kumarganduri/legwork

Your AI finds the open-source tool it needs on GitHub. Legwork installs it in a sandbox.
https://github.com/user-attachments/assets/9e9b80b5-99ff-4d21-b689-74655418f23d
A real run in Claude Desktop. The 25-second install is sped up; the malware repos' names are masked.
Add Legwork to Claude, Cursor, Codex, opencode or any MCP
client once. When you ask for something your AI has no tool for, it
searches GitHub, picks a repo, and asks you to approve installing it.
Legwork then checks the code for hidden payloads, builds a working tool for it in a
sandbox, tests it, and hands it over. In your home folder it can only read
the folders you allow.
sh
claude mcp add legwork -- uvx legwork-mcp hub --allow-read ~/Downloads
Then just ask. Four to try first, all from the public cache, so
they need no API key:
"Use Legwork to transcribe ~/Downloads/memo.m4a." Any voice memo, mp3 or
video, offline. Best in English and other widely spoken languages; its
small built-in model is unreliable for languages like Telugu.
"Use Legwork to remove the background from ~/Downloads/photo.jpg."
"Use Legwork to pull the tables out of ~/Downloads/report.pdf."
"Use Legwork to make a QR code for https://github.com/kumarganduri/legwork."
Saying "use Legwork" matters in Claude Desktop: without it, Claude may reach
for its own cloud code sandbox, which can't see the files on your computer
unless you attach them.
Your AI finds the tool (faster-whisper,
rembg,
pdfplumber,
qrcode), you approve the
install, and about a minute later it does the job. Files a tool makes are
copied to ~/Legwork/outputs/. On macOS, the first time a tool reads
Downloads, macOS asks whether uvx may access it; allow it once. If
something doesn't work, uvx legwork-mcp doctor checks your setup. Or
build one tool yourself: uvx legwork-mcp owner/repo (a model key for repos
not in the cache).
## Why not just ask your AI to install it?
Most repos have no MCP server to install. Your AI would have to write
one on the spot, untested, every time. Legwork writes it once, proves it
works with a self-test, and caches it so the next person doesn't pay for it.
Whatever your AI installs runs with full access to your machine: your
SSH keys, your files, your environment variables. That's how the two
malware repos below would have got in. Legwork checks the code for
obfuscated payloads first, and every tool it installs runs sandboxed: in your home folder it sees only
the folders you grant.
It works across your tools: the same install works in Claude Code,
Claude Desktop, Cursor, opencode, Codex CLI, Goose and OpenClaw.
## What it did on real repos
On 2026-09-26 we ran Legwork against the 10 most-starred AI repos created
on GitHub in the previous week, taken exactly as search ranked them, with
nothing skipped for being hard:
| Outcome | Repos |
| ✅ Built a working MCP server | 3 — an npm CLI, a Python library, a Go binary |
| ↩️ Refused, with the right reason | 5 — two Android/macOS apps, a desktop app, a repo with no usage docs, a tool that needs its own API keys |
| 🛑 Blocked before install (malware) | 2 |
Two of those top-10 "AI tools", about 700 stars each and three days old
at the time, carried the same byte-identical obfuscated dropper under different