chatgpt-local-mcp-bridge
Provides read-only Git repository inspection, allowing agents to view the current status and diff of the configured workspace.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@chatgpt-local-mcp-bridgeWhat files are in the workspace and what's the current git status?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ChatGPT Local MCP Bridge
A narrow, read-only MCP server that lets ChatGPT Web inspect one local workspace through the official OpenAI Secure MCP Tunnel.
This repository is deliberately smaller than a general local-agent runtime. It has no Electron app, no shell tool, no file writes, no browser automation, no child MCP bridge, and no public HTTP listener.
What this gives us
ChatGPT Web (Developer mode)
|
| OpenAI Secure MCP Tunnel (outbound HTTPS)
v
Official tunnel-client on the local host
|
| MCP stdio
v
chatgpt-local-mcp-bridge
|
v
One allowlisted workspace (read-only)ChatGPT cannot connect to localhost directly. For a private MCP server on a developer machine, OpenAI documents Secure MCP Tunnel as the supported connection path. The tunnel keeps the MCP process private and forwards MCP requests over an outbound connection.
Related MCP server: Kastor
Current scope: v0.1.0
The bridge exposes exactly six read-only tools:
Tool | Purpose |
| Show the one configured workspace without exposing its full path |
| List bounded files/directories, skipping generated and sensitive paths |
| Read bounded UTF-8 text files under the workspace |
| Recursively search bounded text files while skipping noise |
| Run a fixed, read-only |
| Run a fixed, bounded, read-only |
There is intentionally no shell, write_file, delete, browser,
process_start, mcp_call, or arbitrary URL fetch tool in this version.
Local setup
Requirements:
Python 3.11+
Git for the read-only Git tools
An official
tunnel-clientbinary for the host OS if connecting ChatGPT Web
Create the isolated environment and install the project:
cd /home/mike/projects/chatgpt-local-mcp-bridge
python3 -m venv .venv
.venv/bin/python -m pip install --upgrade pip
.venv/bin/pip install -e '.[dev]'Choose one workspace explicitly:
export CHATGPT_BRIDGE_WORKSPACE="$HOME/projects/chatgpt-local-mcp-bridge"Run the local server directly:
.venv/bin/chatgpt-local-mcp-bridgeThis is an MCP stdio process. Its stdout is reserved for MCP protocol traffic; configuration errors go to stderr. Do not run it by opening it as an interactive CLI.
For this repository, the helper script sets the workspace to the repository root when no override is supplied:
./scripts/run-bridge.shConnect to ChatGPT Web
The concrete command below assumes the official tunnel-client runs in the
same WSL environment as the bridge. Use the official binary and current OpenAI
tunnel-client instructions for your host OS.
Create an OpenAI Platform tunnel and record its
tunnel_id.Create a restricted runtime key with Tunnels Read + Use.
Keep the key in the environment for the current process; do not commit it or put it in a YAML profile.
Initialize a stdio tunnel profile:
export CONTROL_PLANE_API_KEY='replace-for-this-shell-only'
export CHATGPT_BRIDGE_WORKSPACE="$HOME/projects/chatgpt-local-mcp-bridge"
tunnel-client init \
--sample sample_mcp_stdio_local \
--profile chatgpt-local-mcp-bridge \
--tunnel-id 'tunnel_replace_me' \
--mcp-command "$PWD/scripts/run-bridge.sh"Validate and run the tunnel:
tunnel-client doctor \
--profile chatgpt-local-mcp-bridge \
--explain
tunnel-client run --profile chatgpt-local-mcp-bridgeIn ChatGPT Web, enable Developer mode, create an app from the plus button, choose Tunnel under Connection, select the associated tunnel, and review the discovered tool list.
Start with a read-only smoke prompt:
Use the local MCP bridge to list the configured workspace, show its top-level
files, report Git status, and summarize the current diff. Do not modify anything.The ChatGPT workspace must be associated with the OpenAI Platform tunnel, and the account/workspace must have Developer mode enabled. Tunnel access and ChatGPT Developer mode are separate permissions.
Security model
This bridge uses a single canonical workspace root. Requested paths are resolved, checked for traversal and symlink escapes, and then filtered for common sensitive names. File and search results are bounded.
The bridge is not an OS sandbox. It is a narrow capability boundary for the first experiment. Any file content returned to ChatGPT can leave the local machine through the OpenAI tunnel. Use a disposable or non-sensitive workspace first.
Do not add shell or write tools until a separate approval design exists. A ChatGPT UI confirmation is not a substitute for server-side authorization or an OS/container boundary.
Tests and verification
Run the full local suite:
.venv/bin/pytestThe suite covers:
workspace containment and traversal rejection;
symlink escape rejection;
sensitive-path blocking;
bounded UTF-8 reads;
generated/sensitive directory filtering;
recursive text search;
fixed Git status/diff behavior;
real MCP stdio handshake, tool discovery, and tool invocation through the official Python MCP client.
Project status
This is a working local slice, not a claim that the ChatGPT account/tunnel has been connected end to end. The local MCP protocol is testable without credentials; ChatGPT Web connection still requires the user's OpenAI Platform permissions and tunnel setup.
See ROADMAP.md for the deliberate next steps and stop line.
Available Tools
6 toolsgit_diffARead-onlyIdempotent
Return the bounded read-only Git diff for the configured workspace.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the read-only, idempotent, and non-destructive profile. The description adds 'bounded' and 'configured workspace' as extra context, but 'bounded' is left undefined, so the agent does not know what limits apply to the returned diff.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. The verb, object, and key qualifiers ('bounded', 'read-only', 'configured workspace') are packed efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, an output schema, and annotations covering safety, the description does not need to explain much. However, the meaning of 'bounded' is unclear, and there is no contrast with git_status, leaving minor but real gaps for an agent deciding whether this is the right tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. There is nothing for the description to explain about parameters, and the phrase 'configured workspace' clarifies the implicit scope.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and names the resource ('Git diff for the configured workspace'). It is clear, but it does not explicitly distinguish itself from sibling tools like git_status, so it stops short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: an agent would call this when it needs the Git diff rather than file listing or search. However, there is no explicit guidance about when to prefer this over git_status or when not to use it, so it only meets the 'implied usage' level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_statusARead-onlyIdempotent
Return read-only Git status for the configured workspace.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, and non-destructive behavior, so the description's 'read-only' adds no new safety information. It does add the 'configured workspace' scope, which is useful context, but it does not disclose what Git status includes (e.g., staged, unstaged, untracked files).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that conveys the operation, resource, and scope with no redundant words. It is immediately readable and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only status tool with a rich output schema and strong annotations, the description covers everything needed for an agent to select and invoke it. The configured-workspace qualifier provides sufficient context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so there are no parameter semantics to clarify. The baseline of 4 applies because the description does not need to compensate for any schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return'), a clear resource ('Git status'), and a scope qualifier ('configured workspace'). It is immediately distinguishable from siblings like read_file, list_files, and git_diff without needing to inspect further.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives such as git_diff or read_file. The description implies the tool is for inspecting Git state, but it does not state explicit conditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesCRead-onlyIdempotent
List safe files and directories under the configured workspace path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| max_entries | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds context by mentioning 'safe' and 'configured workspace path,' but 'safe' is vague and no additional behavior such as hidden-file handling, symlinks, or error conditions is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence that front-loads the primary action and resource. There is no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with an output schema and safety annotations, the description is acceptable but not complete. The ambiguity of 'safe,' the missing parameter explanations, and the lack of sibling differentiation leave gaps an agent must guess about.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain the path or max_entries parameters at all. It mentions 'workspace path' in general but does not clarify that path selects a subdirectory or that max_entries limits results, leaving the agent without needed parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clear resource ('safe files and directories under the configured workspace path'), making the tool's basic function obvious. It differentiates from read_file and search_text, though it does not explicitly differentiate from the similarly named sibling workspace_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as workspace_list or search_text. The description implies a listing use case, but it does not state exclusions, when not to use it, or which sibling covers other scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileARead-onlyIdempotent
Read a bounded UTF-8 text file under the configured workspace; secret-like paths are blocked.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds valuable behavioral context beyond these: files are 'bounded' and 'secret-like paths are blocked.' This clarifies size limits and access restrictions, which are not present in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It communicates the core action, the scope, the encoding, and a key limitation in minimal words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool and the rich annotations, the description covers the main purpose and key safety constraints. However, it lacks explicit usage guidance and detailed parameter semantics, leaving non-obvious gaps around max_bytes and when to prefer this tool over sibling tools. An output schema exists, so return-value details are not required, but the missing usage context prevents a higher score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description carries the burden of explaining parameters. It only hints at the max_bytes concept through 'bounded' and at path scope via 'under the configured workspace,' but it never explicitly explains max_bytes semantics, the default value, or what happens when the bound is exceeded. Path is only minimally contextualized as a UTF-8 text file.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read') and a specific resource ('a bounded UTF-8 text file under the configured workspace'), and adds a distinct constraint ('secret-like paths are blocked'). This clearly distinguishes it from siblings like list_files and search_text, which involve listing and searching rather than reading file contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus alternatives such as list_files or search_text. The intended context ('read file contents') is only implied by the verb and resource; there are no exclusions, conditions, or alternative references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textARead-onlyIdempotent
Search UTF-8 text recursively under the configured workspace while skipping generated and sensitive paths.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| query | Yes | ||
| max_results | No | ||
| case_sensitive | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly and idempotent), the description adds meaningful behavior: recursive traversal, UTF-8 restriction, and automatic skipping of generated and sensitive paths. This gives the agent useful operational expectations that annotations alone do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every clause contributes relevant scoping information: search, text type, recursion, workspace boundary, and excluded paths.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and has an output schema plus safety annotations, but the lack of parameter guidance and explicit usage conditions leaves gaps. The description covers the main search behavior and scope, yet an agent is left to infer parameter semantics from names and defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the four parameters. While names and defaults like max_results and case_sensitive are somewhat self-explanatory, the description does not clarify how path interacts with the workspace root or how query is matched.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action (search), the resource (UTF-8 text), and the scope (recursively under the configured workspace). It is distinct from siblings like list_files and read_file because it targets file contents rather than filenames or file reads, though it does not explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when an agent needs to find matching text inside files under the workspace, but it does not state when to prefer this over list_files or read_file. The usage context is present, but explicit when-to-use or exclusion guidance is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_listARead-onlyIdempotent
Return the one configured, read-only workspace.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description does not need to restate safety. It adds the meaningful behavioral fact that there is exactly one configured workspace and no selection is possible, which aligns with the empty input schema. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of only seven words, with the core behavior front-loaded and no filler. Every word contributes meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, a true output schema, and annotations covering read-only/idempotent/non-destructive behavior, the description is sufficient for an agent to invoke the tool correctly. It does not need to enumerate return values because the output schema supplies that detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and 100% schema coverage, so there is no parameter ambiguity. The description's 'one configured' clarifies why no arguments are needed, adding useful context beyond the empty schema rather than repeating it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and identifies the exact resource ('the one configured, read-only workspace'), making the tool's function immediately clear. It is easily distinguished from siblings like list_files and git_status, which operate on files or repository state rather than the workspace object.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for retrieving the single configured workspace object, but it does not explicitly state when to use it over the sibling tools. There are no exclusions or alternative routing, so an agent must infer usage from the name and wording.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
git_diff - First observed
git_status - First observed
list_files - First observed
read_file - First observed
search_text - First observed
workspace_list
TDQS
Scored across 6 tools
Each tool has a distinct purpose: workspace info, file listing, file reading, text search, git status, and git diff. The only minor ambiguity is that workspace_list could be mistaken for a file-listing tool, but the description clarifies it.
Names mix verb-first patterns like list_files and read_file with noun-phrase patterns like git_status and git_diff, plus the unusual workspace_list. All names are readable and consistently snake_case, but the convention is not uniform.
Six tools is a well-scoped count for a read-only local workspace bridge. Each tool covers a necessary operation without redundancy or bloat.
The toolset covers the core read-only workspace needs: discover, list, read, search, and inspect git state. Minor gaps like file metadata or git log are not critical for the stated read-only purpose.
Maintenance
Related MCP Connectors
Securely search and manage workspace context files for AI agents and teams.
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
Search and reason over your Obsidian-style Markdown vault, right from ChatGPT.
Browse and manage files in your Moxt AI workspace from any MCP client.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT to inspect and edit local projects through a secure MCP interface, offering workspace management, file operations, git integration, and safe command execution.5MIT
- AlicenseNot gradedqualityCmaintenanceLets ChatGPT or MCP clients work with files on your machine, with tools for reading, editing, searching, git operations, and safety checks.MIT
- AlicenseNot gradedqualityCmaintenanceEnables ChatGPT web to safely read and modify only explicitly allowed local project files through OpenAI Secure MCP Tunnel, including git operations, file edits, and running project scripts, while enforcing strict security boundaries.17MIT
- AlicenseNot gradedqualityBmaintenanceEnables ChatGPT or any MCP client to operate safely on a designated workspace by listing, reading, searching, writing, and trashing files, inspecting Git status/log/diff, and optionally running allowlisted executables without a shell.Apache 2.0