Local Computer Bridge
Connects ChatGPT to the local machine via OpenAI Secure MCP Tunnel, exposing read, write, edit, and bash tools so ChatGPT can save research reports to local paths, inspect local project source code, and execute shell commands directly on the user's computer.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Local Computer Bridgesave the full report to ~/Documents/research/agent-benchmark.md"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Local Computer Bridge
一个可自行部署的轻量级本机 MCP 服务,让 ChatGPT 经由本机安全隧道读取文件、编辑文本及执行命令。项目以 MIT License 开源。
安全提示: 本服务提供完整的 Shell 命令执行能力。它不是沙箱,也没有路径/命令白名单;只连接到自己信任的 ChatGPT 工作空间或 MCP 客户端,切勿暴露为未授权的公共服务。首次使用前请阅读下方安全说明。
从 GitHub 安装(Quick Start)
git clone https://github.com/szkeli/local-computer-bridge.git
cd local-computer-bridge
npm install
npm test
npm run check
npm startnpm start 会启动本地 stdio MCP Server,并等待 MCP 客户端连接,不会自动连接 ChatGPT。要将其接到 ChatGPT,请按 docs/CHATGPT_SETUP.md 使用 OpenAI Secure MCP Tunnel 配置自己的账号、Tunnel ID 和认证信息。
公开仓库仅包含源代码、文档、测试和示例。 不包含作者本机的 config/、runtime/、logs/、minutes/、backups/ 以及专用 .command 启动脚本。请在自己的电脑上独立安装 Node.js 20+、获取官方 tunnel-client 并完成授权;不要复制别人的 Token 或 Tunnel 配置。
English: Clone the repository, install dependencies, and run the tests. The MCP server communicates over stdio; connecting it to ChatGPT requires your own secure tunnel and credentials. This server can run arbitrary shell commands, so use it only in a trusted environment.
一个尽量薄的本地 MCP Server,让 ChatGPT 可以直接读写你的电脑,而不把它重新实现成一个完整 Coding Agent。
它只暴露 4 个工具:
read:读取本地文本文件write:创建或完整覆盖本地文本文件edit:对已有文本文件做一次精确、唯一的字符串替换bash:在本机执行 Bash 命令
核心目标只有两个:
ChatGPT 做完调研后,直接把报告写到你指定的本地路径,不再手工复制粘贴。
ChatGPT 可以直接查看本地项目目录和源码,给出分析与优化建议,不再上传项目文件。
Related MCP server: Workspace Bridge
架构
┌───────────────────────────────┐
│ ChatGPT │
│ │
│ Web / Research / Reasoning │
│ Conversation Context │
└───────────────┬───────────────┘
│ MCP
▼
┌───────────────────────────────┐
│ Local Computer Bridge │
│ │
│ read write edit bash │
└───────────────┬───────────────┘
│
▼
macOS / Linux这个项目本身不做 Agent planning、不维护项目 session、不建立代码索引、不做向量数据库,也不管理长期进程。ChatGPT 负责“想什么、做什么”,Bridge 只负责本地 I/O。
环境要求
macOS 或 Linux
Node.js 20+
npm
ChatGPT Developer Mode
如果 MCP Server 只运行在本机:OpenAI Secure MCP Tunnel
本项目使用当前 MCP TypeScript/JavaScript SDK 的拆分包:@modelcontextprotocol/server@2.0.0。官方 SDK 文档要求 Node.js 20+,stdio server 使用 @modelcontextprotocol/server 与 @modelcontextprotocol/server/stdio。
快速开始
1. 安装依赖
cd local-computer-bridge
npm install2. 本地检查
npm test
npm run check3. 用 MCP Inspector 测试
npm run inspect或者直接:
npx @modelcontextprotocol/inspector node src/index.jsInspector 中应该能看到 4 个工具:
read
write
edit
bash4. 接入 ChatGPT
推荐通过 OpenAI Secure MCP Tunnel,把本地 stdio MCP Server 接到 ChatGPT,而不开放公网端口。
完整步骤见:
典型使用方式
调研后直接保存报告
你可以直接对 ChatGPT 说:
帮我深入调研目前主流的 Agent Benchmark。
完成后把完整报告保存到:
~/Documents/research/agent-benchmark.mdChatGPT 完成研究后可以调用:
write({
path: "~/Documents/research/agent-benchmark.md",
content: "...完整报告..."
})分析本地项目
帮我检查 ~/Projects/my-app 这个项目的架构,重点看:
1. 模块边界
2. 重复逻辑
3. API 设计
4. 可能的性能问题
先阅读代码,不要修改。ChatGPT 可以组合使用:
bash("find ~/Projects/my-app -maxdepth 2 -type f | head -200")
read("~/Projects/my-app/package.json")
read("~/Projects/my-app/src/...")
bash("cd ~/Projects/my-app && rg 'TODO|FIXME' src")然后直接在对话中给出建议。
Tool 设计
read
{
"path": "~/Projects/foo/src/index.ts",
"offset": 1,
"limit": 1000
}offset:1-based 起始行,默认 1limit:最大返回行数,默认 1000,最大 5000支持绝对路径、
~/...、相对路径V1 只读取 UTF-8 文本
大文件通过多次
read翻页文件正文同时放入
structuredContent.content,兼容 ChatGPT Plugin/Tunnel 的结果传递
write
{
"path": "~/Documents/report.md",
"content": "# Report\n..."
}文件不存在:创建
文件已存在:完整覆盖
父目录不存在:自动创建
V1 不提供 append mode
edit
{
"path": "~/Projects/foo/config.ts",
"old_text": "const timeout = 3000;",
"new_text": "const timeout = 5000;"
}规则非常简单:
old_text找不到:失败old_text恰好出现 1 次:替换old_text出现多次:失败,要求模型提供更多上下文使其唯一
V1 不做 fuzzy matching、不做 patch engine、不做批量 edit。
bash
{
"command": "cd ~/Projects/foo && git status"
}使用
/bin/bash -lc执行默认工作目录是用户 HOME
默认 timeout:60 秒
stdout 与 stderr 分开返回,并同时放入
structuredContent.stdout/stderr每个 stream 最多保留 100 KiB,超出后保留尾部
V1 不提供 PTY、stdin、长期进程 session 或 job 管理
更多细节见 docs/TOOLS.md。
配置
不需要 .env 库,直接使用环境变量:
环境变量 | 默认值 | 说明 |
|
| 相对路径与 Bash 的默认工作目录 |
|
| Bash executable |
|
|
|
|
|
|
|
| Bash timeout |
|
| stdout/stderr 各自最大保留字节数 |
例如:
export LOCAL_BRIDGE_BASE_DIR="$HOME/Projects"
export LOCAL_BRIDGE_BASH_TIMEOUT_MS=120000
npm start注意:如果通过 tunnel-client --mcp-command 启动,应该让这些环境变量存在于 tunnel-client 的进程环境中。
路径规则
文件工具统一使用以下规则:
/absolute/path
↓
直接使用
~/foo
↓
$HOME/foo
foo/bar
↓
$LOCAL_BRIDGE_BASE_DIR/foo/bar默认:
LOCAL_BRIDGE_BASE_DIR=$HOME因此:
read("Documents/a.md")等价于:
read("~/Documents/a.md")为什么没有 ls / grep / find / git 工具?
因为 bash 已经覆盖这些能力:
ls
find
rg
grep
git
npm
pnpm
python
node
curl
ssh
...read / write / edit 是高频文件操作的简洁 primitive;其余本地能力全部交给 shell。
为什么没有 cwd 参数?
为了保持 schema 极简。
文件工具直接使用明确路径;Bash 可以天然写:
cd ~/Projects/foo && npm test因此没有必要再给每个 tool 增加 cwd/session 状态。
为什么 MCP Server 是无状态的?
Bridge 不保存:
current project
current directory
conversation id
open files
active process
project index
ChatGPT 对话上下文已经知道当前在处理哪个项目。每次 tool call 都是独立操作,更简单,也不会产生不同对话之间的隐藏状态冲突。
目录结构
local-computer-bridge/
├── README.md
├── package.json
├── LICENSE
├── src/
│ ├── index.js
│ ├── lib/
│ │ ├── config.js
│ │ ├── path.js
│ │ ├── shell.js
│ │ └── text.js
│ └── tools/
│ ├── read.js
│ ├── write.js
│ ├── edit.js
│ └── bash.js
├── test/
│ └── ...
├── docs/
│ ├── ARCHITECTURE.md
│ ├── CHATGPT_SETUP.md
│ ├── TOOLS.md
│ └── TROUBLESHOOTING.md
└── examples/
└── prompts.md当前明确不做的东西
为了避免重新造一个 Coding Agent,V1 刻意不包含:
repo indexing / repo map
embeddings / RAG
AST 索引
planner
agent loop
shell session / PTY
background job manager
git 专用工具
自动 checkpoint
fuzzy edit
append/write streaming
UI
Plugin Skill
OAuth / 多用户权限系统
如果以后真实使用中出现明确摩擦,再逐项增加。
关于安全
按照当前讨论,V1 的目标是验证体验,而不是设计完整安全边界。因此 bash 是一个真正的通用 shell tool,write 和 edit 也可以修改本地文件。
代码仍然提供了准确的 MCP tool annotations,但没有做路径 allowlist、命令 allowlist、沙箱、用户鉴权等硬化。
不要把这个版本当成面向陌生用户的公共服务。
官方资料
OpenAI Plugins / MCP Server: https://developers.openai.com/plugins/build/mcp-server
ChatGPT 连接与测试 Plugin: https://developers.openai.com/plugins/deploy/connect-chatgpt
OpenAI Secure MCP Tunnel: https://developers.openai.com/api/docs/guides/secure-mcp-tunnels
MCP TypeScript SDK: https://github.com/modelcontextprotocol/typescript-sdk
MCP TypeScript SDK 文档: https://ts.sdk.modelcontextprotocol.io/v2/
Available Tools
4 toolsbashRun local bash commandADestructive
Run a shell command on the local computer using bash. Commands time out after 600 seconds (maximum 10 minutes). Independent calls can run concurrently; avoid concurrent writes to the same files. Use this for directory listing, file discovery, grep/ripgrep, git, package managers, build/test commands, scripts, network tools, and other CLI work. Commands start in the configured base directory; use cd inside the command when needed.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Bash command string to execute. |
Output Schema
| Name | Required | Description |
|---|---|---|
| signal | Yes | |
| stderr | Yes | |
| stdout | Yes | |
| exit_code | Yes | |
| timed_out | Yes | |
| duration_ms | Yes | |
| stderr_truncated | Yes | |
| stdout_truncated | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds meaningful behavioral context beyond the annotations: a 600-second timeout, concurrent execution behavior, a warning against concurrent writes to the same files, and the starting working directory. The annotations already cover destructive and open-world hints, so this description enriches rather than repeats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action, then adds timeout, concurrency, use cases, and working directory in a compact set of sentences. Every sentence provides operational information; the use-case list is long but directly useful for tool selection.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and rich annotations, the description supplies the remaining operational details an agent needs: timeout, concurrency, working directory, and common command categories. Nothing critical about invoking bash safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single command parameter is already described. The description adds execution semantics beyond the schema by noting that commands start in the configured base directory and that cd should be used inside the command when needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: running a shell command on the local computer using bash. The use-case list makes its general CLI scope clear, but it never explicitly distinguishes itself from the sibling read/write/edit tools, especially for overlapping file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear contexts for use: directory listing, file discovery, grep/ripgrep, git, package managers, build/test commands, scripts, network tools, and other CLI work. It does not provide when-not-to-use guidance or name the sibling alternatives explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
editEdit local fileADestructive
Make one exact targeted replacement in an existing local text file. old_text must occur exactly once; the call fails if it occurs zero times or more than once.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the existing text file. | |
| new_text | Yes | Replacement text. May be empty to delete old_text. | |
| old_text | Yes | Exact text that must occur exactly once. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | |
| bytes_after | Yes | |
| bytes_before | Yes | |
| replacements | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, so the safety profile is covered. The description adds genuinely new behavioral context: the call fails when old_text occurs zero times or more than once, which is the key failure mode an agent must handle.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the operation and followed by the constraint. No filler and nothing that could be cut.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a full schema, an output schema, and annotations covering safety, the description only needs the failure semantics, which it supplies. Minor gaps remain: no mention of encoding/line-ending handling or what happens on partial-match ambiguity beyond the count rule.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already documents all three parameters, including old_text's exact-once requirement and new_text's empty-to-delete behavior. The description restates the uniqueness rule rather than adding format or encoding details, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (exact targeted replacement in an existing local text file) and the single-occurrence constraint, which implicitly separates it from whole-file 'write'. It never names the siblings read/write/bash, so an agent gets the operation but not an explicit routing statement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'one exact targeted replacement' suggests preferring this over write when changing part of a file, but there is no explicit when-to-use, when-not-to-use, or alternative (e.g. use write for new files, bash for multi-edit operations).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
readRead local fileARead-only
Read a local text file. Use this for file contents; use bash for directory listings, file discovery, grep/ripgrep, git commands, and other shell operations. Paths may be absolute, start with ~/, or be relative to the configured base directory.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the local text file. | |
| limit | No | Maximum number of lines to return. Defaults to 1000, max 5000. | |
| offset | No | 1-based starting line. Defaults to 1. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | |
| content | Yes | |
| end_line | Yes | |
| truncated | Yes | |
| start_line | Yes | |
| next_offset | Yes | |
| total_lines | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false, and destructiveHint=false, so the safety profile is covered. The description still adds non-obvious behavior beyond the schema: it is limited to text files and defines how paths resolve (absolute, ~/, or relative to the configured base directory). It stops short of covering failure behavior (missing file, encoding, non-text input), which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each carrying a distinct load: what it reads, when to prefer it over bash, and path syntax. No repetition of the schema or annotations and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return format and pagination semantics need not be restated. Purpose, routing, and path semantics are all present, leaving nothing an agent needs before invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so limit/offset defaults and ranges are already documented, establishing a baseline of 3. The description goes beyond that by specifying the accepted path forms (absolute, ~/, base-relative), which the schema's terse 'Path to the local text file' does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read a local text file') and immediately scopes it against the closest sibling by naming what bash is for. An agent can separate read from bash without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives the when-to-use condition ('use this for file contents') and enumerates the alternatives handled by bash (directory listings, file discovery, grep/ripgrep, git). This is a real routing rule, not an implied one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
writeWrite local fileADestructive
Create or completely overwrite a local UTF-8 text file. Parent directories are created automatically. Use edit for a targeted change to an existing file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Destination file path. | |
| content | Yes | Complete UTF-8 contents to write. |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | |
| bytes | Yes | |
| created | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the safety profile is covered. The description adds genuinely useful context beyond that: the overwrite is 'complete' (existing content is destroyed, not merged) and parent directories are auto-created, which affects how the call succeeds or fails. It does not mention permission/error behavior, keeping it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, all front-loaded: what it does, then the directory-creation side effect, then the routing hint. No filler and every sentence carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the annotations carry the safety profile. For a two-parameter mutation tool, the description covers purpose, side effects, and sibling routing adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (path, content) are already documented, making 3 the baseline. The description adds the UTF-8 encoding and 'complete contents' framing for content, but nothing extra for path.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create or completely overwrite a local UTF-8 text file') and immediately distinguishes itself from the sibling 'edit' by contrast. An agent can tell it apart from read/edit/bash without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative ('Use edit for a targeted change to an existing file') and gives the condition that selects it. The overwrite semantics also implicitly state when not to use this tool for incremental edits.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.1- First observed
bash - First observed
edit - First observed
read - First observed
write
TDQS
Scored across 4 tools
Each tool targets a distinct operation: read (file contents), write (full overwrite), edit (targeted single replacement), and bash (shell execution). The descriptions explicitly cross-reference each other, e.g. telling the agent to use bash for directory listings and edit for targeted changes, eliminating overlap.
read, write, and edit are consistent lowercase action verbs, but bash is a noun naming the shell rather than the operation. The deviation is minor and intuitive, so the set remains highly readable.
Four tools is well-scoped for a local file/shell bridge, with no redundancy. Each tool (read, write, edit, bash) earns its place by covering a necessary and non-overlapping capability.
The surface covers reading, creating, overwriting, editing, and arbitrary shell work, so file delete/list/move are reachable through bash. A dedicated delete or list tool is absent, but the bash escape hatch makes this a minor gap rather than a dead end.
Maintenance
Related MCP Connectors
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables file operations and bash command execution on the local workspace, securely exposed to ChatGPT via OpenAI Tunnel.2MIT
- FlicenseNot gradedqualityCmaintenanceEnables ChatGPT to access and manage registered local development projects through controlled file, command, process, and Git operations, with batch tools, permission modes, and tunnel-based remote forwarding.-
- AlicenseNot gradedqualityBmaintenanceEnables local file editing, terminal commands, and durable session management for ChatGPT.MIT
- AlicenseNot gradedqualityCmaintenanceEnables ChatGPT's web interface to operate a real Mac by executing shell commands and reading or writing files over a reverse SSH tunnel, without installing a client or consuming API quota.MIT