🧠 Fully personalized AI MCP stacks
~240 MCPs wired into Claude Code so the AI can actually OPERATE the stack — flip services between nodes, restart daemons, audit router configs, query node stat...
🛡️ HOW I CONTAIN THE AI — Airlock + Physical Key
Now the obvious question: if the AI has 240 tools and reads my disk, how do I keep it on a leash? Two answers, stacked — software on top, hardware underneath.
🛂 AIRLOCK CONTROL — the logical gate
The AI Airlock decides what Claude can read on my disk once any session is open. Four access modes (Full / Restricted / Paranoid / Off), explicit blocked-paths editor, kernel-level immutability on the constraint files (even root can't edit them without unlocking first), Deploy Mode toggle that gates mutating actions (audit-logged), one-click kill on remote AI access.
🔑 YUBIKEY — the physical root under the airlock
The Airlock is software. Software is mutable. The anchor is hardware.
In February 2026 I killed the password slot on my LUKS vault. The drive holding ~/Hub, Vaultwarden master, GPG/SSH keys, every API token — no longer accepts a passphrase. Not 2FA. Substitutive — the token IS the key. Pull the key out and the screen locks, vault closes. Hardware is the dead-man's switch.
The punchline: combining the multisig backbone with the YubiKey perimeter, the whole stack — generational wealth, digital infrastructure, AI cognitive layer — sits on two physical roots of trust: titanium plates spread across countries, and a 1.5cm aluminum stick on my keyring. The threat I'm defending against is duress-and-compromise, not loss. People who don't understand call it fragility. People who do call it the entire point.
Now the obvious question: if the AI has 240 tools and reads my disk, how do I keep it on a leash? Two answers, stacked — software on top, hardware underneath.
🛂 AIRLOCK CONTROL — the logical gate
The AI Airlock decides what Claude can read on my disk once any session is open. Four access modes (Full / Restricted / Paranoid / Off), explicit blocked-paths editor, kernel-level immutability on the constraint files (even root can't edit them without unlocking first), Deploy Mode toggle that gates mutating actions (audit-logged), one-click kill on remote AI access.
🔑 YUBIKEY — the physical root under the airlock
The Airlock is software. Software is mutable. The anchor is hardware.
In February 2026 I killed the password slot on my LUKS vault. The drive holding ~/Hub, Vaultwarden master, GPG/SSH keys, every API token — no longer accepts a passphrase. Not 2FA. Substitutive — the token IS the key. Pull the key out and the screen locks, vault closes. Hardware is the dead-man's switch.
The punchline: combining the multisig backbone with the YubiKey perimeter, the whole stack — generational wealth, digital infrastructure, AI cognitive layer — sits on two physical roots of trust: titanium plates spread across countries, and a 1.5cm aluminum stick on my keyring. The threat I'm defending against is duress-and-compromise, not loss. People who don't understand call it fragility. People who do call it the entire point.
1