Skip to content
Agentmart
Submit a tool

local-workspace-server

Hardened loopback static server for local presentation drafts — capability-URL, read-only GET/HEAD, Host-header gate, nosniff + sandbox CSP.

Skill by sonichi

IndexedMIT★ 400
Write a review

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/sonichi-local-workspace-server

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Hardened loopback static server for local presentation drafts — capability-URL, read-only GET/HEAD, Host-header gate, nosniff + sandbox CSP. Use instead of a plain http.server when the Presentation panel's dev mode loads a local deck.

Use cases: presentations, backend

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools
No tools found
Secrets
None asked for
Install scripts
None found
Runs as
Python package

Network hosts it talks to 1

  • codeload.github.com · found in install command

Files it touches

  • ~/.claude/skills/local-workspace-server

What's inside

Skill name
local-workspace-server
Description
Hardened loopback static server for local presentation drafts — capability-URL, read-only GET/HEAD, Host-header gate, nosniff + sandbox CSP. Use instead of a plain http.server when the Presentation panel's dev mode loads a local deck.
License
MIT
Instructions
23 lines in SKILL.md · view on GitHub

Before installing

  • Ships executable scripts

Files (2)

  • SKILL.md
  • serve.py · scripts/

SKILL.md (first lines)

# Local workspace server

Serves ONE directory, read-only, to the trusted Presentation panel's dev mode.
Loopback binding is not treated as trust: the owner's hardening checklist
(2026-08-26) is the spec, and every guard is pinned in
`tests/local-workspace-server.test.py` over real HTTP.

```bash
python3 skills/local-workspace-server/scripts/serve.py --root <deck-dir> [--port 8899] [--ttl 3600]
```

Prints a capability URL (`http://127.0.0.1:<port>/<token>/`). Paste it into the
panel's device-local dev override — it never goes into room state (logical
`local_workspace` descriptors only; see the Presentation protocol thread).

Guards: 127.0.0.1 bind only · random capability path segment (constant-time
compare) · TTL expiry → 403 · GET/HEAD only, anything else 405 · no directory
listing · traversal-safe resolve containment · explicit MIME + nosniff ·
`sandbox allow-scripts` CSP on HTML · Host header must be loopback (DNS-
rebinding defense, computed from the BOUND port) · no-store caching · stdout
logging only.

From sonichi/sutando, MIT.

More from sonichi/sutando

Signals

Stars
400
Forks
98
Open issues
1,202
Last commit (this folder)
Aug 26, 2026 (2 months ago)
Last release
Aug 20, 2026 (2 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License
MIT
Repository
github.com/sonichi/sutando
Website
sutando.ai
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
GitHubgithub-graphql

More from sonichi

Cite this page

local-workspace-server skill. Agent Mart. https://agentmart.dev/skills/sonichi-local-workspace-server (last updated 2026-10-24)