Magnitude's Install Instructions Are a Prompt. Your Coding Agent Is the Installer.

A look at the open-source local inference server that profiles your hardware and picks models to fit it, and at the setup pattern it is normalizing along the way.

Open Magnitude's README and scroll to "Get started." There is no shell command there. There is a bold line reading Send this to your agent to walk through models and setup: and, under it, a paragraph of plain English sitting in a code block.

The actual terminal commands exist. They are folded inside a collapsed <details> element titled "Want to browse the models directly?"

So the documented happy path is: paste a sentence into Claude Code, and Claude Code installs a global npm package, reads an instruction document you have not seen, and rewrites its own configuration. The CLI reference opens with two sentences: "Magnitude normally configures and manages these interfaces automatically. This reference is for agents, automation, advanced integrations, and manual recovery." Manual recovery. The human path is documented as the fallback.

The timing is worth pinning down, because this is a norm being set in real time rather than an established practice. The README bundled with the latest published package, @magnitudedev/cli@0.0.11 from September 2, still carries the old instructions: npm i -g @magnitudedev/cli and magnitude setup, no prompt, no collapsed block. The prompt-first version landed on the main branch after that release. This pattern is days old.

The tool is good. The pattern is the story.

I want to be clear about the order of these two things, because it would be easy to read this as a hit piece and it isn't one.

Magnitude solves a real problem. If you have tried to run a local model behind Claude Code or Codex, you know the actual work isn't downloading weights. It's answering "which quantization of which model fits in my memory at the context length I need, and will it be fast enough to be worth it." That question has a correct answer for your specific machine and almost nobody computes it. Most people grab whatever Ollama suggests and either run out of memory or leave half their hardware idle.

Magnitude profiles your processor, memory, and memory bandwidth, then ranks model and quantization and context combinations against that profile with estimated tokens per second attached. That is genuinely the useful part, and the README's jab at the alternative is fair: "Your agent would be guessing. It doesn't know your hardware, which quant fits, or how fast it'll run."

The install pattern is a separate question. It's worth pulling apart now, while Magnitude is a twelve-week-old repo with about 2,100 stars and the pattern is days old, rather than after four more tools copy it.

What the agent actually does on your behalf

Follow the chain from that one pasted sentence and here is the sequence:

It runs a global install. npm i -g @magnitudedev/cli. Global, not project-scoped, so it lands on your PATH for every shell.

It fetches an instruction document and follows it. magnitude docs onboarding prints, in the docs' own words, "the complete agent-guided setup workflow." Your agent reads that and acts on it. You do not see it first. There is no published web page for its contents; you get it by running the command that the agent runs.

It registers a background service that starts at login. From the get-started page: "Setup registers the service to start automatically when you log in." The inference server listens on loopback at http://127.0.0.1:10100, exposing both an OpenAI-compatible endpoint at /inference/v1 and an Anthropic-compatible one at /inference/anthropic.

It edits your harness config. The README FAQ describes "an onboarding flow that writes your harness config." The CLI reference lists magnitude connections add <harness> [--set-model <model-id>] [--install-skill], described as "Connect installed models and optionally select a model and refresh the harness skill." So setup can also drop Magnitude's skill into your harness. The flag is optional, which is good, and it is also the sort of thing an agent working from prose instructions will decide about on your behalf.

It keeps the capability afterward. From the get-started page: "Your agent can inspect Magnitude and find, install, or switch local models later."

Supported harnesses are Pi, OpenCode, Hermes, OpenClaw, Codex, Claude Code, Oh My Pi, and Cline.

None of these steps is malicious or even unusual on its own. npm i -g is a normal thing. Writing config is what installers do. What's different is that a natural-language document is the instruction set, and an LLM is the interpreter, and the whole sequence is initiated by copy-pasting prose whose provenance you verified by looking at a GitHub page.

The gap in the documentation

Magnitude's reference page has a table titled "Files and directories." It is thorough about its own footprint. Seven paths under ~/.magnitude/: models, cache, sessions, logs, traces, config.json, and harness-connections.json.

Now find the path to the Claude Code settings file it will edit. Or the Codex config. Or Cline's.

They are not there. To be precise about it, the docs do name third-party directories in one place: the Magnitude Harness page says skills load from .claude/skills, .agents/skills, and .magnitude/skills. But no page anywhere in the documentation names a single harness config file that setup writes. "Writes your harness config" is the most specific statement available, in a project whose primary install method is delegating that write to an agent.

That is the actual finding here, and it's a documentation gap rather than a security hole. But it matters more than a normal documentation gap, because the person reading the docs is not the person performing the install. Your agent is. And an agent following prose instructions will make reasonable choices you never see and never get asked about.

There's a second coupling cost the docs do disclose, buried in a Note on the get-started page: "Codex and Claude Code connections depend on the Magnitude background service, including when you switch back to their hosted models." Connect Claude Code to Magnitude and Claude Code now needs Magnitude running even when you are paying Anthropic for inference. That is a real dependency to take on and it is one sentence in a callout box.

Put this into practice

I'd run Magnitude. I'd just run the manual path, and I'd look at the diff. Here is the version that takes about ten minutes and shows you every step.

Install the CLI yourself, in your own terminal.
```
npm i -g @magnitudedev/cli
```
Read the document before your agent does. This is the whole point of doing it manually:
```
magnitude docs onboarding
```
Now you have seen the instruction set the agent would have silently followed. Skim it for anything that writes outside ~/.magnitude.
Snapshot your harness config first. Before connecting anything, copy your Claude Code or Codex settings somewhere safe, or commit them if they live in a repo. This is the file you want a diff against.
Browse and pick a model yourself.
```
magnitude setup
```
The interactive flow profiles your hardware, ranks the combinations, and shows you the speed and memory tradeoffs before downloading anything.
Connect one harness, explicitly, and skip the skill install on the first pass.
```
magnitude connections add <harness> --set-model <model-id>
```
Leave --install-skill off until you've decided you want it. Then diff your harness config against the snapshot from step 3 and read what changed.
Verify the service and the endpoint.
```
magnitude service status
curl http://127.0.0.1:10100/inference/v1/models
```
Confirm it is bound to loopback and that the model list is what you expect.
Know how to back out. magnitude connections remove <harness> and magnitude service uninstall (which preserves user data). Learn these before you need them, not after.

If you want to skip all of that and paste the prompt, that's a defensible choice on a machine you don't care about. It is a different choice on your main development machine with credentials in it.

Honest limitations

This is 0.0.x software. Latest release is @magnitudedev/cli@0.0.11, published September 2, 2026. The npm registry shows 58 published versions against 11 GitHub releases, and four of those releases shipped inside about 35 hours at the end of August. Fast iteration, no stability promise.

The npm package metadata is stale. The registry description for @magnitudedev/cli still reads "Magnitude AI coding agent," which does not match the current positioning as an inference server. The package was created 2026-03-11, three months before the repo. This project has been something else before.

"Best" is asserted, never measured. The word appears repeatedly ("runs the best local models for your hardware") with no benchmark, no methodology, and no accuracy figure for the recommendations. Tokens per second are labeled "estimated." Treat the ranking as a well-informed starting point, not a measurement.

"Fully private and offline" needs a footnote. The claim is accurate for inference: models, prompts, and files stay local. The reference page also documents an EXA_API_KEY environment variable to "enable web search in Magnitude Harness," which is an opt-in outbound path in their own harness. And offline is conditional on having already downloaded everything, which the FAQ says plainly.

There is no security section in the README at all. No threat model, no telemetry disclosure, no note about what the agent-driven install touches. For a tool whose headline setup method is handing an LLM a global install and config write access, that absence is the thing I'd most want fixed.

No native Windows. macOS and Linux, with Windows through WSL. Release artifacts confirm it: darwin and linux builds only, shipping a CPU base backend plus Metal, two CUDA versions, and Vulkan. No Windows asset at all.

Small and young. Repo created June 12, 2026, about 2,100 stars (two independent counts agree), Apache-2.0 with a clean stock license file and no carve-outs. Backed by Y Combinator. Promising, not proven.

What to do with this

Magnitude is worth your afternoon if you have a machine with real memory and you have been meaning to get a local model behind your agent. The hardware-aware model ranking is the part that's hard to build yourself and it works.

The bigger thing to carry out of this is the setup pattern, because Magnitude is not going to be the last tool to ship it. "Paste this prompt and your agent handles the rest" is a genuinely better onboarding experience than a fifteen-step README, and it is going to spread for exactly that reason. Which means the norms around it need to catch up fast: name the files, publish the onboarding document at a URL, make the skill install opt-in and loud, and say what happens if the agent gets it wrong.

Until that happens, the defense is boring and effective. Read the instruction document before your agent does, and diff your config after. Two commands. Do it once on this tool and you'll have the habit for the next five.

Sources: magnitudedev/magnitude README · Magnitude get-started docs · Magnitude CLI reference · @magnitudedev/cli on npm · magnitude.dev