# ChatGPT Direct Developer MCP — T3 Code Overlay

> **Status: pre-integration prototype.** This is an overlay intended for a private T3 Code checkout, **not** a complete T3 Code distribution and **not** a verified working ChatGPT app. Workspace unit tests pass locally; the overlay has NOT been compiled against the full upstream T3 Code repository or security audited.

## Goal

Use normal ChatGPT as the only model. The T3 Code MCP endpoint is an authenticated tool server on the laptop. It does not launch Codex/Claude/OpenCode for development tasks.

```
ChatGPT model → OAuth/HTTPS MCP → T3 Code MCP server → restricted project files / Git / package scripts
```

## Included tools

- `dev_list_files` — list one directory in a registered project.
- `dev_read_file` — read UTF-8 text file ≤128 KiB, returns SHA-256.
- `dev_write_file` — create/replace text file ≤128 KiB using an expected SHA-256 (must opt in).
- `dev_run_script` — run only `test`, `build`, `lint`, `typecheck` from package.json (must opt in).
- `dev_git_diff` — read a capped local Git diff.
- `dev_git_status` — inspect Git changes.

The existing T3 `t3_project_list` / `t3_project_read` tools can discover projects. These tools do not launch agent threads.

## Architecture and integration

1. Clone upstream [T3 Code](https://github.com/pingdotgg/t3code) to a private local checkout; preserve the upstream MIT license and copyright notice.
2. Copy `overlay/apps/server/src/mcp/toolkits/developer/` into `apps/server/src/mcp/toolkits/developer/` in that checkout.
3. Follow `registration.txt` in that folder to register the toolkit in `McpHttpServer.ts`.
4. Build and test **against that exact upstream revision**. Resolve any API/type changes before enabling the tools.
5. Start with read-only OAuth access. To enable writes, explicitly set `T3_DIRECT_MCP_ENABLE_WRITE=1` on the server and approve full-access MCP client access. To enable project scripts, separately set `T3_DIRECT_MCP_ENABLE_EXEC=1`.
6. Configure T3 Connect and your ChatGPT custom MCP app if your ChatGPT workspace supports custom write-capable MCP apps. The MCP endpoint is `/mcp` and uses OAuth.

## Security boundaries

- All filesystem paths must be relative to a T3-registered project's workspace root.
- `..`, absolute paths, symlinks, secret file patterns, `.git`, `.ssh`, `node_modules`, generated output folders are denied by direct file tools.
- Writes require an explicit server opt-in and T3 MCP full-access authorization, plus a file hash precondition.
- No arbitrary `cmd` or `sh` execution is provided. Running package.json scripts can still execute arbitrary code **with the server account's privileges**; restrict to trusted repos and isolate the process using a low-privilege OS user/container.
- Tool output is capped. There is no automatic secret redaction of source files or Git diff; do not register projects containing secrets you are unwilling to expose to the chosen MCP client.
- Hard links, concurrent filesystem mutations, Windows junctions, malicious Git configs, child process cleanup, and runtime sandboxing need further hardening before production use.
- This patch is experimental. Do not expose a workstation directly over unauthenticated HTTP.

## Local tests

On Node.js 22+:

```bash
npm test
```

These test the workspace helper, not an end-to-end ChatGPT MCP connection.

## What still needs completing

- Compile/typecheck against the pinned T3 Code revision; test OAuth scopes and router registration.
- Add full end-to-end integration tests, per-project allowlisting and approval UI for risky scripts.
- Add robust process cancellation and OS sandboxing, Git diff secret filtering, audit logs and Windows coverage.
- Add backpressure and predictable tool-response sizes for long ChatGPT sessions.

## Upstream attribution

Designed as an overlay for [T3 Code](https://github.com/pingdotgg/t3code) (MIT license, copyright © 2026 T3 Tools Inc.). This package does not bundle upstream source; carry their LICENSE file in any derived distribution.