ChatGPT Direct Developer MCP — T3 Code Overlay

Status: pre-integration prototype. This is an overlay intended for a private T3 Code checkout, not a complete T3 Code distribution and not a verified working ChatGPT app. Workspace unit tests pass locally; the overlay has NOT been compiled against the full upstream T3 Code repository or security audited.

Goal

Use normal ChatGPT as the only model. The T3 Code MCP endpoint is an authenticated tool server on the laptop. It does not launch Codex/Claude/OpenCode for development tasks.

ChatGPT model → OAuth/HTTPS MCP → T3 Code MCP server → restricted project files / Git / package scripts

Related MCP server: WebCodex MCP

Included tools

• dev_list_files — list one directory in a registered project.

• dev_read_file — read UTF-8 text file ≤128 KiB, returns SHA-256.

• dev_write_file — create/replace text file ≤128 KiB using an expected SHA-256 (must opt in).

• dev_run_script — run only test, build, lint, typecheck from package.json (must opt in).

• dev_git_diff — read a capped local Git diff.

• dev_git_status — inspect Git changes.

The existing T3 t3_project_list / t3_project_read tools can discover projects. These tools do not launch agent threads.

Architecture and integration

1. Clone upstream T3 Code to a private local checkout; preserve the upstream MIT license and copyright notice.

2. Copy overlay/apps/server/src/mcp/toolkits/developer/ into apps/server/src/mcp/toolkits/developer/ in that checkout.

3. Follow registration.txt in that folder to register the toolkit in McpHttpServer.ts.

4. Build and test against that exact upstream revision. Resolve any API/type changes before enabling the tools.

5. Start with read-only OAuth access. To enable writes, explicitly set T3_DIRECT_MCP_ENABLE_WRITE=1 on the server and approve full-access MCP client access. To enable project scripts, separately set T3_DIRECT_MCP_ENABLE_EXEC=1.

6. Configure T3 Connect and your ChatGPT custom MCP app if your ChatGPT workspace supports custom write-capable MCP apps. The MCP endpoint is /mcp and uses OAuth.

Security boundaries

• All filesystem paths must be relative to a T3-registered project's workspace root.

• .., absolute paths, symlinks, secret file patterns, .git, .ssh, node_modules, generated output folders are denied by direct file tools.

• Writes require an explicit server opt-in and T3 MCP full-access authorization, plus a file hash precondition.

• No arbitrary cmd or sh execution is provided. Running package.json scripts can still execute arbitrary code with the server account's privileges; restrict to trusted repos and isolate the process using a low-privilege OS user/container.

• Tool output is capped. There is no automatic secret redaction of source files or Git diff; do not register projects containing secrets you are unwilling to expose to the chosen MCP client.

• Hard links, concurrent filesystem mutations, Windows junctions, malicious Git configs, child process cleanup, and runtime sandboxing need further hardening before production use.

• This patch is experimental. Do not expose a workstation directly over unauthenticated HTTP.

Local tests

On Node.js 22+:

npm test

These test the workspace helper, not an end-to-end ChatGPT MCP connection.

What still needs completing

• Compile/typecheck against the pinned T3 Code revision; test OAuth scopes and router registration.

• Add full end-to-end integration tests, per-project allowlisting and approval UI for risky scripts.

• Add robust process cancellation and OS sandboxing, Git diff secret filtering, audit logs and Windows coverage.

• Add backpressure and predictable tool-response sizes for long ChatGPT sessions.

Upstream attribution

Designed as an overlay for T3 Code (MIT license, copyright © 2026 T3 Tools Inc.). This package does not bundle upstream source; carry their LICENSE file in any derived distribution.