Matt Wolfe's Free Control Center: A Local Business Dashboard

Direct Answer

Control Center is a free, local-first dashboard that turns scattered business signals into one daily operating view. Matt Wolfe built it with Codex to monitor industry sources, find verified brand mentions, track public audience totals, review newsletters, manage reminders, and organize recurring tasks without forcing every feature through a paid AI API.

The useful idea is not that one dashboard literally runs every part of a company. It is that a small business can stop checking six feeds, four analytics pages, an inbox, and a task list before deciding what deserves attention. Control Center gathers those inputs, stores them locally, and optionally uses a cloud or local model to rank and summarize them.

Watch the Build

Credits: the build process and original product walkthrough come from Matt Wolfe's video. Installation, data handling, provider support, and security notes below were checked against the current Control Center repository on 6 September 2026. The repo may continue to evolve beyond the version shown in the video.

What Control Center Actually Is

Control Center is best understood as a personal business-intelligence console. It does not replace the underlying sources and it does not autonomously operate every company function. Instead, it creates a stable place to collect evidence, review changes, and decide what to do next.

A fresh installation is intentionally empty. It does not ship with Matt's company names, profiles, feeds, API keys, or demo records. You provide the sources and identities that matter to your business, which is a better default for both privacy and reuse.

That also distinguishes it from our Codex Control Center. Matt's project is a business-signal dashboard for news, mentions, audiences, newsletters, and tasks. The JQ system is an operational control plane for agent sessions, approvals, audit evidence, and intervention. They solve adjacent problems, but they are not the same product.

What the Build Really Took

Matt used Codex inside ChatGPT to create the initial application skeleton. The first pass took roughly 15 minutes, but it contained filler content, dead links, and an incomplete newsletter setup. He then spent several hours testing, prompting, debugging, and refining the result, including a dark mode and substantial changes to individual modules.

This is a healthy example of vibe coding because the work did not stop when the interface appeared. Matt clicked through the app, found broken behavior, clarified what each page should do, and kept iterating until the dashboard supported a real daily workflow. AI compressed implementation time; it did not remove product judgment or verification.

The Control Center Feature Map

The dashboard's value comes from putting these modules beside each other. A new mention can become a follow-up task. A fast-growing source can change an industry watchlist. A newsletter item can influence the daily brief. The interface reduces context switching while keeping the underlying evidence available for review.

How the Data Flows

1. You define the scope. Add industry URLs and topics, brand names and handles, audience profiles, reminders, tasks, and optional provider credentials.
2. Collectors retrieve public data. The app checks pages, common RSS paths, robots files, sitemaps, news search, and supported public profile pages.
3. Deterministic checks establish evidence. Mention discovery does not treat an AI snippet as proof. The current code fetches the direct canonical page and requires literal identity evidence.
4. Optional AI ranks or summarizes. A configured cloud or local model can improve relevance and compression, with deterministic fallback where supported.
5. SQLite keeps the working history. Settings, collection state, snapshots, and extracted records remain in the local application-data directory.
6. The Today page compresses the result. Instead of opening every source, you review a smaller set of priority signals and move relevant items into action.

Collectors run shortly after startup, roughly every 15 minutes while the app remains open, and when a module is refreshed. The first sitemap scan establishes a baseline, so later runs can focus on changes rather than presenting an entire site as newly discovered.

Install It in Three Commands

The current repository requires Node.js 24.19 or newer, npm, Git, and a modern desktop browser. After installing those prerequisites, the documented path is:

git clone https://github.com/mreflow/control-center.git
cd control-center
npm run launch

The launcher installs locked dependencies when necessary, rebuilds after source changes, starts a loopback-only server, performs a health check, and opens http://127.0.0.1:3000. You can also download the repository ZIP if Git is unavailable.

You can ask Codex or Claude Code to perform the installation, as Matt does in the video, but that is optional. The direct commands are short enough to inspect and give you a clearer record of what changed on the machine.

Configure the Non-AI System First

Begin with the smallest useful monitoring loop. This separates collection problems from model problems and prevents you from paying an LLM to summarize bad inputs.

1. Add one industry source. Use a public homepage or feed and a short list of topics that genuinely affect a current decision.
2. Define one brand identity. Add the exact brand name, handles, domains, strong identity anchors, and negative contexts that commonly create false positives.
3. Add one audience profile. Confirm that the displayed total matches the public page before adding more networks.
4. Create three reminders or tasks. Use work you already repeat, not aspirational categories that will become dashboard clutter.
5. Run a full collection cycle. Inspect links and evidence manually. An unavailable source should appear as unavailable, not as a misleading zero.
6. Tune the daily brief. Keep the count small enough that reviewing it changes what you do.

The mention system has deliberate limits on names, handles, sites, anchors, and negative contexts. Those constraints encourage a precise identity definition. They also make false-positive review manageable, which matters more than collecting the largest possible pile of links.

Add AI Only Where It Earns Its Place

Control Center can use OpenAI, Anthropic, Gemini, Grok, or supported local runtimes for curation. The model is a ranking and summarization layer, not the source of truth. Public collectors and direct-page verification should establish what happened; AI should help decide what appears important.

For a cloud provider, create a dedicated project or key with the narrowest available permissions, a spending limit, and a name that identifies this application. Do not reuse a personal master key. The video briefly demonstrates a broadly permissioned key and deletes it afterward; a persistent installation should use least privilege from the start.

For local inference, the repository documents LM Studio and Ollama. Control Center does not install, download, or load a model. Start the runtime yourself, load a model that fits the machine, and expose only the documented loopback endpoint.

Gmail and Newsletter Intelligence

The newsletter module is the main feature that currently requires an AI provider. It connects to Gmail with read-only OAuth, extracts candidate stories, and uses the configured model to curate them. According to the repository documentation, it does not send, label, delete, archive, or mark messages as read.

Raw message bodies are not stored. The local database keeps message metadata, a body hash, and extracted stories, while subscriber-specific email addresses and links are masked before model processing. That reduces exposure, but it does not make the integration risk-free: newsletter content may still contain sensitive commercial context.

Google classifies gmail.readonly as a restricted scope. A private testing setup may require periodic reauthorization, while a shared application can trigger Google verification requirements. Treat the Gmail connector as its own deployment project, with an explicit OAuth client, documented users, revocation instructions, and a test mailbox before connecting a primary business inbox.

Privacy, Secrets, and Backups

The launcher binds the server to 127.0.0.1 and rejects foreign Host and Origin values. That is a strong local default: another device on the network cannot simply browse to the dashboard. The application also keeps cloud-provider keys server-side instead of shipping them to browser code.

Local-first does not mean encrypted-by-default. The repository warns that API keys and OAuth tokens stored in settings.json are not encrypted at rest. Anyone or any process with access to the operating-system account may be able to read them. Use full-disk encryption, a locked user account, dedicated low-privilege keys, and prompt revocation if a machine or backup is exposed.

Run npm run backup before upgrades and before changing connectors. Store that archive like a secrets file because it may contain OAuth tokens and API keys. Test restoration on a separate user profile rather than discovering during an incident that the backup is incomplete.

The repository also documents an optional private connector bridge. Labels in the settings interface do not magically authorize Slack, Granola, or another service, and a standalone dashboard does not inherit connectors from Codex. Every external integration still needs explicit setup, credentials, permissions, and a failure path.

Local by Default, Hosted Only With Controls

The video discusses the possibility of putting the app online. The current repository's documented safe path is local operation, and its security guidance explicitly says not to expose the server through a network proxy without adding authentication.

A remote copy is therefore a small software deployment, not a checkbox. If mobile access is the goal, use a properly authenticated private access layer and preserve the application's host and origin protections. Do not forward port 3000 directly to the public internet.

A Seven-Day Rollout That Produces Evidence

1. Day 1: install and back up. Run the launcher, complete the first-run screen, verify the loopback address, and create an initial backup.
2. Day 2: configure industry monitoring. Add one source and three decision-relevant topics. Inspect the links before adjusting filters.
3. Day 3: define brand identity. Add exact names, handles, domains, anchors, and exclusions. Label false positives instead of accepting every search result.
4. Day 4: add audience profiles. Start with two networks and compare the dashboard against their public pages. Do not treat combined totals as deduplicated people.
5. Day 5: move recurring work in. Add the reminders and tasks you already perform every week, each with a clear completion condition.
6. Day 6: evaluate AI curation. Configure a capped cloud key or a local model, compare ranked and deterministic results, and record whether it saves review time.
7. Day 7: decide on Gmail. Use a test mailbox first. Connect a real inbox only after reviewing scopes, storage, model routing, and revocation.

At the end of the week, remove any module that has not changed a decision. A control center should compress operations, not become another destination you feel obligated to check.

Video Chapters

Verdict

Control Center is valuable because it treats AI as an optional layer over a comprehensible operating system. The app can collect public sources, track tasks, and preserve history without a model. When AI is enabled, it helps prioritize the evidence instead of inventing the evidence.

Its limits are equally important. Public social totals are best effort. Newsletter processing expands the privacy surface. Local secrets are not encrypted at rest. A hosted version needs authentication and proper operations. And the initial 15-minute build became useful only after hours of human testing and correction.

The winning pattern is simple: centralize the signals, verify the collection, keep the raw source visible, and automate only the judgment step that repeatedly consumes attention. That is a realistic way for a free local app to help run a business without pretending the business no longer needs an operator.

Sources and Links

• Matt Wolfe: I Built a FREE App That Runs Your Entire Business
• Control Center repository, README, and security policy
• Control Center MIT License
• FutureTools and Matt Wolfe on X
• LM Studio and Ollama

This article distinguishes the 26 August 2026 video demonstration from the repository state reviewed on 6 September 2026. Recheck the README and security documentation before installing, updating, connecting private data, or changing the network boundary.