Bobbin is a small, dependency-free agent that runs a local model through Ollama for coding, and for security work: reviewing code and doing authorized, offline pentest-style testing.

I built it for a lot of reasons: you don't want a hosted agent reading your private code and you really don't want one doing pentest actions at your own site. Other local agents did not met my high requirements.

I want to be honest about the limits. My machine only runs up to a 30B model, and a local agent has real ceilings no matter what. It's not perfect, and I'd be lying if I said it is. But everything is measured: 4,000+ runs are in the repo, from ordinary coding through finding and exploiting vulnerabilities, with the negative results documented with the wins. Models behave differently and that's funny. Nemotron looks smarter but stubborn (it won't stop, which sometimes helps and sometimes wastes the run), while qwen gives up earlier but wins other cases. Sometimes one win, sometimes the other does. But there is a strong consistency and low noise intra-model.

What I'd most like: feedback from people who can run larger local models fully on a GPU! That would help me to understand if a smarter model can actually pass every run. I noticed a big jump in performance from the 7B to the 30B parameters of qwen, so I would be extremely happy to see that the agent performance scale with the size of the model.