Which harness fits
Most control
Local model via Ollama, plus permission rules that deny edits, shell and web fetches outright.
Simplest read-only default
codex exec runs in a read-only sandbox unless you change it, and --oss uses a local provider.
Desktop, non-technical users
Pick Ollama in the app; installed models show up automatically.
Rig A: OpenCode, local and read-only
{
"$schema": "https://opencode.ai/config.json",
"provider": {
"ollama": {
"npm": "@ai-sdk/openai-compatible",
"name": "Ollama (local)",
"options": { "baseURL": "http://localhost:11434/v1" },
"models": { "<model>": { "name": "<model> (local)" } }
}
},
"permission": {
"*": "deny",
"read": "allow", "grep": "allow", "glob": "allow",
"webfetch": "deny", "websearch": "deny"
}
}With the catch-all "*": "deny" first, only the read tools you list are allowed. OpenCode already denies reading .env files by default.
Rig B: Codex on Ollama
cd ~/private-docs
codex exec --oss "Which of these contracts renew automatically? Cite file names."
# exec keeps the default read-only sandbox; don't add --sandbox flagsSet oss_provider = "ollama" in ~/.codex/config.toml so --oss doesn't prompt.
Know the limits
- Check that every model slot is local. A cloud model configured for a side task would see your text.
- Remote MCP servers send data to their host. Leave them off this rig.
- Give the model room. Ollama recommends 64k context for agents; the default can be as low as 4k.
FAQ
Can I use an AI agent on private files without sending them to the cloud?
Yes, with a local model through Ollama or LM Studio and a harness configured to use only that provider, such as OpenCode, Codex CLI with --oss, goose or Aider.
How do I make an agent read-only?
In OpenCode, set "*": "deny" and allow only read, grep and glob. Codex's exec is read-only by default. In Claude Code, --permission-mode dontAsk with --allowedTools "Read,Grep,Glob".
Get new rigs by email
New job recipes and harness changes, a few times a month. Each one with copy-ready config and dated sources.
Sources
- OpenCode 1 docs: providers · checked Oct 18, 2026
- OpenCode 1 docs: permissions · checked Oct 18, 2026
- Codex docs: non-interactive mode · checked Oct 18, 2026
- Codex docs: config reference · checked Oct 18, 2026
- goose docs: providers · checked Oct 18, 2026
- Claude Code docs: permissions · checked Oct 18, 2026
- Claude Code docs: run Claude Code programmatically · checked Oct 18, 2026
- Ollama docs: context length · checked Oct 18, 2026
Spotted something out of date? Email sternberg@mail.grokbot.com.