Running a local coding agent on a Mac Mini Running a local coding agent on a Mac Mini — the actual setup By Vilius Vystartas I have an agent that does my low-stakes coding. File edits, test fixes, build verification. The kind o…

Sichere Programmierung dev.to 21.06.2026, 18:17 Uhr 3 Min. Lesezeit Cloud & IT-Enterprise

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

STANDARD — Regulärer Patch-Zyklus ~3 Min. (449 W.)

Deep Tech

Running a local coding agent on a Mac Mini — the actual setup

Angriffsfläche

Enterprise IT / Cloud Infrastruktur

Exploit-Status

Geringe Ausnutzungswahrscheinlichkeit / Keine aktiven Kampagnen

Sofortmaßnahme

Asset-Inventar prüfen & Upstream-Advisory überwachen

Running a local coding agent on a Mac Mini

Running a local coding agent on a Mac Mini — the actual setup

By Vilius Vystartas

I have an agent that does my low-stakes coding. File edits, test fixes, build verification. The kind of work you'd normally do yourself but it's faster to delegate. It also writes Playwright tests, reviews code, updates documentation, and runs deploys.

It runs locally — Mac Mini M4, 24 GB. No cloud API calls for the coding part. The orchestration layer still uses a cheap cloud model for planning and routing. The actual file editing is done by Pi, a coding agent that connects to oMLX, an OpenAI-compatible local LLM server.

The same setup can drive Claude Code, Codex, or any coding agent that speaks OpenAI-compatible API. Pi is what I use, but the oMLX server works with anything.

All the model names, config files, and paths are inside the script at the bottom.

Two models

I keep two and swap depending on the task. The 24 GB can't hold both at once.

One as good as I can have on this machine — 9B class, ~20 tok/s. Primary coding model.

Another fast — 4B class, ~27 tok/s. File edits, quick fixes, daily tasks.

The swap script moves one out, brings the other in, restarts the server. Takes about 5 seconds.

What Pi does

File edits and refactoring

Writing and fixing tests (Playwright, unit tests)

Build verification

Code review

Documentation updates

Running deploys

Anything more complex than a one-liner goes through RPC mode. The orchestration layer writes a prompt, Pi executes, the result comes back. No tmux, no process wrangling.

Pi extensions — what they do, why I use them

pix-optimizer — ponytail + caveman (lazy dev mode and token compression). Keeps Pi output tight and skips boilerplate.

context-mode — workspace routing and tool call interception. Keeps Pi from wandering into the wrong directories.

pi-subagents — spawns sub-agents. Parallel work without blocking the main session.

pi-workflow-engine — multi-step task orchestration. Lets Pi handle sequences without losing context.

pi-mcp-adapter — MCP server connectivity. Connects to context7 and scrapling for external tools.

@fgladisch/pi-caveman — additional compression on top of pix-optimizer.

Known issues

Can only keep one model loaded at a time. Two = OOM. Swap script handles it.

Thinking mode must be disabled. Defaults to chain-of-thought, kills speed.

Full chat history in prompts crashes the local model. Prompts must be just the files and changes.

Print mode skips safety controls. Use RPC mode for anything non-trivial.

First request after a model swap can time out. Retry once.

The blueprint

curl -fsSL https://workswithagents.dev/static/setup-local-llm-pi.sh | sh

1. Sofort-Triage & Abwehrmaßnahmen

IR-PLAYBOOK-RCEHIGH

Schritte anzeigen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

WAF MitigationSofort

Virtuelles Patchen am Reverse Proxy / WAF für gefährdete URL-Pfade und Payloads aktivieren.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

Web Shell ScanSofort

Web-Root auf neu angelegte Scripts, anomal modifizierte Dateien und Persistence scannen.

find /var/www -type f -name "*.php" -mmin -120

Outbound FilteringSofort

Ausgehenden Datenverkehr (Reverse Shells zu unbekannten IPs/Ports) blockieren.

ss -tunp | grep -E ":(4444|1337|8080|9001)"

Vendor Patching

Hersteller-Update in Staging validieren und schnellstmöglich in Produktion ausrollen.

apt update && apt --only-upgrade install <pkg>

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - Running a local coding agent on a Mac Mini — the actual setup
id: 471bdc64-c9e8-403c-b69a-a96ef7cd1bdf
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Running a local coding agent o" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Running a local coding agent on a Mac Mi")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*Running a local coding agent on a Mac Mi*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "Running a local coding agent on a Mac Mi"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🛡️

Exploit PoC Security Sandbox & Payload Analyzer TEXT

Danger Index:25/100 SAFE_ANALYSIS_ONLY

✅ Keine offensichtlich destruktiven Befehle erkannt.

Standard-Analystenprüfung vor Ausführung empfohlen.

Erkannte Gefahrensignaturen (1):

HIGHPAYLOAD_DROPPER:Download-and-Execute Dropper-Muster (Piped Shell-Execution).

curl -fsSL https://workswithagents.dev/s

API Endpoint: /api/v1/poc_analyzer.phpStatic Heuristic Sandbox v1.0

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

CVE-2026-12823 | Browserbase up to 20260526 Autobrowse Trace Artifact default permission

Sicherheitslücken (CVE)

NÄCHSTER BEITRAG 1 Min

Cyberkriminalität: Tausende Angriffe auf sächsische Unternehmen

Hacking & PentestingWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Running a local coding agent on a Mac Mi.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')

Auch interessante Nachrichten Running a local coding agent on a Mac Mini — the actual setup

Thematisch verwandte Begriffe: Running, local, coding, agent · 6 Treffer

Sichere Programmierung DEV Community

Orca: The Agent Development Environment for Running AI Coding Agents in Parallel

vor 5 Tagen 📆 20.09.2026 um 08:00 Uhr

Weiterlesen ↗

Sichere Programmierung DEV Community

A self-hostable AI workstation with a coding agent and answer-checking (Flywheel 1.0.1)

vor 5 Tagen 📆 20.09.2026 um 01:50 Uhr

Weiterlesen ↗

Sichere Programmierung DEV Community

I'm an architect. I built an AI agent that draws - and outputs IFC models

vor 5 Tagen 📆 20.09.2026 um 00:41 Uhr

Weiterlesen ↗

Sichere Programmierung DEV Community

Introducing mvnex v0.1.0: A Native CLI for Faster Maven Workflows

vor 5 Tagen 📆 20.09.2026 um 01:54 Uhr

Weiterlesen ↗

Sichere Programmierung DEV Community

agent-usage NEW8: agents can torch a 5-hour window with no estimate

vor 5 Tagen 📆 20.09.2026 um 05:46 Uhr

Weiterlesen ↗

Sicherheitslücken (CVE) KitPloit - PenTest Tools!

xalgorix v4.6.78

vor 5 Tagen 📆 19.09.2026 um 21:27 Uhr

Weiterlesen ↗

Videos werden geladen ...

Beiträge werden geladen ...

Videos werden geladen ...

Beiträge werden geladen ...

Videos werden geladen ...

Beiträge werden geladen ...

Videos werden geladen ...

Beiträge werden geladen ...

Videos werden geladen ...

🚀 Auf tsecurity.de entdecken

Kommentare über Running a local coding agent on a Mac Mini — the actual setup

💬 Social News Network

Community Debatte 0 Beiträge

Tags:Noch keine Tags.

Noch keine Diskussion eröffnet

Sei der Erste, der seine Einschätzung oder PoC zu diesem Thema teilt.

🚀 Auf tsecurity.de entdecken

Echtzeit-Radar & Feeds

👥 Community & Social

🕒 tsecurity.de Such-Trends & Chronologie

Running a local coding agent on a Mac Mini — the actual setup

Running a local coding agent on a Mac Mini — the actual setup

Two models

What Pi does

Pi extensions — what they do, why I use them

Known issues

The blueprint

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

Exploit PoC Security Sandbox & Payload Analyzer TEXT

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten Running a local coding agent on a Mac Mini — the actual setup

Orca: The Agent Development Environment for Running AI Coding Agents in Parallel

A self-hostable AI workstation with a coding agent and answer-checking (Flywheel 1.0.1)

I'm an architect. I built an AI agent that draws - and outputs IFC models

Introducing mvnex v0.1.0: A Native CLI for Faster Maven Workflows

agent-usage NEW8: agents can torch a 5-hour window with no estimate

xalgorix v4.6.78

tsecurity.de LIVE

Echtzeit-Radar & Feeds

👥 Community & Social

Running a local coding agent on a Mac Mini — the actual setup

Running a local coding agent on a Mac Mini — the actual setup

Two models

What Pi does

Pi extensions — what they do, why I use them

Known issues

The blueprint

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense

2. Cyber Threat Intelligence & Forensik

MITRE ATT&CK Matrix Navigator 14 Taktiken

Exploit PoC Security Sandbox & Payload Analyzer TEXT

Mehr aus dieser Kategorie

tsecurity.de Cognitive Threat RAG

Auch interessante Nachrichten Running a local coding agent on a Mac Mini — the actual setup

Orca: The Agent Development Environment for Running AI Coding Agents in Parallel

A self-hostable AI workstation with a coding agent and answer-checking (Flywheel 1.0.1)

I'm an architect. I built an AI agent that draws - and outputs IFC models

Introducing mvnex v0.1.0: A Native CLI for Faster Maven Workflows

agent-usage NEW8: agents can torch a 5-hour window with no estimate

xalgorix v4.6.78

tsecurity.de App