OpenAI Secure MCP Tunnel

A Turborepo monorepo: mcp-tunnel exposes local stdio MCP services to the workspace through the OpenAI Tunnel Client. Core tools and optional extensions are provided as workspace packages, and new standalone apps/mcp-* combined apps can be added in the future.

Architecture

apps/mcp-tunnel                   当前 Tunnel 专用 MCP 应用和运行脚本
packages/mcp-tool-runtime         通用 tool 注册、配置与结果协议
packages/mcp-tools-core           read / write / edit / bash
packages/mcp-tools-extra          read_image / read_many / edit_many / notify
packages/mcp-image-adapter        图片读取和 sharp 转码（按需加载）
packages/pi-adapter               工作区文件、编辑、命令和路径安全适配

The development environment uses unbuild --stub via pnpm stub (also executed in postinstall), so there is no need to manually build after each package modification.

Related MCP server: localmcpcoder

Current Tunnel App Configuration

All runtime files are located in apps/mcp-tunnel/: .env.local, the Tunnel Client binary, logs, and dist-tunnel-client/. Create the app's .env.local:

CONTROL_PLANE_TUNNEL_ID=tunnel_...
CONTROL_PLANE_API_KEY=sk-...
# 可选；相对路径以 apps/mcp-tunnel 为基准
TUNNEL_CLIENT_PATH=./tunnel-client.exe
MCP_WORKSPACE_ROOT=.
# 未配置时只启用 core；配置时仅启用列出的工具
TOOLS_ENABLED=read,write,edit,bash,read_image,read_many,edit_many,notify

https://platform.openai.com/settings/organization/tunnels Create a tunnel here -> CONTROL_PLANE_TUNNEL_ID

https://platform.openai.com/settings/organization/api-keys Create an api-key here -> CONTROL_PLANE_API_KEY

https://chatgpt.com/plugins Add plugins here after starting locally

When TOOLS_ENABLED is not configured, only read, write, edit, and bash are enabled. When configured as empty, no tools are exposed; when configured as non-empty, only the listed tools are exposed. Extension code is loaded via dynamic import, and read_image with its sharp dependency is only loaded when explicitly enabled.

MCP_WORKSPACE_ROOT supports comma-separated directories and glob patterns, e.g. D:/Workspace/ai-projects/*,C:/Users/Maple/.codex-cc. Relative paths are resolved against the first matching directory, while absolute paths can access files within any matching directory.

read_image supports PNG, JPEG, GIF, and WebP; relative paths are constrained by workspace boundaries, while absolute paths retain the compatibility behavior of reading local images. Large images are automatically resized/converted to WebP. edit_many executes sequentially and is non-atomic.

Startup and Deployment

pnpm start:mcp-tunnel
pnpm start:mcp-tunnel:pm2
pnpm stop:mcp-tunnel:pm2
pnpm build:mcp-tunnel

The first command starts the Tunnel in the foreground. The second command uses the globally installed PM2 to manage the app; the third command stops and removes its PM2 record; run npm install --global pm2 first. PM2 is not part of the project dependencies and is not bundled into the standalone package. On Windows, a PM2-managed Tunnel Client hides its resident console window; foreground startup still keeps output visible.

The standalone package is generated in apps/mcp-tunnel/dist-tunnel-client/ and does not include .env.local, the Tunnel Client binary, or node_modules. After placing credentials and the binary into that directory, run node start-cli.js; to run node start-pm2.js, the host machine also needs global PM2.

macOS launchd is an optional compatibility layer:

pnpm --filter @workspace/mcp-tunnel install:macos-launchd

It only invokes the PM2 driver script at login; the actual residency and restarts are managed by PM2.

Development and Verification

pnpm stub
pnpm check
pnpm build
pnpm test

Do not commit the app's .env.local, Tunnel credentials, or binaries.