ChatGPT Local Supervisor Bridge

Let the ChatGPT web interface safely view and operate the local projects you explicitly open up, via OpenAI's official Secure MCP Tunnel.

It suits a workflow like this: ChatGPT handles the big picture — surveying the project, checking uncommitted progress, reviewing diffs, and writing work orders; a local Agent handles the actual work. When necessary, ChatGPT can also directly modify files within the allowed scope, run the project's existing checks, and view local previews.

Windows-first, zero third-party dependencies for Node.js. Not an official OpenAI project; the tunnel client uses OpenAI's official open-source project.

What it can do

• Dynamically list configured projects and all their Git worktrees.

• Read files, search text, view Git status, diff, log, and commit contents.

• Create files; overwriting an existing file requires the SHA-256 returned by the most recent read.

• Precisely replace unique text fragments, preventing accidental changes in multiple places.

• Deletion is changed to moving into the bridge's own recoverable area, with restore support.

• Only commit explicitly listed files; refuse to sneak in unrelated pre-staged files.

• Only allow non-force-push of the current branch, and require an explicit confirmation phrase.

• Only run the project's existing check/test/lint/typecheck/build/verify scripts.

• Only start the project's existing dev/start/preview scripts, and can read logs and stop processes.

• Capture localhost pages to assist with web-based quality checks.

It does not have tools for arbitrary Shell, force push, hard reset, merge, permanent deletion, or reading secrets.

Related MCP server: OpenAI Secure MCP Tunnel

Security boundaries

ChatGPT web
    │
    ▼
OpenAI-hosted Secure MCP Tunnel endpoint
    ▲
    │ outbound HTTPS only
    │
tunnel-client on your PC
    │ local stdio
    ▼
this bridge ── allowlisted projects and Git worktrees
              denyRoots, secret filters, SHA write guard

The server enforces the following rules; they cannot be bypassed with prompt tricks alone:

• Only the project root directories in config.json and their Git worktrees are accessible.

• Directories under denyRoots are always rejected.

• .env, credentials, tokens, certificates, private keys, .ssh, and internal .git directories are rejected.

• Symbolic links or junctions cannot escape the workspace.

• The bridge's own source code, configuration, runtime key, and logs cannot be read or modified by the bridge.

See the full threat model in SECURITY.md.

Plans and Fees

This project does not call the Responses API or Chat Completions API; model inference happens in the normal ChatGPT webchat conversation. The Platform runtime API key is only used by tunnel-client to authenticate to the OpenAI Tunnel control plane.

The public version was tested with read/write operations on the ChatGPT Pro webchat on 2026-08-22. For Plus or other plans, don't just rely on the plan name: your account actually needs to show the following entry points:

1. Developer mode;

2. Creating custom plugins/apps;

3. Tunnel selectable in Connection;

4. The target chat allows calling that plugin's write tools.

OpenAI may adjust the feature rollout, and team workspaces may also be under admin control. Therefore this project does not promise that all Plus accounts have these entry points; rely on your current account interface and one real low-risk read/write test.

Prerequisites

• Windows 10/11;

• Node.js 20 or newer;

• Git;

• OpenAI official tunnel-client Windows version;

• A Secure MCP Tunnel;

• A runtime API key with only Tunnels Read + Use permissions;

• Developer mode and custom plugin entry points available in ChatGPT.

Official resources:

• Secure MCP Tunnel documentation

• OpenAI tunnel-client source and releases

• ChatGPT / Codex MCP documentation

Quick Start

git clone https://github.com/VITASID57/chatgpt-local-supervisor-bridge.git
cd chatgpt-local-supervisor-bridge

Download the Windows tunnel-client.exe from the official Release and place it in:

vendor\tunnel-client.exe

Run initialization. The key input is not displayed and is encrypted to the current user with Windows DPAPI:

.\scripts\setup.ps1

Edit the generated config.json, only fill in the projects you're willing to hand over to ChatGPT, and put all private directories into denyRoots. Then check:

.\scripts\start-tunnel.ps1 -Mode doctor
npm run check

Start in the foreground:

.\scripts\start-tunnel.ps1

After confirming the connection is normal, you can install the login auto-start:

.\scripts\install-autostart.ps1

The full connection steps for the ChatGPT webchat are in Windows Chinese installation guide.

Recommended first prompt

只使用 Local Supervisor Bridge。先调用 list_workspaces，选择目标项目，
再读取项目规则、NOW/README、Git 状态和未提交差异。
先给出当前事实、风险和下一张施工卡；除非我明确要求，否则先不要修改文件。

For the first write, only create a trivial acceptance file, then use read_file to read it back and verify the SHA-256. After acceptance, clean it up with move_to_trash.

Stopping and Revoking

.\scripts\uninstall-autostart.ps1

This stops and removes the login task, but keeps the source, configuration, and DPAPI-encrypted key. For full deactivation, you should also revoke the runtime key on the OpenAI Platform and delete the Tunnel you no longer use.

Development

npm test
npm run smoke
npm run check
.\scripts\verify-public.ps1

Issues and PRs are welcome. Contribution rules are in CONTRIBUTING.md.

License

MIT. OpenAI tunnel-client is not included in this repository and is governed by its own Apache-2.0 license.