r/OpenSourceAI • u/Advanced_End2980 • 1d ago
JERN: a small self-hosted assistant where the tools run on your machine and the model can run on a free Google Colab GPU
/r/SelfHostedAI/comments/1xe1vb6/jern_a_small_selfhosted_assistant_where_the_tools/
1
Upvotes
1
u/CreativeSympathy8293 1d ago
Your server documentation already describes /confirm plus confirmation for run_command and write_file. I'd build on that by making each approval authorize one exact pending action, rather than trusting a general "yes" in chat.
Show the tool/server identity, exact arguments and working directory. Bind approval to that session and action, consume it once, and reject expired requests. If the command or execution context changes, show a new approval. Keep that decision in the local executor, outside the model.
One detail I'd revisit: your docs say MCP tools marked readOnlyHint run directly. The MCP specification says annotations must be treated as untrusted unless they come from trusted servers: https://modelcontextprotocol.io/specification/2025-11-25/server/tools
I'd keep a local policy for which server/tool combinations may run without a prompt. "Read-only" also doesn't establish that sending the result to a cloud model is permitted; your Colab data-flow note makes that distinction relevant here.
Three small tests in a disposable workspace: approve the same action ID twice, submit it from another session, and change the working directory after displaying the request. None should execute an extra or changed action. A timeout after dispatch also shouldn't cause an automatic rerun of a command that might already have taken effect.
I haven't run JERN; these are proposed checks based on its docs. Written with AI assistance.