feat: Ollama + MCP bridge so local models can drive bolt

[Sajawal007]

Summary

Adds an end-to-end bridge that lets a local Ollama model use bolt's MCP toolset without depending on Claude/Anthropic, plus a stdlib HTTP API so external services (e.g. a Rails threat-intel pipeline) can call it over the wire. Nothing in bolt's existing code paths is changed; everything here is additive.

What changed

File	Purpose
ollama-bridge.sh	CLI wrapper around mcphost. Pulls bolt's MCP_ADMIN_TOKEN from the running container, health-checks ollama + bolt, applies the default system prompt, max-steps and temperature.
.mcphost.json	mcphost remote-server config pointing at bolt's HTTP MCP endpoint with bearer auth via ${env://BOLT_ADMIN_TOKEN} substitution.
Modelfile.qwen7b-bolt, Modelfile.qwen14b-bolt	Derived Ollama models that bake num_ctx=32768 (default 4096 was too small for bolt's 25-tool schema + system prompt) and a low temperature for decisive tool calls.
prompts/recon-agent.md	Agent role + default playbook telling the model to classify the target, plan, and chain tools (subfinder → dnsx → httpx → nuclei) instead of asking the user which tool to invoke.
bridge-api.py	Stdlib-only HTTP wrapper. POST /scan accepts {target, targets, iocs, infra, instructions, prompt, system_prompt, model, max_steps, timeout, verbose}; auto-builds a prompt or accepts a raw one; supports per-request system-prompt override; returns JSON {ok, output, duration_ms, model, error}. GET /health verifies ollama, bolt, and the bridge script.

Why

Bolt today is consumed by Claude Desktop / Claude Code — i.e. an Anthropic-hosted client drives the toolset. This PR makes bolt usable from any local Ollama model and from any HTTP-speaking app. The pieces are intentionally split:

• The shell wrapper handles the messy environment glue (token, health, mcphost flags).
• The Modelfiles solve a real footgun: Ollama loads qwen2.5:* with a 4 K context by default, which silently truncates bolt's 25-tool schema and makes the model "forget" what tools it has.
• The system prompt fixes the second footgun: small models will happily generate tool-use examples in text instead of issuing function calls — the prompt forces them to invoke instead of describe.
• bridge-api.py is the integration point for a Rails / FastAPI / other backend that wants to fire scans without spawning processes itself.

How to use

# one-shot CLI
./ollama-bridge.sh -p "Target: scanme.nmap.org. Recon it."

# interactive REPL
./ollama-bridge.sh

# HTTP API for external apps
python3 bridge-api.py            # listens on :8080
curl -X POST http://localhost:8080/scan \
  -H 'Content-Type: application/json' \
  -d '{"target":"scanme.nmap.org","iocs":["45.33.32.156"]}'

Override per call: MODEL=qwen2.5:14b-bolt, MAX_STEPS=60, SYSTEM_PROMPT=/path/to/role.md, etc.

Known issue worth a follow-up

Bolt's nmap (and any other plugin marked requiresRoot: true) wraps the binary with sudo via packages/core/src/executor.ts. The shipped Docker image runs as root and does not include sudo — so every root-required tool fails with Executable not found in $PATH: "sudo". As a runtime workaround we drop a passthrough shim into the running container:

docker exec bolt sh -c 'printf "#!/bin/sh\nexec \"\$@\"\n" > /usr/local/bin/sudo && chmod +x /usr/local/bin/sudo'

The clean upstream fix is a one-liner in executor.ts: skip the sudo prefix when process.getuid?.() === 0. Happy to send a separate PR for that if maintainers prefer.

Test plan

• ollama-bridge.sh -p "say OK" returns OK (~5s, plain chat path)
• ollama-bridge.sh -p "Target: scanme.nmap.org. Recon it." issues real bolt__nmap, bolt__httpx etc. tool calls visible in docker logs bolt
• bridge-api.py GET /health returns ok with all three checks green
• POST /scan with bare {} returns 400 with the right message
• POST /scan with targets array of wrong type is rejected with a clear error
• POST /scan with target only, targets only, and both, all auto-build a prompt and run end-to-end
• system_prompt override is written to a tempfile, passed via SYSTEM_PROMPT env var to mcphost, and cleaned up after the run
• Modelfile-built qwen2.5:7b-bolt reports context_length=32768 from /api/ps

🤖 Generated with Claude Code