Legwork MCP server

Legwork

<!-- mcp-name: io.github.kumarganduri/legwork -->

Your AI finds the open-source tool it needs on GitHub. Legwork installs it in a sandbox.

https://github.com/user-attachments/assets/9e9b80b5-99ff-4d21-b689-74655418f23d

A real run in Claude Desktop. The 25-second install is sped up; the malware repos' names are masked.

Add Legwork to Claude, Cursor, Codex, opencode or any MCP client once. When you ask for something your AI has no tool for, it searches GitHub, picks a repo, and asks you to approve installing it. Legwork then checks the code for hidden payloads, builds a working tool for it in a sandbox, tests it, and hands it over. In your home folder it can only read the folders you allow.

claude mcp add legwork -- uvx legwork-mcp hub --allow-read ~/Downloads

Then just ask. Four to try first, all from the public cache, so they need no API key:

video, offline. Best in English and other widely spoken languages; its small built-in model is unreliable for languages like Telugu.

• "Use Legwork to transcribe ~/Downloads/memo.m4a." Any voice memo, mp3 or

• "Use Legwork to remove the background from ~/Downloads/photo.jpg."
• "Use Legwork to pull the tables out of ~/Downloads/report.pdf."
• "Use Legwork to make a QR code for https://github.com/kumarganduri/legwork."

Saying "use Legwork" matters in Claude Desktop: without it, Claude may reach for its own cloud code sandbox, which can't see the files on your computer unless you attach them.

Your AI finds the tool (faster-whisper, rembg, pdfplumber, qrcode), you approve the install, and about a minute later it does the job. Files a tool makes are copied to ~/Legwork/outputs/. On macOS, the first time a tool reads Downloads, macOS asks whether uvx may access it; allow it once. If something doesn't work, uvx legwork-mcp doctor checks your setup. Or build one tool yourself: uvx legwork-mcp owner/repo (a model key for repos not in the cache).

Why not just ask your AI to install it?

one on the spot, untested, every time. Legwork writes it once, proves it works with a self-test, and caches it so the next person doesn't pay for it.

• Most repos have no MCP server to install. Your AI would have to write

SSH keys, your files, your environment variables. That's how the two malware repos below would have got in. Legwork checks the code for obfuscated payloads first, and every tool it installs runs sandboxed: in your home folder it sees only the folders you grant.

• Whatever your AI installs runs with full access to your machine: your

Claude Desktop, Cursor, opencode, Codex CLI, Goose and OpenClaw.

• It works across your tools: the same install works in Claude Code,

What it did on real repos

On 2026-09-26 we ran Legwork against the 10 most-starred AI repos created on GitHub in the previous week, taken exactly as search ranked them, with nothing skipped for being hard:

Shortened. The full README is on GitHub.