diff --git a/system/machines/server/modules/home-manager/default.nix b/system/machines/server/modules/home-manager/default.nix
index c3a558b..b9c7fc3 100644
--- a/system/machines/server/modules/home-manager/default.nix
+++ b/system/machines/server/modules/home-manager/default.nix
@@ -17,7 +17,6 @@
       neovim.enable = false;
       vim.enable = true;
       tmux.enable = false;
-      utils.dev.enable = true;
     };
   };
 }
diff --git a/system/machines/server/modules/nginx/default.nix b/system/machines/server/modules/nginx/default.nix
index 3f4b0f2..d2aa7f3 100644
--- a/system/machines/server/modules/nginx/default.nix
+++ b/system/machines/server/modules/nginx/default.nix
@@ -78,6 +78,7 @@ in
       recommendedGzipSettings = true;
       eventsConfig = "worker_connections 4096;";
 
+
       # Catch-all default - friendly error for unknown subdomains
       virtualHosts."_" = {
         default = true;
@@ -137,9 +138,9 @@ in
           '';
         };
 
-        # MCP servers (namespaced, for llama.cpp web UI + direct access)
-        locations."/mcp/web_search/" = {
-          proxyPass = "http://192.168.0.23:8002/";
+        # MCP servers (same-origin with the web UI to avoid CORS)
+        locations."= /mcp/web-search" = {
+          proxyPass = "http://192.168.0.23:8002/mcp";
           proxyWebsockets = true;
           extraConfig = ''
             include ${config.sops.templates."nginx-mcp-auth.conf".path};
diff --git a/system/machines/server/system.nix b/system/machines/server/system.nix
index 43b75f6..1ceac33 100644
--- a/system/machines/server/system.nix
+++ b/system/machines/server/system.nix
@@ -40,7 +40,7 @@
     nginx = {
       enable = true;
     };
-    sandpack.enable = true;
+    sandpack.enable = false;
     forgejo.enable = true;
     frigate.enable = true;
     immich.enable = true;