Automation
Skill
/local-workspace-server
Hardened loopback static server for local presentation drafts — capability-URL, read-only GET/HEAD, Host-header gate, nosniff + sandbox CSP. Use instead of a plain http.server when the Presentation panel's dev mode loads a local deck.
Claude Code
$ npx -y skills add sonichi/sutando --skill local-workspace-server --agent claude-code
Codex
$ npx skills add sonichi/sutando --skill local-workspace-server -a codex -y
Cursor
$ npx skills add sonichi/sutando --skill local-workspace-server -a cursor -y
Gemini CLI
$ npx skills add sonichi/sutando --skill local-workspace-server -a gemini-cli -y
GitHub Copilot
$ npx skills add sonichi/sutando --skill local-workspace-server -a github-copilot -y
OpenCode
$ npx skills add sonichi/sutando --skill local-workspace-server -a opencode -y
Windsurf
$ npx skills add sonichi/sutando --skill local-workspace-server -a windsurf -y
SKILL.md
local-workspace-server.SKILL.mdname: local-workspace-server description: Hardened loopback static server for local presentation drafts — capability-URL, read-only GET/HEAD, Host-header gate, nosniff + sandbox CSP. Use instead of a plain http.server when the Presentation panel's dev mode loads a local deck.
Local workspace server
Serves ONE directory, read-only, to the trusted Presentation panel's dev mode. Loopback binding is not treated as trust: the owner's hardening checklist (2026-08-26) is the spec, and every guard is pinned in `tests/local-workspace-server.test.py` over real HTTP.
python3 skills/local-workspace-server/scripts/serve.py --root <deck-dir> [--port 8899] [--ttl 3600]
Prints a capability URL (`http://127.0.0.1:<port>/<token>/`). Paste it into the panel's device-local dev override — it never goes into room state (logical `local_workspace` descriptors only; see the Presentation protocol thread).
Guards: 127.0.0.1 bind only · random capability path segment (constant-time compare) · TTL expiry → 403 · GET/HEAD only, anything else 405 · no directory listing · traversal-safe resolve containment · explicit MIME + nosniff · `sandbox allow-scripts` CSP on HTML · Host header must be loopback (DNS- rebinding defense, computed from the BOUND port) · no-store caching · stdout logging only.
Stats
408
Stars
99
Forks
Active
Maintenance
Python
Language
MIT
License
Last commit
Created
Ships withsutando
My AI Stand — Realtime by Day, Rewriting Itself by Night. Summon my AI superpower. Voice, vision, screen, meetings, calls when I'm engaged. Learns my patterns, ships its own code when I'm not. Runs across my Macs, interacts with people & their Stands.
40179 skills
Stars on GitHub
Momentum
- stars in total
- 401
Other skills on sutando.
More skills from other plugins.
browser-use
Direct browser control via CDP for web interaction: automation, scraping, testing, screenshots, and site/app work. Also covers…
@browser-useInstall Skillagent-browser
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling…
@vercel-labs-2Install Skill
Questions about local-workspace-server.
- Which coding agents can use local-workspace-server?
- local-workspace-server installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.