The Eccentricities of
Air-Gapped AI

Every tutorial assumes a connection you don’t have

I don’t normally get into the “why” of things here — usually I’d rather just show you what broke and how I fixed it — but this one’s worth setting up properly, because almost nobody writing about agentic AI in air-gapped environments is operating anywhere close to where I am.

Every tutorial you’ll find assumes the same thing: a frontier model from Anthropic or OpenAI, a live connection to call its API, and a toolkit so big you’ll never use half of it — web search, code execution, a filesystem, a dozen connectors somebody else already built. Paste in an API key, go. Done.

None of that exists where I work.

I’m in a secure military environment. No connection out. No frontier model (read: nothing anywhere near what powers a consumer chat product). No API key, because there’s no API to call one with. If you’re in air-gapped finance, classified research, or anywhere else where “just hit the API” isn’t a sentence that makes sense, this is for you too — the walls are the same shape even if the reasons for building them aren’t.

This series is about what’s actually possible to build inside that wall, using kmcp as the scaffold — a CLI and Kubernetes controller for building, testing, and deploying MCP servers. This post isn’t about kmcp yet, though. It’s the “why bother” post — why chase agentic AI at all when you’re missing most of what makes it agentic in the first place.

The constraint, stated plainly

So. The constraint, stated plainly, because it’s not going anywhere and it’s not waiting on some future model release to fix it.

You don’t get frontier-scale anything. The big labs run hosted APIs by design — the model never leaves their infrastructure, so there’s no export button even if you wanted one. What you get instead is whatever open-weight model is small enough, and cleared enough, to actually sit inside your network. That’s a real downgrade in capability, and pretending otherwise doesn’t help anyone.

You don’t get the tool ecosystem either. No live web search, because there’s no web. No calling out to some SaaS API for anything, because there’s no “out.” Every tool your agent touches is something you built yourself, inside the wall, on purpose. Nobody’s shipping you a connector.

What agentic AI in air-gapped environments actually means

Here’s the part that actually matters, and it’s the part that took me a while to actually believe: this isn’t agentic AI’s little brother. It’s a different discipline, and in a lot of ways it’s a better one.

The public version of “agentic” assumes breadth by default — give the model everything, then spend your time figuring out what to turn off. Implicit allow.

Air-gapped agentic AI starts from nothing. No tool exists until you build it, test it, and decide it’s earned a place. Implicit deny, same as the rest of this blog’s whole philosophy, just applied to tooling instead of network ACLs.

And look — the upside is real:

• Smaller blast radius if something goes sideways. Three purpose-built tools can only fail three ways. Forty inherited connectors give you forty ways to get surprised.
• Actual auditability, because every tool exists because you wrote it and you know what it does — not because it shipped in a default bundle from some vendor’s catalog.
• It forces you to actually understand the problem before you build the tool for it, instead of pointing a big general model at something and hoping.

In my own experience, this setup is genuinely versatile — just not in the “ask it anything” sense. It’ll do exactly what you design and build it to do, reliably, inside a boundary you fully control. The ceiling isn’t the model. The ceiling is what you’re willing to design.

fig. 1 — tool surface under implicit allow vs. implicit deny

We talk about agentic AI like it’s one thing, but it isn’t. Out there, it’s breadth and convenience and a model that can reach for almost anything. In here — running agentic AI in air-gapped environments — it’s discipline. It’s knowing exactly what you built and why. It’s a smaller world, sure — but it’s a world you actually understand end to end, and that’s worth more than people give it credit for. Constraint isn’t the opposite of capability. Sometimes it’s just what capability looks like when you have to earn every piece of it.

What it costs

Granted, none of this is free, and I’m not going to sit here and tell you the workflow is convenient. There’s no curl | bash. No helm install pulling a chart from some public registry. No live model API to poke at from your laptop over lunch. Getting anything running at all means doing the real work — scaffolding, building, scanning, signing, getting it approved — all before a single byte of it ever crosses into the place where it’ll actually run.

None of that’s free, and none of it happens on its own. Next post — The Weight on One Side of the Wall — gets into what actually gets built where, and how the heavy lifting on one side of the wall is what makes the other side simple.