# chatgpt-file-mcp

A local, read-only MCP server that exposes explicitly authorized directories to local ChatGPT/OpenAI MCP clients.

## What it provides

- Node.js `>=20` on macOS/Linux
- MCP stdio transport only; no public listener
- Six read-only tools: `list_roots`, `list_directory`, `search_files`, `search_text`, `read_file`, and `read_file_range`
- Root-relative paths, policy checks, bounded reads/searches, and content-free audit records

## Quick start

```sh
npm ci --ignore-scripts --audit=false --fund=false
npm run build
npm test
npm run security:check
```

Launch with one explicit absolute configuration path:

```sh
node /absolute/path/to/dist/main.js --config /absolute/path/to/config.yaml
```

Minimal configuration:

```yaml
version: 1
roots:
  - name: project
    path: /absolute/path/to/project
audit:
  path: /absolute/path/to/audit.jsonl
```

Do not put credentials, audit logs, or private configuration files in the repository. See [`SECURITY_REVIEW.md`](SECURITY_REVIEW.md) for security scope and known limitations.