AkiMCP 2.1: local-first, Codex, and optional ingress
AkiMCP 2.1 moves to local-first: Gatekeeper always binds 127.0.0.1, ingress becomes optional, and the panel adds a Codex connector, Local/Web groups, and clear 401/503 errors.
AkiMCP 2.1 changes its operating default from remote-first to local-first. Gatekeeper always binds to 127.0.0.1; public ingress is no longer required for the server to start. The release also adds a Codex connector, splits the panel into Local and Web groups, and returns distinct errors for an invalid token or unavailable ingress.
What changes with local-first?
Gatekeeper listens only on the 127.0.0.1 loopback address, so clients on the same machine can connect without Tailscale Funnel or another ingress. Ingress remains available when a web client needs remote access, but it is an optional layer rather than a startup requirement.
Local-first does not remove authentication. An invalid token returns a clear 401; when a Web route needs ingress and ingress is unavailable, the server returns 503 instead of collapsing both cases into an ambiguous connection error.
Codex gets its own connector
The 2.1 panel provides a copy-ready connector configuration for Codex. Tabs are grouped under Local and Web, helping users distinguish same-machine clients from clients that first need an internet-reachable address.
A more stable panel and Postman boundary
Local IDE tabs remain visible after the panel is divided into groups. For Postman, 2.1 restores the hard lock on the subagent shell, preserving the intended execution boundary instead of allowing the control flow to loosen permissions.
The release also removes the dead install.py fallback on Windows. Compared with 2.0.4, version 2.1.0 changes 15 files, adding 543 lines and removing 52.
If you use AkiMCP only on a personal machine, 2.1 lets you start with Local and configure ingress only when Web access is actually needed. Read what MCP local-first means and how to distinguish 401 from 503.