Use what you already have
For the h0SINT prototyping work, I have used OpenCode, OpenRouter, Proxmox, Tailscale and Cloudflare. The appeal is keeping the extra spend low while trying ideas. That is an account of a prototyping approach, not a claim that every h0SINT deployment sends its data through those services.
Each has a different job. OpenCode is the coding tool; OpenRouter offers access to model providers. Proxmox hosts virtual machines and containers on your hardware. Tailscale connects permitted devices privately. Cloudflare can serve the internet-facing parts. A private network does not make a remote model local.
Cheap is something you design
Give a small task to an appropriately sized model. Send the relevant files rather than the whole repository on every turn. Cap agent loops, inspect usage and set budgets or alerts where supported. Check whether a limit really stops spending: an email warning is not a hard cap.
Free allowances are useful within their quotas and eligibility rules. They are not a promise of free commercial use everywhere or unlimited capacity. Existing hardware still costs electricity, maintenance and time; backups need somewhere to go. “Very little extra cash for this prototype” is more honest than “the infrastructure costs nothing”.
Free does not settle the privacy question
Some free model offers collect data to improve the service; others have different terms. Paid access is not automatically private either. OpenRouter documents separate provider policies for training and retention, and OpenCode Zen lists privacy conditions by model. Read the terms for the actual route, including fallback providers, not just the app’s homepage.
Logging, model training and possible human review are different questions. Check what is retained, for how long, who can access it and which controls apply. An agent may send files and command output as well as the words you typed. Fake data for a prototype? Often a sensible starting point. Client documents, credentials or a sensitive asset inventory? Do not send them to an unapproved provider and hope for the best.
Local is worth trying, with eyes open
Local models are worth testing on bounded jobs such as drafting text or summarising sanitised notes. Measure the result on your own task and hardware; there is no universal promise that a small offline model can replace your strongest hosted one.
If the data must stay offline, verify the whole path: model, agent, tools, plugins and network traffic. Disable cloud fallbacks and unnecessary remote connections. Running the chat window on your laptop is not enough. The nice compromise is often a cheap sandbox for experiments and a deliberately chosen, approved setup for sensitive work.