Sezzlee Local LLM

@sezzlee/llm-mcp

MCP server that lets a planning agent (Codex, Claude Code, Cursor) hand off bounded language work to a local model. It builds on @sezzlee/mcp-core and names no other @sezzlee/* package.

Quick start

{

"mcpServers": { "local": { "command": "npx", "args": ["-y", "@sezzlee/llm-mcp"], "env": { "SEZZLEE_LLM_BASE_URL": "http://127.0.0.1:11434", "SEZZLEE_LLM_MODEL": "qwen3:8b" } } } }

In Codex, the same block goes under mcp_servers.local. If it runs with approval_policy = "never", default_tools_approval_mode = "auto" is also required, or Codex refuses the call.

Tools

Three tools. Two are read-only; local_map only adds new files to the server's own output directory.

Configuration

SEZZLEE_LLM_MODEL=qwen3:8b

SEZZLEE_LLM_ROOT=. # default: the working directory SEZZLEE_LLM_OUTPUT_DIR=.llm-mcp/out # default; relative to root, must stay inside it SEZZLEE_LLM_BASE_URL=http://127.0.0.1:11434 # default SEZZLEE_LLM_NUM_CTX=16384 # default; at least 4096 SEZZLEE_LLM_KEEP_ALIVE=30m # default SEZZLEE_LLM_TIMEOUT_MS=300000 # default; one request

npx -y @sezzlee/llm-mcp

Only the model name is required. Parsing is fatal, reaching the host is not: the server still starts and answers tools/list with the host down, and local_status reports reachable: false. The model is warmed up right after the server starts serving.

Set SEZZLEE_LLM_NUM_CTX to what the GPU actually delivers. Ollama does not refuse an oversized input — it silently drops the head — and the input budget is derived from this value.

Limits

Rules

• Three lint-enforced layers, three root entrypoints. src splits into platform/ (the mcp-core and Node boundary), backend/ (the model host), and tools/ (the MCP surface). tools/ sees the host only through backend/port.ts; the concrete backend is wired in cli.ts.
• Only `src/backend/ollama.ts` reaches the network, and only through the global fetch. That global and the node:http/net/tls family are lint-banned everywhere else.
• `process.env` is read only in `cli.ts`, each variable accessed by name.
• File paths are resolved against the workspace. The requested path and its realpath are checked separately, so a symlink pointing outside the workspace is refused too. readText accepts only a WorkspacePath-branded path that has passed both checks. In error envelopes, the workspace's absolute path appears as ..
• The server counts tokens, not the model. An input over num_ctx × 0.45 never reaches the host; an input that could not fit under any circumstances is refused before it is even read. The answer is capped at num_ctx × 0.4.
• Only `src/platform/workspace.ts` touches the filesystem, lint-enforced. The single writer is createOutput: it re-checks the output directory's realpath, the server itself picks the file name, lowers it to a safe alphabet and fixes the extension to .csv, and opens it wx — so it never overwrites an existing file or a symlink, and nothing is ever deleted (mcp-core).
• `local_map` carries the row number to the model and back. An id-less format lost the row order. A skipped row is asked again once; if it is still missing, it is left unlabeled and counted — never guessed.
• A chunked input is not truncated either. Chunks split on paragraph, then line, boundaries; each chunk yields notes, the notes are merged and the instruction applied one last time. If the merged notes still do not fit the budget, the merge round repeats (up to 3); if that still fails, the call is refused as input_too_large.
• One request per host at a time. createSerialBackend queues requests: the GPU does not run them in parallel, while Codex fires calls concurrently. probe bypasses the queue.
• A new backend kind is just another implementation of the `Backend` interface. The rest of the server does not change.

Design notes

The measurements below are what the rules above are built on.

Why an MCP server instead of pointing Codex at Ollama directly

Four ways of getting Codex to a local model were tried; only the MCP server worked.