ChatGPT MCP Bridge
Controls an existing Google Chrome session via chrome-devtools-mcp, enabling navigation, tab management, clicking, typing, screenshots, DevTools inspection, and optional coordinate/vision tools.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ChatGPT MCP Bridgelist files in my Downloads folder"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
On Glama
Public hosted demo: an isolated read-only sample exposes the actual Local Files MCP tools against bundled example Markdown only. The Glama hosted edition cannot access your local computer, credentials, Chrome session or shell.
View our Glama MCP listing · Glama-specific setup and limitations
MCP Bridge is local-first, not a Glama-hosted connector. Install the desktop app on the machine you control, authorize specific file roots and other optional capabilities, and connect through your own OpenAI Secure MCP Tunnel. The local files, logged-in Chrome session and shell tools are not remotely available to a Glama-hosted container. The Glama listing is for discovery; one-click hosted deployment would not provide the real desktop integrations.
The repository includes a validated glama.json maintainer declaration. Glama's separate hosted-release requirement does not mean the GitHub desktop installers are missing.
Related MCP server: agent-mcp-gateway
What is MCP Bridge?
MCP Bridge is a desktop app for Linux and Windows that keeps powerful local tools on your own computer while making them available to ChatGPT through OpenAI Secure MCP Tunnel.
It can manage three independent connections (the third requires Meta Manager):
Connection | What it does |
Local MCP | Browse/search approved folders, read files, optionally create/edit files, and optionally run terminal commands. |
Web MCP | Control your existing Chrome session through Chrome DevTools MCP: tabs, navigation, clicks, typing, screenshots, console/network inspection, and optional vision tools. |
Meta Manager MCP | Optional connection to a separately installed and running Meta Manager local MCP service. |
Your files, browser session, and terminal remain on your machine. MCP Bridge only exposes the roots and capabilities you explicitly allow.
Highlights in v0.2.1
Fresh product-level desktop UI
Dedicated Bridge / Gateway app identity and production icon
Proper Linux taskbar/window identity — no longer grouped under ChatGPT
System tray controls for Local MCP and Web MCP
Closing the window minimizes instead of terminating active tunnels
Automatic Linux mounted-drive discovery
Friendly labels for external SSDs and mounted volumes
Read/write validation before a mounted root is exposed
Existing encrypted Runtime API key survives upgrades
Built-in cross-platform update system
SHA-256 verification before an update can be installed
Linux
.deb, Linux AppImage, and Windows NSIS.exereleasesLocal MCP and Web MCP remain completely independent
Architecture
OpenAI Secure MCP Tunnel
|
+---------------+---------------+
| |
Local MCP Web MCP
| |
approved local roots Chrome DevTools MCP
/ | \ |
files folders shell existing Chrome
\ /
+--------- MCP Bridge --------+
Linux / WindowsNo public local MCP port needs to be exposed directly to the internet.
Quick start
1. Install MCP Bridge
Linux
Current packaged releases target Debian / Ubuntu / Linux Mint on amd64/x86_64.
curl -fsSL -H "Accept: application/vnd.github.raw+json" \
"https://api.github.com/repos/haseebgb92/ChatGPT-MCp/contents/install-linux.sh?ref=main" | bashIf Chrome/Chromium is already installed:
curl -fsSL -H "Accept: application/vnd.github.raw+json" \
"https://api.github.com/repos/haseebgb92/ChatGPT-MCp/contents/install-linux.sh?ref=main" | SKIP_CHROME=1 bashOr download the latest .deb from GitHub Releases:
sudo apt install ./MCP-Bridge-*-linux-amd64.debWindows
Open PowerShell:
Set-ExecutionPolicy -Scope Process Bypass -Force
irm "https://raw.githubusercontent.com/haseebgb92/ChatGPT-MCp/main/install-windows.ps1" | iexOr download the latest Windows .exe from GitHub Releases.
2. Create two OpenAI tunnels
Open:
https://platform.openai.com/settings/organization/tunnelsCreate separate tunnel IDs for Local MCP and Web MCP.
Local Files
ChromeUse different tunnel IDs when both services will run at the same time.
3. Create a Runtime API key
Open:
https://platform.openai.com/settings/organization/api-keysFor least privilege, use a restricted key whose principal has:
Tunnels: Read
Tunnels: UseDo not use an OpenAI Admin API key as the long-running Runtime API key.
When Remember API key securely is enabled, MCP Bridge stores it through Electron safeStorage / operating-system credential encryption instead of normal settings.
4. Configure MCP Bridge
Enter the Runtime API key.
Enter the Local tunnel ID.
Enter the Web tunnel ID.
Add one or more approved folders.
Choose read-only or read/write access per root.
Enable file writing only if needed.
Enable terminal access only if needed.
Enable Browser vision tools if needed.
Optionally start MCP Bridge at OS login.
Start Local MCP, Web MCP, or both.
5. Add the connections in ChatGPT
In ChatGPT, enable Developer mode and add MCP connections using Tunnel as the connection method.
Local connection:
Name: Local Files
Connection: Tunnel
Tunnel: <your Local tunnel ID>Browser connection:
Name: Chrome
Connection: Tunnel
Tunnel: <your Web tunnel ID>Start the matching service in MCP Bridge before refreshing/scanning its tools in ChatGPT.
Mounted drives on Linux
MCP Bridge automatically discovers mounted filesystems under common Linux mount locations such as:
/mnt
/media/<user>
/run/media/<user>Instead of making you work with an opaque mount path such as:
/mnt/289E678E9E6752FCthe UI can show the volume label, filesystem, size, and actual mount path.
Before a mounted root is exposed, MCP Bridge resolves the real path and confirms that the current user can read it. Read/write roots are also checked for write access.
This makes external SSDs and secondary drives first-class without weakening the Local MCP path-security model.
Desktop experience
Dedicated app and tray icon
Separate Linux
WM_CLASS/ desktop identityClick X to minimize instead of killing active tunnels
Tray menu to reopen the app
Start/stop Local MCP from the tray
Start/stop Web MCP from the tray
Restart running services
Explicit Quit when you want the bridge terminated
Optional launch at login
Optional automatic Local/Web startup
Runtime activity logs
Built-in updates
Starting with v0.2.1, MCP Bridge can update itself from GitHub Releases.
Update flow
Check the latest GitHub Release.
Compare semantic versions.
Select the correct installer for the current OS and architecture.
Download the installer locally.
Download the matching
.sha256file.Verify the installer before installation is enabled.
You explicitly choose Install & restart.
Automatic checks happen shortly after launch and then periodically. They can be disabled in Settings.
Linux
download → SHA-256 verify → pkexec → apt install → relaunch MCP BridgeThe system elevation dialog is used. MCP Bridge does not store your sudo password.
Windows
download NSIS .exe → SHA-256 verify → launch installer → MCP Bridge exitsUpdates are not silently installed.
Local MCP
Files and folders
Multiple approved roots
Read-only/read/write mode per root
Mounted Linux drive support
List files and directories
File metadata
Read UTF-8 text files
Recursive filename/content search
Create folders
Create or replace text files
Real-path and traversal protection
Symlink escape protection
Shell
Terminal execution is optional.
Restricted shell supports normal development work while blocking several obvious destructive/system-level commands.
Examples:
npm install
npm run build
git status
git diff
git pull
git push
python script.py
adb devicesRestricted shell is a guardrail, not a complete OS sandbox.
Full shell executes Bash on Linux or PowerShell on Windows with the current user's privileges.
Treat Full Shell as local-user-equivalent code execution. Enable it only for a machine and MCP connection you trust.
Web MCP / Chrome
Web MCP uses chrome-devtools-mcp with your existing Chrome session, so ChatGPT can work with tabs and authenticated sessions already open on your computer.
Capabilities include:
list/select/open/close tabs
navigation
click, hover, typing, forms, and keyboard input
screenshots and accessibility snapshots
console and network inspection
performance tooling
optional coordinate/vision tools
optional usage-statistics opt-out
Chrome setup
Open:
chrome://inspect/#remote-debuggingEnable remote debugging for the Chrome profile you want MCP Bridge to use.
When Browser vision tools are enabled, MCP Bridge launches Chrome DevTools MCP with:
--experimentalVisionPackaged releases include
MCP Bridge desktop app
Local MCP server
Chrome DevTools MCP
Electron/Node runtime
Full OpenAI
tunnel-clientProduction app/tray icons
You do not need to manually install Node.js, npm, Go, the MCP SDK, Chrome DevTools MCP, or tunnel-client when using an official packaged release.
Release artifacts
Platform | Artifact |
Linux |
|
Linux |
|
Windows |
|
Every installer also has a matching:
<installer>.sha256The built-in updater refuses to install an update if its checksum is missing or does not match.
Build from source
Linux
git clone https://github.com/haseebgb92/ChatGPT-MCp.git
cd ChatGPT-MCp
npm install
npm startWindows
git clone https://github.com/haseebgb92/ChatGPT-MCp.git
cd ChatGPT-MCp
npm install
npm startA development run expects a full tunnel-client either on PATH or selected in Advanced settings.
Build installers
npm install
npm run checkLinux:
npm run dist:linuxWindows:
npm run dist:winGitHub Actions builds the official release artifacts and SHA-256 sidecars from version tags.
Security
MCP Bridge deliberately exposes powerful local capabilities, so use the smallest access level that fits the task.
Never commit Runtime API keys.
Prefer a restricted Runtime API key.
Use separate tunnel IDs for Local and Web MCP.
Prefer read-only roots unless write access is required.
Mounted roots are real-path checked before use.
Enable shell only when required.
Full shell is not a sandbox.
Chrome MCP can act inside logged-in browser sessions.
Review consequential actions before allowing them.
Runtime logs redact OpenAI-style
sk-keys.Update installers are SHA-256 verified before installation.
See SECURITY.md for details.
Project structure
.
├── .github/workflows/build.yml
├── assets/
├── bundled/
│ └── local-mcp/
├── docs/
│ └── images/
├── install-linux.sh
├── install-windows.ps1
├── src/
│ ├── main.js
│ ├── preload.js
│ ├── updater.js
│ └── renderer/
├── LICENSE
├── package.json
└── README.mdCurrent release
v0.2.11
The latest public release includes the desktop updater, local files and Chrome connections, optional Meta Manager MCP integration, and privacy-reviewed support diagnostics. See all release notes for details.
License
MIT License.
Credits
OpenAI Secure MCP Tunnel /
tunnel-clientModel Context Protocol
Chrome DevTools MCP
Electron
Built by Advertpreneur.
Meta Manager MCP (v0.2.9)
Install and open Meta Manager v0.1.21 or later on the same Windows or Linux computer. In Meta Manager → Settings verify that Local MCP is online.
Create a separate tunnel ID using OpenAI Tunnels. Never reuse your Local or Web tunnel IDs.
In MCP Bridge → Connection settings, enter the Meta Manager tunnel ID and your Runtime API key, then select Save settings.
Choose Start Meta in Connections. The tunnel client uses native HTTP transport to
http://127.0.0.1:38939/mcpover the secure OpenAI tunnel (no extra proxy process required).Connect the corresponding tunnel in ChatGPT. Both applications must be running to use local MCP tools; posts already scheduled through Meta Manager Cloud do not require either PC to remain on.
The Runtime API key is kept in secure local storage and is never included in installer files or public links. The Meta Manager local MCP service stays bound to 127.0.0.1 rather than a public HTTP listener. The tunnel ID alone is not a credential and cannot establish the connection without a Runtime API key and a running tunnel client.
Combined diagnostics and private GitHub report (v0.2.11)
Meta Manager v0.1.24+ records structured error categories for Facebook, Instagram, LinkedIn OAuth and MCP startup. MCP Bridge records its tunnel startup and runtime failures. Both applications keep their diagnostics in their own local app-data folders.
To send a reproducible support report:
Reproduce the error in Meta Manager or MCP Bridge.
In MCP Bridge, open Support diagnostics → Generate report.
Inspect the preview, which includes only allowlisted error categories, optional HTTP status, timestamps, application version, OS and local MCP reachability.
Choose Copy sanitized report, or Open GitHub issue draft.
GitHub opens an issue draft in the private Meta Manager repository (GitHub access required). Only you can submit it.
The applications do not automatically post reports, do not include raw process logs, and do not include OAuth codes/states, account names, tokens, Runtime API keys, tunnel IDs, passwords, usernames, email addresses or full file paths. Keep raw traces on your computer and never paste them into public issues.
Available Tools
5 toolsfile_infoARead-onlyIdempotent
Inspect a file or directory in an approved root and return its type, size and modification time without reading its contents. Use read_file for UTF-8 content. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Relative file or directory path inside the approved root. | |
| root | Yes | Name of a configured approved root returned by list_roots. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/destructiveHint=false, so the safety profile is covered; the description usefully adds that contents are not read and which metadata attributes come back. Error behavior for a missing or out-of-root path is left unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero waste, front-loaded with the action and payload before the disambiguation and the read-only confirmation. Nothing could be cut without losing signal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly enumerates the returned fields, which is the key omission-risk covered. For a simple two-parameter read-only stat call this is nearly complete; only failure-mode behavior is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are self-documenting, so the schema carries the load. The description's only added signal is the 'approved root' framing, which largely repeats the root parameter's own description; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (inspect a file or directory) and the exact payload returned (type, size, modification time), plus an explicit scope constraint ('in an approved root'). The 'without reading its contents' clause sharply separates it from read_file, so the agent can route without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative and the condition that selects it ('Use read_file for UTF-8 content'), which is real routing guidance. It doesn't address the other plausible siblings (list_files, search_files) or say what to do when the path doesn't exist, so it stops short of full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesARead-onlyIdempotent
List up to 1,500 immediate files and directories in an approved root, including relative path, type, size and modification time. Use search_files for recursive discovery. Does not change files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Relative directory or subtree within the root; defaults to its top level. | . |
| root | Yes | Name of a configured approved root returned by list_roots. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, destructiveHint=false, idempotentHint, and closed-world scope, so the safety profile needs no restating. The description still adds real value with the 1,500-entry cap and the non-recursive 'immediate' scope, which are not in the annotations; it just doesn't say what happens when the cap is exceeded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action and scope, then the sibling routing, then the safety note. Every sentence carries distinct information with no repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully enumerates the returned fields and the entry cap, which is most of what an agent needs. The only gap is truncation behavior past 1,500 entries, which matters for a listing tool but is a minor omission overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both 'root' and 'path' are already documented with defaults and meanings. The description's word 'immediate' reinforces that the listing is non-recursive, but adds no path syntax or root-selection guidance beyond what the schema provides, making the baseline 3 correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource (list immediate files and directories) and states the scope limits precisely: non-recursive, an approved root, capped at 1,500 entries. It also names the returned fields (relative path, type, size, modification time), so an agent knows exactly what this produces versus search_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names the alternative, 'search_files for recursive discovery,' which is the key decision point for choosing between the two. The closing 'Does not change files' further signals this is a safe read for inspection-style tasks rather than mutation workflows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_rootsARead-onlyIdempotent
List the approved root names and access modes. Call this before other file tools to discover valid root values; filesystem paths and file contents are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, so safety is covered. The description still adds useful value by clarifying the scope of the return: only approved root names and access modes, explicitly excluding filesystem paths and file contents. It does not mention error or empty-result behavior, keeping it below 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence plus one clarifying clause, with the core purpose front-loaded and the negative scope statement following. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must convey return shape; it does so at a high level ('root names and access modes', not paths or contents). What is missing is any hint of result format or ordering, a minor gap for a simple zero-parameter read.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the schema is trivially complete and there is nothing for the description to disambiguate. Baseline of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the approved root names and access modes') and immediately delimits it from what sibling file tools do by noting that filesystem paths and file contents are not returned. An agent can tell this apart from list_files or file_info without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit sequencing guidance: 'Call this before other file tools to discover valid root values.' That is a clear when-to-use rule tied to sibling tools, but no when-not-to-use case or alternative is named, so it falls short of a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileARead-onlyIdempotent
Read text from an approved local root as UTF-8, truncating at MAX_READ_BYTES (512 KB by default) with a clear truncation marker. Use search_files first to locate passages; binary files are not supported. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Relative file or directory path inside the approved root. | |
| root | Yes | Name of a configured approved root returned by list_roots. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, closed-world, non-destructive, so the safety profile is free. The description adds genuinely non-obvious behavior beyond that: a concrete truncation ceiling (512 KB default) with a visible truncation marker, UTF-8 decoding assumptions, and binary rejection. It omits error semantics for missing paths or oversized files, keeping it out of the top band.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero filler: the capability and truncation behavior come first, then the alternative routing and exclusion. Every clause carries information an agent needs before calling.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully characterizes the return value as UTF-8 text with an explicit truncation marker, which is the key thing an agent needs to interpret results. For a two-parameter read tool with full annotation coverage this is nearly complete; error behavior on unreadable paths is the only notable omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both 'root' and 'path' are already documented, and no enum constraints exist. The description reinforces the notion of an 'approved local root' but adds no new syntax, format, or constraint information about the two parameters beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read text from an approved local root') with concrete scope modifiers: UTF-8 decoding, MAX_READ_BYTES truncation, and rejection of binary files. It separates itself from search_files by telling the agent to locate passages there first, but does not distinguish itself from file_info or list_files, which are the closest competing reads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use search_files first to locate passages' gives explicit routing to a sibling, and 'binary files are not supported' is a clear exclusion. It stops short of full when/when-not coverage: it never says when to prefer file_info (metadata only) over read_file, nor what to do when a file is large or missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_filesARead-onlyIdempotent
Recursively search filenames and UTF-8 contents inside an approved root with case-insensitive substring matching. Returns relative paths and brief snippets, bounded by max_results and a file scan limit; skips symlinks and build folders. Use read_file for complete text.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Relative directory or subtree within the root; defaults to its top level. | . |
| root | Yes | Name of a configured approved root returned by list_roots. | |
| query | Yes | Case-insensitive filename or UTF-8 content substring to find. | |
| max_results | No | Maximum matching files, from 1 to 200; defaults to 50. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as a safe, idempotent, non-destructive read, and the description adds useful behavior beyond them: results are bounded by max_results and a file scan limit, symlinks and build folders are skipped, and results are relative paths with brief snippets. It does not detail error behavior for missing roots or permission failures, but the operational profile is substantially enriched.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with no filler. The core search behavior and scope are front-loaded, and the alternative routing comes after the primary definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description appropriately explains the return shape: relative paths and brief snippets, bounded by limits. It also covers traversal exclusions. Minor gaps remain around failure modes, but for a read-only search tool with full schema coverage and complete annotations, it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented, including query matching semantics and max_results bounds. The description reinforces that matching is case-insensitive and substring-based, but adds little beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Recursively search filenames and UTF-8 contents'), plus the matching model ('case-insensitive substring') and scope ('inside an approved root'). It also explicitly contrasts with read_file, so an agent can distinguish it from siblings without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly routes the agent to read_file for complete text rather than snippets, which is an explicit alternative. It does not state exclusions or when-not to use search, but the retrieval-use case is clear enough to support correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
file_info - First observed
list_files - First observed
list_roots - First observed
read_file - First observed
search_files
TDQS
Scored across 5 tools
Each tool has a distinct role: discovering roots, listing directory contents, inspecting one path, reading text, and recursive searching. The only mild overlap is that list_files and file_info both return metadata, but their scope is clearly differentiated by the descriptions.
Four of five tools follow a clear verb_noun convention (list_roots, list_files, read_file, search_files). file_info is noun-based rather than get_file_info, which is a minor deviation but still understandable.
Five tools is well-scoped for a read-only filesystem bridge. Each tool covers a necessary operation—discovery, listing, metadata, reading, and searching—without redundant surface area.
The read-only filesystem surface is coherent and covers discovery, navigation, metadata, reading, and search. It lacks write/create/delete operations, but the descriptions consistently frame the server as read-only, so this is a minor scope gap rather than an internal inconsistency.
Maintenance
Related MCP Connectors
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.
Related MCP Servers
- AlicenseAqualityBmaintenanceEnables ChatGPT web to use local tools like file reading, command execution, and patch application through an MCP server over OpenAI Secure MCP Tunnel.62MIT
- FlicenseNot gradedqualityBmaintenanceEnables ChatGPT Web to securely access local files and run commands via MCP, with optional OpenCode agent mode for autonomous tasks.-
- FlicenseBqualityAmaintenanceEnables ChatGPT Web to securely control a trusted local computer through an OpenAI Secure MCP Tunnel, letting it perform file, process, Git, and other system operations on Windows, macOS, and Linux.62-
- FlicenseNot gradedqualityCmaintenanceEnables ordinary ChatGPT web Chat to work directly on a local machine over a private MCP tunnel — reading and editing project files, running shell commands and tests, loading local skills, manipulating images, and driving Chrome — without spinning up a separate coding agent or additional model-generation API calls. It also supports multi-step task plans with persisted execution receipts and acceptance checks so results from real runs are returned to the conversation.-