Legwork

Your AI finds the open-source tool it needs on GitHub. Legwork installs it in a sandbox.

https://github.com/user-attachments/assets/9e9b80b5-99ff-4d21-b689-74655418f23d

_{A real run in Claude Desktop. The 25-second install is sped up; the malware repos' names are masked.}

Add Legwork to Claude, Cursor, Codex, opencode or any MCP client once. When you ask for something your AI has no tool for, it searches GitHub, picks a repo, and asks you to approve installing it. Legwork then checks the code for hidden payloads, builds a working tool for it in a sandbox, tests it, and hands it over. In your home folder it can only read the folders you allow.

claude mcp add legwork -- uvx legwork-mcp hub --allow-read ~/Downloads

Then just ask. Four to try first, all from the public cache, so they need no API key:

• "Use Legwork to transcribe ~/Downloads/memo.m4a." Any voice memo, mp3 or video, offline. Best in English and other widely spoken languages; its small built-in model is unreliable for languages like Telugu.
• "Use Legwork to remove the background from ~/Downloads/photo.jpg."
• "Use Legwork to pull the tables out of ~/Downloads/report.pdf."
• "Use Legwork to make a QR code for https://github.com/kumarganduri/legwork."

Saying "use Legwork" matters in Claude Desktop: without it, Claude may reach for its own cloud code sandbox, which can't see the files on your computer unless you attach them.

Your AI finds the tool (faster-whisper, rembg, pdfplumber, qrcode), you approve the install, and about a minute later it does the job. Files a tool makes are copied to ~/Legwork/outputs/. On macOS, the first time a tool reads Downloads, macOS asks whether uvx may access it; allow it once. If something doesn't work, uvx legwork-mcp doctor checks your setup. Or build one tool yourself: uvx legwork-mcp owner/repo (a model key for repos not in the cache).

Why not just ask your AI to install it?

• Most repos have no MCP server to install. Your AI would have to write one on the spot, untested, every time. Legwork writes it once, proves it works with a self-test, and caches it so the next person doesn't pay for it.
• Whatever your AI installs runs with full access to your machine: your SSH keys, your files, your environment variables. That's how the two malware repos below would have got in. Legwork checks the code for obfuscated payloads first, and every tool it installs runs sandboxed: in your home folder it sees only the folders you grant.
• It works across your tools: the same install works in Claude Code, Claude Desktop, Cursor, opencode, Codex CLI, Goose and OpenClaw.

What it did on real repos

On 2026-09-26 we ran Legwork against the 10 most-starred AI repos created on GitHub in the previous week, taken exactly as search ranked them, with nothing skipped for being hard:

Two of those top-10 "AI tools", about 700 stars each and three days old at the time, carried the same byte-identical obfuscated dropper under different file names. Legwork's pre-i

... View full README on GitHub