A local Matrix server and a small agent beside it
vidarh asked Kimi to set up a local Matrix server and a small agent with a sandbox. Email is read-only. He reaches it from the phone over Matrix, inside his own network.
Done with KimiAdvanced
What was done
On 8 October 2026 vidarh writes on Hacker News that he asked Kimi to set up a local Matrix server and a small agent. The tools run in a bubblewrap sandbox, which he writes is not enough if the agent is exposed to a lot of untrusted data. He intends to move the whole thing into a virtual machine. Email is read-only because the agent has no credentials, only tools that read. It can read and send Matrix messages. A heartbeat asks it to consolidate what it wants to remember, and to tidy. He runs the agents with a mix of Kimi and GLM5. Matrix is self-hosted with federation off. It runs on his WireGuard network, and he uses a Matrix client on the phone. He can also reach it from Claude, Codex and the Kimi CLI through a small MCP.
How it went
The service runs at home, and he reaches it from the phone. He writes that the code might be released later, and that the sandbox is not enough against untrusted data.
Worth knowing
The sandbox is bubblewrap, and he says himself that it is not enough if the agent receives a lot of outside data. Email is read-only. Federation is off to keep the agents inside.
How to do it
- Ask the agent to set up the service on a network you control, with no federation out.
- Give email as read access, without the password in the agent's environment.
- Do not open it to untrusted messages until the sandbox is one you trust.
Try it with Kimi
Set up [service] on [machine] on my network. Turn federation off. Email must be read-only, with no password in your environment. Do not open the service to the internet. Show me how I reach it from the phone on [network].
Replace text in brackets with your own.
Done when. The service answers only on your network, and the email password is not with the agent.
Safety rule. No password in the agent's environment. No opening to the internet. Email is read-only.
Read the original
Read the original · vidarh on Hacker News ·