llama.cpp native tools power sandboxed web RAG

This is the right instinct: once you let an LLM drive shell commands, the real product is the sandbox stack, not the model prompt.

• –llama.cpp now exposes built-in tools in `llama-server`, but the official docs warn they are experimental and should not be enabled in untrusted environments.
• –The author’s layered setup is sensible defense in depth: dedicated user account, Firejail, then an ephemeral Alpine VM before any command reaches the host.
• –The pattern is useful for local web RAG and automation, but it is operationally heavy enough that it will mostly appeal to power users and self-hosters.
• –The example workflow is intentionally constrained, which matters: no link following, a browser-like user agent, and an explicit wrapper around every command.
• –The main risk is still `exec_shell_command`; if the prompt or fetched content is adversarial, containment reduces blast radius but does not eliminate it.