Túnel Chat MCP
Connects ChatGPT to private local files through an OpenAI Secure MCP Tunnel without opening inbound ports. Exposes tools to list folders and files, read text or binary files in chunks, create/overwrite files with concurrency protection, create folders and copy, move, rename or delete whole trees, send deleted items to a recoverable trash, save PNG/JPEG/WebP images that ChatGPT produces, and create/restore verified backups, all restricted to a single explicitly authorized folder with per-profile permissions, one-time local approvals and a control panel.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Túnel Chat MCPlee las notas de la carpeta proyectos y haz copia de seguridad"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Túnel Chat MCP
Servidor MCP local para trabajar con archivos privados desde ChatGPT mediante OpenAI Secure MCP Tunnel, sin abrir puertos entrantes ni publicar el servidor local en Internet.
Proyecto comunitario independiente; no es un producto oficial de OpenAI.
Estado: versión local funcional y endurecida en Windows, distribuida bajo Apache-2.0. La implementación de macOS y Linux tiene pruebas automáticas, pero aún requiere validación funcional en equipos reales y se ofrece como compatibilidad experimental.
Qué permite hacer
Listar carpetas y archivos.
Leer texto o archivos binarios por fragmentos.
Crear y sobrescribir archivos con protección frente a cambios concurrentes.
Crear carpetas y copiar, mover, renombrar o eliminar árboles completos.
Mover archivos y carpetas eliminados a una papelera recuperable.
Guardar en el PC imágenes PNG, JPEG o WebP que ChatGPT entregue a la app.
Crear y restaurar copias de seguridad verificadas.
Exigir una aprobación local para cada escritura o permitir un modo autónomo.
Activar permisos por 10, 30 o 60 minutos, o sin límite temporal.
Mantener varios perfiles de carpetas completamente aislados.
Controlar el túnel, el inicio automático nativo y los permisos desde un panel ES/EN.
No existe ninguna herramienta para ejecutar comandos, PowerShell o programas.
Related MCP server: Kastor
Modelo de seguridad
Solo se acepta una carpeta explícitamente autorizada; nunca una unidad completa, Windows, el propio proyecto ni una carpeta que lo contenga.
Cada perfil tiene permisos, aprobaciones y copias independientes, ligados a la huella de su carpeta real.
Las aprobaciones son de un solo uso y se consumen de forma atómica.
Se bloquean escapes con
.., rutas absolutas, enlaces simbólicos, enlaces duros, uniones, flujos ADS, nombres reservados de Windows, secretos habituales y los datos del propio túnel.Los archivos con más de un enlace duro se rechazan aunque todos sus nombres parezcan estar dentro de la carpeta autorizada: no es posible demostrarlo con
realpath. Los enlaces temporales usados internamente para crear archivos atómicamente se eliminan antes de finalizar la operación.Las operaciones recursivas aceptan como máximo 10.000 elementos y 512 MiB, calculan una huella del árbol y vuelven a verificarla antes y después de mover o copiar. Cualquier enlace, unión, archivo especial o cambio concurrente hace que la operación falle de forma cerrada.
Las imágenes de ChatGPT se crean como archivos nuevos, con un máximo de 20 MiB. Solo se descargan por HTTPS, se comprueba su firma real y se bloquean puertos no estándar, credenciales en URL, redirecciones excesivas y direcciones locales, privadas o reservadas para evitar SSRF.
Las copias llevan perfil, huella de carpeta y SHA-256. Los metadatos se validan antes de listar, limpiar o restaurar.
La credencial del plano de control se protege con DPAPI, Keychain o Secret Service, según el sistema. Durante la ejecución se retira del entorno del controlador, solo se añade deliberadamente al proceso de
tunnel-clienty se elimina antes de cargar el código del servidor MCP o iniciar procesos auxiliares. La decisión está documentada en ADR-001.El panel escucha exclusivamente en
127.0.0.1, usa token efímero anti-CSRF, política CSP y cabeceras defensivas.La auditoría rota automáticamente y encadena criptográficamente sus eventos para detectar modificaciones accidentales o posteriores.
El límite final de confianza es la cuenta local del sistema. Otro proceso malicioso ejecutado como el mismo usuario podría manipular archivos o procesos locales.
Datos privados
El código no contiene perfiles, rutas personales, credenciales, aprobaciones, copias ni registros. Las ubicaciones predeterminadas son:
%LOCALAPPDATA%\OpenAI-Secure-MCP-Tunnel
~/Library/Application Support/OpenAI-Secure-MCP-Tunnel
${XDG_STATE_HOME:-~/.local/state}/openai-secure-mcp-tunnelLa carpeta .tunnel-client, vendor, .env y los registros están excluidos por
.gitignore. Antes de hacer público un repositorio, revisa también todo su historial
Git y rota cualquier credencial que haya llegado a un commit.
Requisitos
Windows 10/11, macOS o Linux con sesión de usuario.
Node.js 22 o posterior.
Acceso a Secure MCP Tunnel en la organización de OpenAI.
Una copia autorizada de
tunnel-client. En Windows se detecta la copia devendor\tunnel-client\tunnel-client.exe; en macOS/Linux se indica con--clientoMCP_TUNNEL_CLIENT_PATHsi no está enPATH.Keychain disponible en macOS o un proveedor Secret Service desbloqueado en Linux.
Primera configuración
Guarda la credencial sin incluirla en argumentos:
node cli.mjs credential setConfigura y verifica el cliente:
node cli.mjs setup --workspace "RUTA" --tunnel-id "tunnel_<32_caracteres_minusculos_o_digitos>" --client "RUTA_CLIENTE"Inicia el servicio:
node cli.mjs runCon el panel iniciado, el ciclo de vida también puede controlarse desde terminal:
node cli.mjs tunnel status
node cli.mjs tunnel stop
node cli.mjs tunnel start
node cli.mjs tunnel restartEn Windows se conservan los flujos compatibles de PowerShell:
cd "<RUTA_DEL_PROYECTO>"
.\setup-tunnel.ps1Comprueba que el diagnóstico termina en RESULT ok.
setup-tunnel.ps1 configura el MCP con mcp-launcher.mjs, que limpia las
credenciales de OpenAI antes de importar server.mjs.
Inicio manual
cd "<RUTA_DEL_PROYECTO>"
.\start-tunnel.ps1El iniciador pide la carpeta autorizada. Pulsa Enter para conservar la guardada o
escribe otra. Mantén abierta la ventana: Ctrl+C apaga el controlador y el túnel.
Panel principal: se abre automáticamente al iniciar de forma interactiva. Si el túnel se inició en segundo plano, ejecuta
.\open-panel.ps1.Panel técnico del cliente: http://127.0.0.1:8082/ui
Preparación: http://127.0.0.1:8080/readyz
Conectar desde ChatGPT.com
Consulta el tutorial Conectar Túnel Chat MCP con ChatGPT.com. Explica paso a paso cómo crear la app en modo desarrollador, seleccionar el túnel, probar primero el acceso de solo lectura, aprobar una modificación y solucionar problemas de conexión.
Inicio automático
Después de configurar el túnel:
node cli.mjs autostart enable
node cli.mjs autostart status
node cli.mjs autostart disableEn Windows también siguen disponibles:
.\enable-autostart.ps1Para desactivarlo:
.\disable-autostart.ps1También puede cambiarse desde el panel.
Para retirar el arranque y la credencial nativa sin borrar registros ni copias:
node cli.mjs uninstall --yesEn macOS/Linux, la desinstalación comprueba que el servicio esté detenido y que la credencial haya desaparecido. Si el gestor de servicios falla, conserva la definición hasta poder confirmar la parada. Si el almacén está bloqueado o no responde, informa del error y no anuncia éxito. Desbloquea el almacén y repite la operación; en macOS hace falta una sesión gráfica disponible. La operación es idempotente cuando se puede confirmar que servicio y credencial ya no existen. Las instancias iniciadas manualmente se detienen desde su panel o terminal.
Panel de control
El panel está en español por defecto y permite cambiar a inglés. Los permisos de lectura, creación, modificación y eliminación se aplican inmediatamente. La aprobación por operación, protección sensible, copias y retención son independientes para cada perfil.
Al cambiar de perfil se reinicia el túnel si estaba activo. Las aprobaciones del perfil anterior no aparecen ni pueden utilizarse en el nuevo.
El panel usa un enlace efímero cuyo secreto viaja en el fragmento # y se elimina
de la barra de direcciones al cargar. El enlace se guarda en la carpeta privada y
no se incrusta en el HTML público de 127.0.0.1.
Pruebas
npm testLas pruebas usan carpetas temporales y cubren permisos, lectura binaria, escapes de ruta, ADS, secretos, copias, papelera, árboles de carpetas, entradas de archivo de ChatGPT, bloqueo SSRF, aislamiento de perfiles y consumo simultáneo de aprobaciones.
Archivos principales
cli.mjs: interfaz portátil de configuración, inicio y autostart.platform-runtime.mjs: almacenes de credenciales y servicios nativos.control-api-contract.mjs: contrato validado de/api/v1.control-panel.mjs: backend y ciclo de vida local.panel/: interfaz adaptable ES/EN.server.mjs: herramientas MCP y límites del espacio autorizado.workspace-tree.mjs: huellas, límites y operaciones seguras con árboles.chatgpt-files.mjs: descarga limitada y validación de imágenes de ChatGPT.mcp-launcher.mjs: saneamiento del entorno antes de cargar el MCP.secure-store.mjs: estado por perfil, bloqueo atómico y auditoría.harden-private-data.ps1: restringe los ACL de los datos privados.open-panel.ps1: abre el enlace efímero del panel desde el almacén privado.start-tunnel.ps1: inicio manual.enable-autostart.ps1ydisable-autostart.ps1: inicio con Windows.SECURITY.md: política de seguridad y divulgación responsable.SECURITY-AUDIT.md: última auditoría y riesgos residuales conocidos.CHANGELOG.md: cambios y alcance de cada versión pública.CONTRIBUTING.md: proceso seguro para incidencias y contribuciones.CODE_OF_CONDUCT.md: normas de participación y canal privado de aplicación.TUTORIAL-CHATGPT.md: conexión, prueba y desconexión desde ChatGPT.com.docs/control-api-v1.md: interfaz local versionada.docs/decisions/: decisiones de arquitectura y sus límites de seguridad.
Estado de compatibilidad
Entorno | Estado | Validación actual |
Windows 10/11 | Validado | Uso funcional real, DPAPI, Programador de tareas y pruebas automáticas. |
macOS | Experimental | Pruebas automáticas y de contrato para Keychain y |
Linux de escritorio | Experimental | Pruebas automáticas y de contrato para Secret Service y |
La integración continua ejecuta las pruebas en Windows, macOS y Ubuntu ante cada cambio y también realiza comprobaciones de seguridad semanales. Estas pruebas no sustituyen un ciclo real con ChatGPT, el almacén de credenciales y el servicio de inicio de cada sistema.
tunnel-client es una dependencia externa y no se distribuye en este repositorio.
Debe descargarse desde el enlace indicado por la
documentación oficial de OpenAI.
La carpeta vendor/ permanece excluida de Git y la licencia Apache-2.0 de este
proyecto no cubre ese cliente.
Los fallos de macOS o Linux pueden comunicarse mediante GitHub Issues, indicando sistema, versión, arquitectura, versión de Node.js y pasos para reproducirlos. No incluyas claves, identificadores de túnel, rutas personales ni contenido privado.
Licencia
Este proyecto se distribuye bajo la Apache License 2.0. El archivo
NOTICE identifica al titular inicial. La licencia no cubre tunnel-client.exe,
marcas de OpenAI ni dependencias de terceros.
Available Tools
11 toolscomprobar_estado_localComprobar estado localARead-onlyIdempotent
Devuelve estado, carpeta, permisos y protecciones activas.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already establish that this is a safe, read-only, idempotent, non-destructive operation. The description adds useful behavioral context by listing the returned categories (state, folder, permissions, active protections), which helps the agent understand what information the tool surfaces beyond generic safety metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every listed item (state, folder, permissions, active protections) contributes to telling the agent what the tool returns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only diagnostic tool with rich annotations, the description is adequate but not complete. It lists return categories without explaining what 'local state' means, how the data is structured, or when the tool should be invoked, and there is no output schema to compensate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there are no parameter semantics to explain. Per the scoring baseline for parameterless tools, a 4 is appropriate even though the empty schema fully covers the input structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear retrieval verb ('Devuelve') and names specific return categories: state, folder, permissions, and active protections. It does not explicitly differentiate itself from the file-management siblings, but none of them are similarly scoped diagnostic tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It neither states a use case nor names sibling tools or conditions for selection, leaving the agent to infer usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
copiar_elementoCopiar archivo o carpetaC
Copia un archivo o una carpeta completa a una ruta nueva, verificando limites, enlaces e integridad.
| Name | Required | Description | Default |
|---|---|---|---|
| origen | Yes | ||
| destino | Yes | ||
| confirmar | No | ||
| aprobacion_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already indicate this is a non-read-only, non-idempotent, non-destructive, closed-world operation. The description adds some behavioral context by mentioning verification of limits, links, and integrity, but it does not explain overwrite behavior, permission requirements, or how confirmar/aprobacion_id affect execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no filler or redundancy. It is appropriately sized, though the brevity contributes to the gaps in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter mutation tool with 0% schema description coverage, no output schema, and an approval parameter, the description is too sparse. It omits confirmation/approval semantics, overwrite behavior, and return-value expectations, leaving the agent with insufficient operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, but it does not name or explain any of the four parameters. It only implies a source and destination concept, leaving confirmar and aprobacion_id entirely unaddressed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (copia) and resource (archivo o carpeta completa), plus the target (a una ruta nueva). This clearly distinguishes it from mover_elemento, though it does not name the sibling or elaborate on scope limits.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. The description merely states what the tool does, not when an agent should choose it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
crear_carpetaCrear carpetaC
Crea una carpeta nueva dentro del espacio autorizado. No sobrescribe rutas existentes.
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | Yes | ||
| confirmar | No | ||
| aprobacion_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare write operation (readOnlyHint=false), non-destructive, non-idempotent, and closed-world. The description adds a useful constraint ('No sobrescribe rutas existentes'), but does not explain what happens if the path exists (error? duplicate?), nor mentions the confirmar or aprobacion_id parameters or any confirmation requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero waste. The purpose is front-loaded, followed by a key behavioral constraint. Perfectly sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With three parameters and no schema descriptions, the description should explain parameter semantics and the approval/confirmation workflow. It omits all of that, and there is no output schema to clarify returns. Incomplete for a tool that likely requires an approval ID.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does not mention any of the three parameters (ruta, confirmar, aprobacion_id), their formats, or their purposes. The only hint is 'dentro del espacio autorizado', which is vague and insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Crea una carpeta nueva') and adds scope ('dentro del espacio autorizado'). Clear what the tool does, but does not explicitly differentiate from siblings like eliminar_carpeta or mover_elemento beyond the obvious name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Does not mention prerequisites, when-not to use, or any sibling tool. Only states what it does.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
eliminar_archivoEliminar archivoBDestructive
Mueve un archivo a la papelera recuperable y crea copia si esta activada.
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | Yes | ||
| confirmar | No | ||
| aprobacion_id | No | ||
| sha256_esperado | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true, and the description usefully qualifies this by clarifying the deletion is recoverable (papelera recuperable) and may create a backup copy. That nuance materially changes how an agent should treat the risk, adding value beyond the raw hint. It still omits the sha256 verification, confirmation, and approval requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the action and its key behavioral qualifier with zero filler. Well-sized for the operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A destructive mutation with an approval-id parameter and a required hash precondition, no output schema, and 0% schema coverage. The description leaves the whole safety/authorization workflow and the meaning of the required hash unexplained, which is a substantial gap for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% with 4 parameters, so the description must compensate and it does not. The required sha256_esperado (an optimistic-concurrency/verification token), confirmar, and aprobacion_id (an approval workflow) are never mentioned or explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it moves a file to a recoverable trash, not a permanent delete. This distinguishes it conceptually from the removal implied by eliminar_carpeta, though it never names that sibling. Purpose is clear but sibling differentiation is left implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus eliminar_carpeta, nor when the trash copy versus backup copy applies. No prerequisites or exclusions are stated. The agent must infer all routing decisions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
eliminar_carpetaEliminar carpetaBDestructive
Mueve una carpeta completa a la papelera local recuperable tras verificar todo su contenido.
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | Yes | ||
| confirmar | No | ||
| aprobacion_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, but the description adds valuable context beyond them: the deletion is a move to a recoverable local trash and is preceded by content verification. What is missing is any disclosure of the confirmation/approval requirements implied by confirmar and aprobacion_id.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense, front-loaded sentence that packs the action, scope, and recoverability note without waste. It is efficient, though very terse given the tool's operational complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation with three undocumented parameters, no output schema, and a required approval identifier, the description omits the confirmation/approval mechanics entirely. Annotations cover safety flags, but the operational workflow an agent needs to call this correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across three parameters, so the description must carry the burden and largely fails. It never mentions ruta, confirmar, or aprobacion_id, leaving the confirmation and UUID-approval workflow completely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (mueve/elimina) and resource (una carpeta completa), and clarifies the outcome is a recoverable local trash rather than permanent deletion. It implicitly distinguishes itself from eliminar_archivo by scoping to folders, but does not name or route to that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance, and no mention of prerequisites despite the presence of confirmar and aprobacion_id parameters that clearly gate the operation. The agent must infer the deletion workflow entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guardar_imagen_chatgptGuardar imagen de ChatGPTC
Descarga de forma segura una imagen PNG, JPEG o WebP recibida por ChatGPT y la crea dentro de la carpeta autorizada.
| Name | Required | Description | Default |
|---|---|---|---|
| imagen | Yes | ||
| confirmar | No | ||
| ruta_destino | Yes | ||
| aprobacion_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=false, readOnlyHint=false, openWorldHint=true, but the description does not explain whether existing files are overwritten in ruta_destino, how destination conflicts are handled, or what approval/confirmation entails. 'De forma segura' is vague and not backed by concrete behavior. It adds almost nothing beyond annotations for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One efficient sentence, front-loaded with the action. It is very short but not wasteful; the problem is what it omits rather than verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 parameters at 0% schema description coverage, a nested object, no output schema, and a write operation, the description is insufficient. It does not document the expected shape of the 'imagen' object, the confirmation/approval flow, or what happens to an existing destination file.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for 4 parameters, including a nested 'imagen' object and optional 'confirmar'/'aprobacion_id'. The description mentions only the image format, adding no meaning to any parameter; a low-coverage schema demands compensation that is absent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource: 'Descarga... una imagen... y la crea dentro de la carpeta autorizada', with supported formats (PNG, JPEG, WebP) and source (ChatGPT). It distinguishes itself from file siblings like crear_carpeta or mover_elemento. It does not explicitly differentiate from other write tools, but the niche (saving a ChatGPT image) is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus alternatives, and no explanation of prerequisites such as the 'confirmar' or 'aprobacion_id' flow. For a write tool with confirmation parameters, the agent is left to infer when confirmation is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
leer_archivoLeer archivoBRead-onlyIdempotent
Lee archivos autorizados por fragmentos de hasta 2 MiB. La huella completa puede omitirse para evitar recorrer archivos grandes.
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | Yes | ||
| formato | No | ||
| max_bytes | No | ||
| offset_bytes | No | ||
| incluir_sha256 | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already declaring readOnlyHint/idempotentHint/destructiveHint, the description still adds genuinely useful behavior: reads are chunked at 2 MiB, and the full fingerprint (sha256) can be skipped to avoid traversing large files. That is real context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with no filler, front-loaded with the core action and the size constraint. Efficient, though it leaves no room for the missing parameter meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter read tool with no output schema and zero schema descriptions, the definition is too thin: pagination via offset_bytes, output format via formato, and the base64/texto distinction are never explained, and return shape is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden, yet it only hints at two of the five parameters (max_bytes via 'hasta 2 MiB', incluir_sha256 via 'huella completa'). ruta, formato, and offset_bytes remain entirely undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (lee) and resource (archivos) plus a scoping detail (fragmentos de hasta 2 MiB). The read operation is unambiguous and clearly distinct from the write/delete siblings, though it never explicitly names a sibling it should be preferred over listar_archivos or modificar_archivo.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives like listar_archivos, and states no prerequisites (what makes a file 'autorizado'). The chunking detail is a behavioral fact, not usage-direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listar_archivosListar archivos y carpetasCRead-onlyIdempotent
Lista de forma no recursiva hasta 500 elementos autorizados.
| Name | Required | Description | Default |
|---|---|---|---|
| ruta | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, and non-open-world, so the safety profile is covered. The description adds genuinely useful traits beyond that – non-recursive traversal and a 500-item ceiling – but omits pagination/truncation behavior (what happens beyond 500) and says nothing about the 'autorizados' permission scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste, but the brevity tips into under-specification given the undocumented ruta parameter and unclear truncation behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with full annotation coverage, the description covers the essential traversal constraint. However, the only parameter is entirely undocumented and the behavior at the 500-item boundary is unspecified, leaving gaps an agent would hit in practice.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single 'ruta' parameter, and the description never explains what ruta means, its default (it is optional, so listing presumably roots somewhere), or accepted path formats. With one undocumented parameter, the description fails to compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Lista) and resource (archivos/carpetas via the title) with key scope qualifiers: non-recursive and capped at 500. It is distinguishable from siblings like leer_archivo or eliminar_archivo, though the description itself never names an alternative to route between them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance and no mention of sibling tools. An agent gets the operational shape (non-recursive, max 500) but no context for choosing this over leer_archivo or listar_copias_seguridad.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listar_copias_seguridadListar copias de seguridadARead-onlyIdempotent
Lista las copias recuperables existentes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, covering the safety profile. The description adds only that listed copies are 'recuperables', a useful scoping detail, but does not describe return format, pagination, or what metadata is included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It communicates the essential action and scope immediately, which is appropriate for a simple listing operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, parameterless, and has comprehensive read-only annotations, so the description is nearly sufficient. However, without an output schema, it could say more about what a listed backup entry contains, such as names or timestamps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there are no parameter semantics to document. The baseline for a parameterless tool is 4, and nothing in the description is needed to compensate for schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Lista') and a specific resource ('copias recuperables existentes'), making clear it enumerates recoverable backups. It does not explicitly differentiate itself from sibling listing tools like listar_archivos, but the backup-specific scope is reasonably distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, no exclusions, and no alternatives among the many sibling file-management tools. An agent must infer that this tool applies only to backup copies rather than general files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
modificar_archivoCrear o modificar archivoCDestructive
Crea o sobrescribe un archivo. La primera llamada puede generar una solicitud de aprobacion local.
| Name | Required | Description | Default |
|---|---|---|---|
| modo | Yes | ||
| ruta | Yes | ||
| formato | No | ||
| confirmar | No | ||
| contenido | Yes | ||
| aprobacion_id | No | ||
| sha256_esperado | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false and idempotentHint=false, so the safety profile is covered. The description adds one genuinely new behavioral fact – the first call may trigger a local approval request – but says nothing about the confirmar/aprobacion_id flow, reversibility, or what happens to an existing file on overwrite.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action, with no filler. It is arguably too terse for a 7-parameter mutation tool, but as written every sentence carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive write tool with 7 undocumented parameters and no output schema, the description is far too thin. It omits the approval/confirmation mechanics hinted at by confirmar and aprobacion_id, and gives no sense of what the tool returns or how failure is signaled.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 7 parameters, so the description must compensate and largely does not. Only the overwrite concept loosely maps to the 'modo' enum; ruta, contenido, formato, confirmar, aprobacion_id and sha256_esperado are left entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('crea o sobrescribe un archivo'), which clearly separates it from read/delete/copy siblings such as leer_archivo or eliminar_archivo. It does not explicitly name an alternative, but the create/overwrite scope aligned with the 'modo' enum is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to choose this tool over siblings like guardar_imagen_chatgpt or copiar_elemento, nor any prerequisites for use. The only usage-adjacent statement is the approval-request note, which describes a side effect rather than guiding selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mover_elementoMover o renombrar archivo o carpetaBDestructive
Mueve un elemento a una ruta nueva. Sirve para cortar y pegar o para renombrar.
| Name | Required | Description | Default |
|---|---|---|---|
| origen | Yes | ||
| destino | Yes | ||
| confirmar | No | ||
| aprobacion_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, idempotentHint=false, so the safety profile is covered structurally. The description adds only the move/rename framing and says nothing about overwriting an existing destination, undoability, or the approval flow implied by the schema. Modest added value over annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action and then the use cases. No filler, nothing to cut.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation with no output schema and 4 undocumented parameters, the description is too thin. It omits overwrite behavior, failure modes, and the meaning of the approval parameter, leaving an agent unable to invoke it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for 4 parameters. 'origen' and 'destino' are loosely implied by 'a una ruta nueva', but 'confirmar' and especially 'aprobacion_id' (a UUID suggesting a confirmation/approval workflow) are completely unexplained in both schema and description. A destructive tool hiding an approval parameter is a real gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb+resource ('Mueve un elemento a una ruta nueva') and adds the two practical use cases (cut-and-paste, rename). It does not distinguish itself from the close sibling copiar_elemento, so it stops short of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The mention of 'cortar y pegar o renombrar' implies when the tool is useful, but there is no explicit routing guidance such as when to use this instead of copiar_elemento or eliminar_archivo. Usage is implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v3.2.1- First observed
comprobar_estado_local - First observed
copiar_elemento - First observed
crear_carpeta - First observed
eliminar_archivo - First observed
eliminar_carpeta - First observed
guardar_imagen_chatgpt - First observed
leer_archivo - First observed
listar_archivos - First observed
listar_copias_seguridad - First observed
modificar_archivo - First observed
mover_elemento
TDQS
Scored across 11 tools
Each tool targets a distinct file-system operation or server-state check; leer vs modificar vs eliminar vs copiar/mover are clearly separated. Minor potential overlap between 'listar_copias_seguridad' (backups) and general listing, but descriptions distinguish them.
Consistent verb_noun Spanish convention across all 11 tools (guardar_imagen, listar_copias, leer_archivo, crear_carpeta, copiar_elemento, mover_elemento, eliminar_archivo/carpeta). No mixing of conventions or styles.
11 tools is well within the ideal 3-15 range and maps naturally onto a file-management surface. Slightly more than minimal but each tool earns its place (backups, status, folder vs file distinction).
Covers full lifecycle: list, read, create/modify, delete (file and folder), copy, move, plus backup listing and local status. Rename is handled via mover_elemento; no obvious dead ends, though a restore-from-trash operation is implied but not exposed.
Maintenance
Related MCP Connectors
Browse and manage files in your Moxt AI workspace from any MCP client.
Persistent file storage for AI agents via MCP and curl. Upload, download, and version files.
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT to inspect and edit local projects through a secure MCP interface, offering workspace management, file operations, git integration, and safe command execution.5MIT
- AlicenseNot gradedqualityCmaintenanceLets ChatGPT or MCP clients work with files on your machine, with tools for reading, editing, searching, git operations, and safety checks.MIT
- AlicenseNot gradedqualityCmaintenanceEnables remote MCP clients like ChatGPT to run shell commands and manage files on your local machine via a Cloudflare tunnel, exposing tools for file operations, search, and task management.4MIT
- AlicenseNot gradedqualityDmaintenanceEnables ChatGPT to securely control a local workstation via an MCP tunnel, exposing 44 tools for file/project editing, git, process supervision, browser automation, and Office document handling across macOS, Linux, and Windows.7MIT