diff --git a/system/machines/server/modules/home-manager/default.nix b/system/machines/server/modules/home-manager/default.nix
index b9c7fc3..c3a558b 100644
--- a/system/machines/server/modules/home-manager/default.nix
+++ b/system/machines/server/modules/home-manager/default.nix
@@ -17,6 +17,7 @@
       neovim.enable = false;
       vim.enable = true;
       tmux.enable = false;
+      utils.dev.enable = true;
     };
   };
 }
diff --git a/system/machines/server/modules/nginx/default.nix b/system/machines/server/modules/nginx/default.nix
index d2aa7f3..3f4b0f2 100644
--- a/system/machines/server/modules/nginx/default.nix
+++ b/system/machines/server/modules/nginx/default.nix
@@ -78,7 +78,6 @@ in
       recommendedGzipSettings = true;
       eventsConfig = "worker_connections 4096;";
 
-
       # Catch-all default - friendly error for unknown subdomains
       virtualHosts."_" = {
         default = true;
@@ -138,9 +137,9 @@ in
           '';
         };
 
-        # MCP servers (same-origin with the web UI to avoid CORS)
-        locations."= /mcp/web-search" = {
-          proxyPass = "http://192.168.0.23:8002/mcp";
+        # MCP servers (namespaced, for llama.cpp web UI + direct access)
+        locations."/mcp/web_search/" = {
+          proxyPass = "http://192.168.0.23:8002/";
           proxyWebsockets = true;
           extraConfig = ''
             include ${config.sops.templates."nginx-mcp-auth.conf".path};
diff --git a/system/machines/server/system.nix b/system/machines/server/system.nix
index 1ceac33..43b75f6 100644
--- a/system/machines/server/system.nix
+++ b/system/machines/server/system.nix
@@ -40,7 +40,7 @@
     nginx = {
       enable = true;
     };
-    sandpack.enable = false;
+    sandpack.enable = true;
     forgejo.enable = true;
     frigate.enable = true;
     immich.enable = true;