Snap Human Tools: A Local Server That Refuses to Let the Model Decide Alone
snap-human-tools is a repository of mine under github.com/yethikrishna. It has three small prototypes: a check before a browser action, a triage queue for security alerts and a memory-game difficulty chooser. I read server.py and the README. This post covers those.
The shape of it
The server uses only the Python standard library: ThreadingHTTPServer, urllib and hashlib. Each tool is a question with a type of choice and a set of named criteria. The browser tool answers allow, ask or block. The alert tool answers do_now, watch or ignore. The game tool answers ease, hold or advance.
The rule layer
After the model answers, a policy function can overrule it for the browser tool. Sensitive data going to an external destination is a block. A page that tries to change the user task is a block. Send, buy, delete, upload and account changes are always ask. Even when the model says allow, the app turns it into ask unless the allow probability is at least 0.9. I like this order. The model gives a judgment, and code the user can read has the last word.
Live mode needs the SUBQ_API_KEY environment variable on the server side. Without it the code raises an error saying offline mode only, and the offline path uses local rules that label themselves as not model output. Every live call writes a receipt with a SHA-256 of the request, the wall time and both the model choice and the app decision.
The guardrails around the server
POST only works for the local host on port 8775 and a same-origin header. The extension route needs an exact origin set in an environment variable. Input over 12 KB is refused, evidence over 8 KB is refused, and only one live call can run at a time.
What the README admits
It says these are local prototypes, not security audited, and that the extension was not verified end to end because the service worker failed to start. It also says the seventeen live calls were not a benchmark. My opinion: that honesty is what makes the project worth reading. The one thing I would add is a test for the 0.9 threshold, since it is the line that decides allow.