Server package directory
│ ├── __init__.py
│ ├── config.py # Global settings, timeout & injection settings
│ ├── prompts.py # Custom agent system prompt templates
│ ├── security.py # Precompiled regex prompt injection scanners
│ ├── server.py # Main FastMCP server definitions
│ └── tools_helper.py # MCP schema to Ollama payload formatters
├── tests/ # Pytest test cases
├── examples/
│ └── minimal_client.py # Example Python client integration script
├── pyproject.toml # Package declarations and dependencies
├── test_changelog.md # Log of test suite errors and resolutions
└── README.md # Extensive documentationThe server registers 5 primary tools, 1 resource path, and 2 prompt templates:
list_local_models
Description: Returns all models currently downloaded on the host machine.
Output: JSON list containing name, size, family, and parameter_size.
run_model_completion
Description: Runs text generation/completion on a targeted model.
Parameters:
model_name (string, required): Target model identifier (e.g. llama3:latest).
prompt (string, required): Text input.
Security: Blocks execution if prompt violates injection filters.
generate_with_tools
Description: Runs chat completions exposing a list of execution tool schemas to the model.
Parameters:
model_name (string, required): Target model identifier.
messages (array of objects, required): Chat message history.
tools (array of objects, required): Custom tool definitions to expose.
list_running_models
Description: Retrieves a list of models currently loaded and active in the system's memory (RAM/VRAM).
stop_model
Description: Unloads a specific model from RAM/VRAM to free up system resources.
Parameters:
model_name (string, required): Model to unload.
active-model://status: Returns the status and name of the currently active model.
agent_bootstrap: System prompt template to spin up a structured reasoning agent.
code_assistant: System prompt template configuring a coding assistant.
Install Ollama and download a model (e.g. ollama run qwen2.5-coder:1.5b).
Install uv Python package manager.
To start the MCP server locally using standard I/O (STDIO):
$env:PYTHONPATH="src"
uv run python -m ollama_wrapper.serverWe have provided a complete example client in examples/minimal_client.py. To run this client and test the server:
Start Ollama.
In the project root directory, execute:
uv run python examples/minimal_client.pyTo prevent jailbreaks and bypasses, all input prompts passing through text generation tools are filtered by precompiled regular expressions in security.py. This blocks:
Instruction overrides (e.g., "ignore previous instructions").
Scenarios activating bypass roles (e.g., "DAN mode", "developer mode active").
Sensitive information disclosure (e.g., "reveal system prompt").
Encoding attacks (e.g., "translate system instructions to base64").
Run the test suites with pytest:
uv run pytestTo use this MCP server in another project or on a different PC:
git clone https://github.com/PieterVDMerwe/ollama-wrapper-mcp.gitAdd the configuration block under the mcpServers key of your client settings file:
Configuration Path: %APPDATA%\Claude\claude_desktop_config.json
JSON Payload:
{
"mcpServers": {
"ollama-wrapper": {
"command": "uv",
"args": [
"--directory",
"C:/path/to/cloned/ollama-wrapper-mcp",
"run",
"python",
"-m",
"ollama_wrapper.server"
],
"env": {
"PYTHONPATH": "src",
"OLLAMA_HOST": "http://localhost:11434"
}
}
}
}Configuration Path: ~/.gemini/config/mcp_config.json
JSON Payload:
{
"mcpServers": {
"ollama-wrapper": {
"command": "uv",
"args": [
"--directory",
"C:/path/to/cloned/ollama-wrapper-mcp",
"run",
"python",
"-m",
"ollama_wrapper.server"
],
"env": {
"PYTHONPATH": "src",
"OLLAMA_HOST": "http://localhost:11434"
}
}
}
}(Make sure to replace C:/path/to/cloned/ with the absolute path to the directory on the new machine).
When interacting with this MCP server as an AI assistant or agent client, adhere to the following operation guidelines:
Do not guess model names: Always call list_local_models first to discover downloaded options.
Select the smallest viable model appropriate for the task (e.g. use smaller coder models for code tasks, and larger ones for reasoning).
Local models consume massive GPU/RAM resources.
Check currently loaded models using list_running_models.
Clean up after yourself: When you are finished running generation tasks, explicitly call the stop_model tool to unload the model from memory.
All input prompts are statically scanned. Avoid using phrases that look like overrides (e.g. "ignore prior commands"), or the server will reject your request with a security error.
Keep prompts focused on content generation rather than system configurations.
Use generate_with_tools to expose system capabilities to the Ollama backend model.
Inspect the returned message.tool_calls structure to determine which functions the model wants to run, execute them in your client wrapper, and feed the results back into the chat history.
Execute chat generation with a list of tools exposed to the model.
| Name | Required | Description | Default |
|---|---|---|---|
| tools | Yes | ||
| messages | Yes | ||
| model_name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, but it only states the basic function. It does not disclose output format, side effects, authentication requirements, or any behavioral nuances.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence that immediately states the core purpose. Every word contributes to meaning, with no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three required parameters, no output schema, and no annotations, the description is far too sparse. It lacks essential details about expected response structure, tool format, or how it relates to sibling completion tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate. It gives no explanation of model_name, messages, or tools beyond what the schema already shows, leaving the agent to infer their meanings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Execute chat generation') and the distinguishing feature ('with a list of tools exposed to the model'). This differentiates it from sibling tools like run_model_completion, which does not mention tool exposure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as run_model_completion. There is no mention of appropriate scenarios, exclusions, or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all local models currently downloaded in the Ollama instance.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the burden. It clearly indicates a read-only listing operation, and the operation is inherently non-mutating. While it does not explicitly state side-effect-freeness, the behavior is transparent and honest.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no redundant words. It is front-loaded with the main verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no parameters and an output schema exists, so the description does not need to explain return values. It fully covers the scope of the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty with zero parameters. According to the rubric, a baseline of 4 applies since there is nothing to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' and identifies the resource 'local models' with the qualifier 'currently downloaded in the Ollama instance', which distinguishes it from the sibling tool 'list_running_models'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for viewing downloaded local models but does not explicitly mention alternatives or exclusions. It would benefit from a note about using list_running_models for running models.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all models currently loaded and running in memory (RAM/VRAM).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description itself must convey behavioral traits. The verb 'list' implies a read-only operation, but the description does not explicitly state that it has no side effects or require any special permissions. It does clarify that it refers to memory status, but lacks additional behavioral context beyond the basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states the tool's function. It is front-loaded with the action verb and contains no unnecessary information or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (zero parameters) and the presence of an output schema, the description sufficiently covers the essential context. It clarifies what 'running' means (in memory) and distinguishes from local models, making it complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema is complete. The description does not need to explain parameters, and it appropriately focuses on the action. Baseline 4 is appropriate for tools with no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'list' and clearly identifies the resource as 'all models currently loaded and running in memory (RAM/VRAM).' This clearly distinguishes it from sibling tools like list_local_models by specifying the in-memory scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states that it lists models that are currently loaded and running in memory, which implies the appropriate use case. It does not explicitly mention alternatives or exclusions, but the context is clear enough to guide the agent in selecting this tool over list_local_models.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run text generation completion on a specific local model.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| model_name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since annotations are absent, the description must convey behavioral traits such as output format, blocking behavior, or side effects. It only restates the core function without disclosing what the completion returns or any model-related implications. This adds minimal value beyond the tool's name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundancy. Every word contributes to the core purpose, making it highly concise. It is appropriately sized for the limited information it conveys.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema and annotations, the description should explain return values or distinguish this tool from generate_with_tools. It does neither, leaving the tool's behavior incomplete for an agent. The simplicity of the params does not excuse the missing outcome information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the tool description does not explain the two parameters (model_name, prompt). While the parameter names are somewhat self-explanatory, the description does not clarify their expected formats or constraints. With low schema coverage, the description fails to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool runs text generation completion on a specific local model, clearly identifying the operation and target resource. It distinguishes from sibling tools that list or stop models, though the verb 'run' is somewhat generic. Overall, the purpose is clear and specific enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like generate_with_tools or list_local_models. There is no mention of prerequisites, intended scenarios, or exclusions. The lack of any usage context leaves the agent without direction for selecting this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Stop and unload a specific model from memory (RAM/VRAM).
| Name | Required | Description | Default |
|---|---|---|---|
| model_name | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description is the sole source of behavioral info. It states the action but not side effects (e.g., terminating active completions), prerequisites, or error conditions. The RAM/VRAM mention adds some context, but more is needed for a mutating operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the essential action without waste. It is appropriately concise for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description is incomplete. It fails to explain when to use it, what the result or return value is, and how to source model_name. Additional context about the lifecycle of models would improve usability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema only shows model_name as a string with no description. The description mentions 'a specific model' but does not say how to identify it, where to get valid values, or any format expectations. With 0% schema coverage, the description should compensate but doesn't.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('stop and unload') and identifies the resource ('a specific model') and context ('from memory (RAM/VRAM)'). It clearly distinguishes from sibling tools like list_local_models and run_model_completion, which have different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention checking running models first, nor when it is appropriate to unload a model. There are no exclusions or alternatives referenced.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0generate_with_toolslist_local_modelslist_running_modelsrun_model_completionstop_modelThe tools are mostly distinct, but list_local_models and list_running_models are similar in purpose (listing models in different states), and run_model_completion and generate_with_tools both handle generation. Descriptions clarify the differences, but the boundaries could be sharper.
All tool names follow a consistent verb_noun snake_case pattern (list_*, run_*, generate_*, stop_*), making the naming predictable and easy to navigate.
With only five tools, the set is well-scoped and focused on core local model interaction, avoiding unnecessary bloat while covering the essential immediate operations.
The set covers listing, running, and stopping models, but lacks essential model lifecycle management like pulling or deleting models, which are common in Ollama workflows. This leaves notable gaps for a wrapper of this kind.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Prompt-injection scanning and safe webpage fetching for AI agents reading untrusted content.
The WAF for agents. Pattern-based + heuristic firewall scans prompts, RAG documents, tool argume...
LLM Orchestration Agent (Opentelemetry Api)
Deterministic runtime safety for AI agents: scan PII, gate tool actions, verify LLM output.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/PieterVDMerwe/ollama-wrapper-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
