Local Drive MCP

Standalone Streamable HTTP MCP server for ChatGPT Developer Mode.

This is not a Codex plugin. Codex already has local filesystem access. This server exists so ChatGPT can call controlled local-drive tools through an MCP endpoint.

Tools

• list_roots

• stat_path

• list_directory

• read_file

• read_many_files

• write_file

• append_file

• edit_file

• create_directory

• copy_path

• move_path

• delete_path

• search_files

• hash_file

Guardrails

The server only touches paths inside configured roots unless LOCAL_DRIVE_ALLOW_ALL=1.

Current local .env defaults:

LOCAL_DRIVE_ALLOW_ALL=1
LOCAL_DRIVE_ALLOW_WRITE=0
LOCAL_DRIVE_ALLOW_DELETE=0
LOCAL_DRIVE_AUTH_MODE=none

Deletes require both:

LOCAL_DRIVE_ALLOW_DELETE=1
confirm=DELETE

The server refuses to delete a mounted drive root or a configured allowed root.

Install

cd "path\to\local-drive-mcp"
npm install

Run Locally

cd "path\to\local-drive-mcp"
npm start

Local endpoint:

http://127.0.0.1:7331/mcp

Health check:

http://127.0.0.1:7331/health

Test

npm run check
npm run smoke

Connect From ChatGPT Developer Mode

ChatGPT requires a public HTTPS MCP endpoint.

For development, tunnel this local server:

ngrok http 7331

Then use the HTTPS /mcp URL in ChatGPT:

https://<your-ngrok-host>/mcp

In ChatGPT:

1. Open Settings -> Apps & Connectors -> Advanced settings.

2. Confirm Developer Mode is on.

3. Go to Settings -> Connectors -> Create.

4. Use a name like Local Drive MCP.

5. Use the tunnel URL ending in /mcp.

6. Create, inspect the tool list, and test with List my allowed local drive roots.

Authentication

For a private development tunnel, LOCAL_DRIVE_AUTH_MODE=none allows ChatGPT to connect without a custom auth flow. In that mode this server does not advertise write or delete tools because .env sets LOCAL_DRIVE_ALLOW_WRITE=0.

For static reverse-proxy or bearer-token testing, set:

LOCAL_DRIVE_AUTH_MODE=bearer
LOCAL_DRIVE_MCP_TOKEN=<long-random-token>

Requests then require:

Authorization: Bearer <long-random-token>

ChatGPT production use should move to OAuth or a locked-down reverse proxy.

For OAuth 2.1 resource-server mode, set:

LOCAL_DRIVE_AUTH_MODE=oauth
LOCAL_DRIVE_MCP_PUBLIC_BASE_URL=https://your-public-host
LOCAL_DRIVE_OAUTH_AUTHORIZATION_SERVER=https://auth.example.com
LOCAL_DRIVE_OAUTH_ISSUER=https://auth.example.com
LOCAL_DRIVE_OAUTH_AUDIENCE=https://your-public-host
LOCAL_DRIVE_OAUTH_JWKS_URL=https://auth.example.com/.well-known/jwks.json
LOCAL_DRIVE_ALLOW_WRITE=1

The server publishes:

/.well-known/oauth-protected-resource

and returns a WWW-Authenticate challenge when protected requests lack a valid bearer token.