AI tooling, fenced in
Giving an AI assistant access to your bank account is a bad idea, right up until you decide what it is physically incapable of doing. These are four servers that hand a model real access to money, mail, and engineering tools, each one built so the dangerous action is impossible rather than merely discouraged.
- Role
- Architect & director
- Status
- In daily use
- Servers
- Four
- Runs on
- Local hardware only
The shared idea
An assistant that can only talk is safe and not very useful. An assistant with real access is useful and, done carelessly, alarming. The way out is not a carefully worded instruction telling the model to behave. It is an interface where the harmful operation does not exist.
Do not ask the model to refrain from doing the dangerous thing. Build the tool so the dangerous thing has no code path.
A prompt is a request. A missing method is a guarantee.
Finance: read-only by construction
The first server gives an assistant access to real bank, card and payment accounts so it can answer questions like where the money went this month. It cannot move a dollar, not because it was told not to, but because the wrapper around the banking interface exposes only read methods. There is no transfer function to call. If the model decided to try, there would be nothing there.
Two more commitments hold it up. No secrets at rest: configuration stores references, not credentials, and the actual values are pulled from the system keychain or password manager at the moment of use and never written to disk or logs. Integrity at the boundary: amounts keep their exact values and signs and always travel with their currency, because a rounding convenience in a financial tool is a bug with a long tail.
Email: it can write, it cannot send
The second server indexes the mail already on the machine into a local full-text search database, so an assistant can find a thread, summarize a reporting period, or tell me what still needs a reply, entirely offline, with no credentials and no network.
It can compose a draft. It cannot send one. There is no send path at all. And because a silent failure is worse than a loud one, the server reads the draft back after writing it and fails the call if it came back empty, so "I saved your draft" is a verified claim rather than an assumption.
CAD: isolate the part that crashes
The third gives a model a persistent 3D modelling kernel: it writes geometry code, gets exact measurements back, renders images so it can actually look at what it built, and exports standard manufacturing formats.
Geometry kernels crash. A boolean operation on an ugly solid can hang or take the process down. So the kernel runs as a separate process that can be killed and rebuilt from history without dropping the session. The failure was designed for before it happened, which is the only time that design is cheap. This is the tool behind the Strix aircraft model.
What this is really about
These are small servers. The transferable part is not the code, it is the posture: decide what the system must never do, then make that outcome unreachable rather than unlikely, and test that the gate holds. That reasoning applies far beyond AI tooling. It is how you think about any interface that touches money, records, or people's private information.
How they were built
I specified and directed these, working with AI coding agents on the implementation. I own the architecture, the guardrails, and the definition of done. Writing tools for AI assistants by directing an AI assistant is a tight feedback loop: every weakness in how you state a requirement shows up immediately in what comes back.
Honest limits
- Single-user tools on my own machine. Nothing here is multi-tenant or hardened for shared hosting.
- They are only as safe as the boundary they wrap; a bug in the underlying library is still a bug.
- Coverage is uneven: two have real test suites, the others have smoke tests and honest documentation about what is not covered.
Seeing the code
The repository is private. If you are evaluating me and want to read the code or walk through the architecture, ask me and I will arrange read access or a screen share.