bigmac-mcp

A small MCP server that turns a shared Ollama box into a team resource for Claude Code (or any MCP client): typed grunt-work tools plus delegated read-only repo exploration that runs an agent loop on the box's local models — so bulk reading and first-pass analysis burn zero frontier tokens.

Claude Code (your subscription, untouched)
   │  MCP over streamable HTTP  (:8434/mcp)
   ▼
bigmac-mcp (this server, runs on the Ollama box)
   ├── ask / summarize / classify / models / usage ──► Ollama (localhost:11434)
   └── explore_start / explore_status / explore_result
          └── spawns `opencode run --agent explore` in a synced workspace:
              read-only file tools, step-capped, local model, cited synthesis

Tools

Related MCP server: mcp-local-llm

Delegated exploration

Jobs run OpenCode headless with a custom read-only agent (opencode.json): edit/bash/webfetch/external_directory denied, step cap, --dir jailed to the workspace, reasoningEffort: "none" so thinking models don't burn minutes per step. Results must cite file:line — treat them as a draft map and verify citations before relying on them.

Workspaces are plain directory snapshots under ~/delegate/workspaces/<name> (ship them with tar | ssh, rsync, or similar — by design the server never pulls from your VCS and holds no repo credentials). Snapshots auto-purge after 7 days; each job git inits the workspace if needed (OpenCode roots its jail at a VCS marker).

Run it

Requires uv and, for exploration, the OpenCode binary on PATH.

uv sync
uv run python -m bigmac_mcp.server     # streamable HTTP on 0.0.0.0:8434/mcp

Connect a client:

claude mcp add --transport http bigmac http://<host>:8434/mcp

Configuration (env vars): OLLAMA_URL (default http://localhost:11434), MCP_HOST/MCP_PORT (default 0.0.0.0:8434), DELEGATE_ROOT (default ~/delegate), OPENCODE_BIN, EXPLORE_WALL_SECONDS (default 900).

For production on macOS, run it as a LaunchDaemon (KeepAlive, logs + newsyslog rotation) — see com.bigmac.mcp.plist in our infra repo for the pattern.

⚠️ Security model — read this

The server has no authentication and binds all interfaces. It is designed for a trusted LAN/tailnet where everyone with network access is already trusted (in our case, the same people who hold the box's SSH key). Anyone who can reach the port can run generations and read synced workspaces. Do not expose it to untrusted networks; put a reverse proxy with auth in front if you need one.

Never sync secrets into workspaces — filter with .gitignore semantics plus a deny-list (.env*, *.pem, *.key, id_*, …) on the client side.

License

MIT — see LICENSE.