I Ran a Fire Drill for Incident Response with a Local LLM (and Caught It Making Things Up)
A Japanese version of this is on Note . RoamSwitch is a network security tool I build solo for Mac and Linux. It's Zero Telemetry, so nothing about your usage ever leaves the machine, and when it detects behavior that looks like ransomware, it does something drastic: it cuts all network traffic. We call this Air-Gap containment. It's the last line of defense against data exfiltration and lateral…
RoamSwitch is a network security tool for Mac and Linux that provides Zero Telemetry, meaning no data leaves the machine during usage. One of its key features is Air-Gap containment, which cuts network traffic when it detects behavior similar to ransomware. The tool's developers have been concerned about the impact of Air-Gap firewalls on cloud AI tools like Claude Desktop, as they are cut off when Air-Gap is activated.
To address this issue, RoamSwitch includes a read-only Model Context Protocol (MCP) server that enables AI agents to query the tool even when the network is down. To test this functionality, the author created a staged scenario within RoamSwitch's state files and used a local Large Language Model (LLM) from Ollama to investigate the situation.
The LLM successfully analyzed the data and generated a report detailing the timeline of events, the affected process, and the actions taken by RoamSwitch to contain the incident.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
