{"id":24950,"date":"2026-10-03T10:56:46","date_gmt":"2026-10-03T14:56:46","guid":{"rendered":"https:\/\/nuxx.net\/blog\/?p=24950"},"modified":"2026-10-03T10:56:46","modified_gmt":"2026-10-03T14:56:46","slug":"clanker-home-nuxx-net","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2026\/10\/03\/clanker-home-nuxx-net\/","title":{"rendered":"clanker.home.nuxx.net"},"content":{"rendered":"\n
\"\"<\/a>
Running Claude Code on a remote machine via ssh.<\/figcaption><\/figure>\n\n\n\n

Due to still-unresolved feelings of how-much-of-this-work-is-really-mine when using AI tools, I’m trying to make it as obvious as possible when I use them, and give away as much of the output as possible. I also like what I get out of the tools, but I don’t trust the tools themselves.<\/p>\n\n\n\n

As Apple is beginning to allude to (or… perhaps outright states) with their Updates to Full Disk Access in macOS<\/a> article, AI tools with unbounded access on end user devices are becoming a problem. And no, in-model guardrails (eg: prompts not to touch certain files) are not sufficient; the model can’t really constrain the model. So, other layers below — like in the OS — are needed to restrict access and maintain control and boundaries.<\/p>\n\n\n\n

I’ve taken a little bit different approach to this: a separate computer. I took an old computer, dropped a simple Ubuntu install on it, disabled the GUI, and I ssh<\/a> into it to run Claude Code<\/a> (or other AI tools) under tmux<\/a>. While it does have an ssh key for accessing one specific server (as part of the trailmaps.app<\/a> work I’m using it for), it can’t get anywhere else; access to it is essentially a one-way door.<\/p>\n\n\n\n

This is all very intentional, because then it doesn’t have direct\/implied access to anything else. Sure, it could “hack” it’s way into other things, but for now this feels like a sufficient guardrail. I can (and do) turn it off when I’m not using it as well. It gets backed up periodically (via borg to my NAS)<\/a> so I should even be able to wipe it and restore things, should I lose confidence in the installed OS.<\/p>\n\n\n\n

Lots and lots of the web development tools I’ve been using can run headless on it, automatically, but every once in a while it’s nice to give it access to something else via an MCP server<\/a>. This is easy, and can also be controlled, by giving the agent a path to the MCP via a very controlled SSH tunnel.<\/p>\n\n\n\n

For example, for the Safari MCP server<\/a> I have a script that I run on my Mac which uses socat<\/code> to run safaridriver<\/code> locally then plumbs it through a specific port via an SSH tunnel to clanker<\/code>. The result is that Claude Code can then access the MCP via a local TCP port, which in turn can drive a real copy of Safari on a remote machine.<\/p>\n\n\n\n

Nice and isolated, while still giving access to useful tools but only as I set up the tunnel. I just have to plumb them through one at a time.<\/p>\n\n\n\n

For now, at least, this works well for me.<\/p>\n\n\n\n

#!\/bin\/sh\n# safari-mcp-tunnel \u2014 serve Safari's MCP server to a remote Claude Code.\n#\n# Usage:\n#   safari-mcp-tunnel            start the listener and open the SSH tunnel\n#   safari-mcp-tunnel --serve    (internal) run safaridriver --mcp on stdio\n#\n# On the remote host, register the client end once with:\n#   claude mcp add safari -s user -- socat STDIO TCP:127.0.0.1:7391\n\nset -eu\n\nPORT=7391\nREMOTE=username@remoteserver.local\nSAFARIDRIVER=\/usr\/bin\/safaridriver\n\n# --- child mode: this is what socat execs for each connection ---------------\nif [ \"${1:-}\" = \"--serve\" ]; then\n    exec \"$SAFARIDRIVER\" --mcp\nfi\n\n# --- parent mode ------------------------------------------------------------\n# socat needs an absolute path to re-invoke this script, since $0 may be a\n# bare name when we were found on PATH.\nSELF=$(cd \"$(dirname \"$0\")\" && pwd)\/$(basename \"$0\")\n\n[ -x \"$SAFARIDRIVER\" ] || { echo \"no safaridriver at $SAFARIDRIVER\" >&2; exit 1; }\ncommand -v socat >\/dev\/null || { echo \"socat not installed\" >&2; exit 1; }\n\n# ,pipes is load-bearing: the default socketpair has an 8K buffer on macOS and\n# silently truncates large tool responses like get_page_content.\nsocat TCP-LISTEN:$PORT,bind=127.0.0.1,reuseaddr,fork \"EXEC:$SELF --serve,pipes\" &\nSOCAT=$!\ntrap 'kill $SOCAT 2>\/dev\/null || true' EXIT INT TERM\n\n# Wait for the listener before handing the port to ssh.\nwhile ! nc -z 127.0.0.1 $PORT 2>\/dev\/null; do\n    kill -0 $SOCAT 2>\/dev\/null || { echo \"socat failed to start\" >&2; exit 1; }\n    sleep 0.2\ndone\n\n# ExitOnForwardFailure catches a stale binding on the remote end, which would\n# otherwise leave the MCP server looking connected but dead.\nssh -o ExitOnForwardFailure=yes -R $PORT:127.0.0.1:$PORT \"$REMOTE\"<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Due to still-unresolved feelings of how-much-of-this-work-is-really-mine when using AI tools, I’m trying to make it as obvious as possible when I use them, and give away as much of the output as possible. I also like what I get out of the tools, but I don’t trust the tools themselves. As Apple is beginning to\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-24950","post","type-post","status-publish","format-standard","hentry","category-computers"],"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/24950","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=24950"}],"version-history":[{"count":1,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/24950\/revisions"}],"predecessor-version":[{"id":24955,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/24950\/revisions\/24955"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=24950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=24950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=24950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}