Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Network Access Tools for ChatGPT Web UI scrape https://news.ycombinator.com and list the top 5 story titles"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A self-hosted MCP backend giving a ChatGPT conversation unrestricted owner-directed network access: arbitrary HTTP fetch (any method, caller headers, bodies), raw TCP sockets, outbound WebSockets, and browser-grade scraping with challenge solving — plus a full guarded public-read stack with DNS admission.
Deploy your own instance and connect it to your ChatGPT account. This repository contains the application source — not a hosted public service.
┌─────────────────────────────────────────────────────────────────────┐
│ 1. ChatGPT web UI — the MCP CLIENT (the "plugin"/connector) │
│ │
│ • Discovers tools via MCP tools/list; invokes them via tools/call │
│ • Renders results into the model's context │
│ • Runs user-selected models (GPT-6.1 Sol etc.) — NOT your code │
│ • Caches the tool list per conversation session │
└──────────────────────────────┬──────────────────────────────────────┘
│ managed OAuth via the Sites gateway
│ HTTPS POST https://your-site/mcp
┌──────────────────────────────▼──────────────────────────────────────┐
│ 2. ChatGPT Sites worker — the MCP SERVER (this repository's source) │
│ │
│ • Implements the MCP protocol endpoint at /mcp (JSON-RPC) │
│ • Owner identity comes from the Sites dispatch gateway headers — │
│ caller-supplied identity headers are stripped before they arrive │
│ • Runs 16 tools inside Cloudflare Workers isolates: │
│ – QuickJS WASM + LinkeDOM for page script execution │
│ – guarded public reads (DNS admission, quality gates) │
│ – browser_open_fetch: unrestricted HTTP(S) via platform fetch │
│ – edge tools: raw TCP via cloudflare:sockets, WebSockets │
│ • Holds probe/breaker availability state — per-isolate, ephemeral │
│ • NO browser/Chromium here; no filesystem; no persistent cookies │
└──────────────────────────────┬──────────────────────────────────────┘
│ one HTTPS POST {url} → /v1 (Basic auth)
│ only when browser_scrape is invoked
┌──────────────────────────────▼──────────────────────────────────────┐
│ 3. Your VPS — browser-grade scraping endpoint (optional) │
│ │
│ • TRAWL (FlareSolverr-compatible): real Chrome/Camoufox behind │
│ Docker, with WAF/challenge solving and cookie session cache │
│ • Sessions persist in Redis on the VPS — never in the Sites worker │
│ • Hardened: read-only containers, dropped capabilities, non-root │
│ • Stateless from the worker's perspective: one POST per scrape │
│ • If down → browser_scrape returns route:"fallback" and the │
│ guarded worker path serves the request instead │
└─────────────────────────────────────────────────────────────────────┘What does NOT run where: no Chromium/browser in the Sites worker (page execution is QuickJS approximation); no arbitrary code execution on the VPS beyond TRAWL's own scraping engine; credentials never leave the caller's explicit tool arguments — the worker holds no cookie jar and no Sites identity.
Failover is explicit, never silent. When the browser-grade endpoint is
unavailable, browser_scrape returns route:"fallback" with a reason so the
model can retry via browser_read_page / browser_open_fetch.
Two hardening layers: the guarded stack keeps DNS admission and quality
gates for public reads; browser_open_fetch trades those for unrestricted
reach. Both disclose which path served the result.
Related MCP server: local-web-mcp
Tool | Purpose |
| Measured runtime contract: engines, limits, tool inventory |
| Fixed in-process DOM/JS demo proving script execution |
| Guarded public page → clean Markdown, title, links |
| Opt-in: run page scripts in QuickJS WASM/LinkeDOM |
| Structural DOM roles/targets, caller-held plans |
| Deterministic bounded rows/fields from selectors |
| Static article/catalog/media acquisition with presets |
| Guarded public GET/HEAD with admission + quality gate |
| Up to 32 ordered acquisitions, 8 concurrent |
| Unrestricted HTTP(S): any host, method, headers, body; 60s/32MB |
| Measured runtime capability probe (raw TCP, WebSocket, Caches) |
| Raw TCP to any host:port (starttls/TLS), bounded reads |
| Outbound WebSocket, send + receive messages |
| DNS A query over raw TCP (demonstrates non-HTTP egress) |
| Browser-grade scrape via operator TRAWL endpoint; readability extraction; shell detection; failover |
| Parallel 2–10 URL scrape, 4-way concurrency, per-item isolation |
Readability extraction: browser_scrape returns cleaned text/title/links
server-side (22KB cap) — the model sees content, not truncated HTML.
SPA/login-shell detection: results flag app_shell_suspected with reasons
(SPA mount nodes, low visible text, login screens) so JS-heavy pages route to
the browser tier instead of producing empty shells.
Circuit breaker: consecutive probe timeouts widen cooldown exponentially (60s→240s, capped); healthy responses reset it; solve errors and caller aborts never pollute availability state.
Anti-herd jitter: probe retries stagger across isolates.
4xx/5xx classification: TRAWL request-level errors don't block subsequent unrelated URLs; only endpoint-health failures do.
Node.js 22.13+, a ChatGPT account with Sites access, and (optional, for
browser_scrape) a Docker/Dokploy VPS for the TRAWL browser-grade endpoint.
git clone https://github.com/YOUR_USERNAME/chatgpt-web-ui-network-access.git
cd chatgpt-web-ui-network-access
npm install
node tests/run.mjs # workerd protocol suite
node tests/friction.mjs # adapter/readability/circuit-breaker suite
node build.mjs # dist/server/index.js + quickjs.wasmDeployment happens through ChatGPT's Sites workflow — not git push.
Open Work in ChatGPT web (or ask a Sites-capable agent) and reference this
repository. Give it the source and ask it to create a private Site with the
mcp capability (.openai/hosting.json is included).
Set environment bindings in Site settings (names only enter source; values stay private):
Binding | Purpose |
| Your authorized owner identity |
| (optional) Your TRAWL endpoint base URL for |
| (optional) Basic-auth password for that endpoint |
Without TRAWL_URL, browser_scrape returns route:"fallback" with
trawl_not_configured — the other 15 tools work regardless.
Publish the approved version and capture the HTTPS origin. Append /mcp
for the MCP endpoint.
Run a FlareSolverr-compatible scraper (e.g. TRAWL)
behind an HTTPS reverse proxy with Basic auth. See TECHNICAL_NOTES.md for the
hardened Compose pattern: read-only containers, dropped capabilities, non-root
services, and a Traefik basic-auth middleware.
Install the Site-generated plugin from its card (Plugins → Personal → Created by
you), complete the managed authorization, and mention the app in a new chat.
Verify with browser_capabilities — it reports the measured tool inventory.
Owner identity headers are trusted only behind the Sites dispatch gateway.
The adapter never fakes a TRAWL result and never silently downgrades: failover is a typed routing decision disclosed in every response.
Caller-supplied credentials (headers, bodies) are explicit per-call arguments; the worker has no cookie jar and never forwards Sites identity.
Probe/failure state is per-isolate and self-healing; a dead TRAWL endpoint degrades to the guarded stack within one probe timeout (4s).
Raw TCP on port 53 is intercepted by the Cloudflare edge (DNS-over-TCP tool is demonstrative; DNS resolution uses DoH).
Worker fetch cannot shape the TLS handshake (no JA3 control) — that is what
the TRAWL browser tier provides.
Plain-HTTP targets route directly to fallback (the browser tier is HTTPS-only in practice).
The connector caches the tool list per ChatGPT session; use a fresh chat after deploying new tools.
MIT — see LICENSE.
This server cannot be deployed
Call third-party APIs from agents without leaking secrets. SSRF blocked, per-key quotas.
Route HTTP requests through the Tor network. Rotating exit IPs, .onion support, no body logging.
Remote streamable-HTTP MCP server running on a single Cloudflare Worker. Your assistant gets live Airbnb, Amazon, Booking.com, Google Flights, Maps and Reddit data, social search on X, Instagram and TikTok, the Meta Ad Library, and image/video generation without any keys. Connect your own accounts to let it send WhatsApp or Telegram messages, work an IMAP inbox, manage Meta Ads campaigns and publish to X and LinkedIn. OAuth 2.1 with PKCE; stored credentials are AES-256-GCM encrypted.
Undetectable cloud browser sessions for AI agents and scrapers. Navigate, extract, click, captcha.
