TunnelGPT

Comparison

Best Tools to Connect ChatGPT to Local Files and MCP Servers

Can I read, search and edit a local folder from ChatGPT on the web?

On an Apple Silicon Mac, TunnelGPT connects ChatGPT on the web to the project folder you select, so you can ask it to read files, search the project and propose edits. It starts read-only; enabling Allow writing permits previewed, confirmed writes. You need Docker 24+, your own OpenAI tunnel and credentials, and a ChatGPT account with the required MCP/tunnel features enabled.

Start with the local-files guide and the setup steps. Requested tool results are sent to OpenAI so ChatGPT can answer, and your Mac must stay awake and online. Compare the alternatives below by their setup, permission defaults and data flow.

ChatGPT on the web cannot reach files or an MCP server at localhost on your computer, so something has to carry the connection. The main options are OpenAI's Secure MCP Tunnel run by yourself, a public HTTPS tunnel such as ngrok or Cloudflare Tunnel, hosting the MCP server remotely, a browser extension such as MCP SuperAssistant, a desktop bridge such as Chat On Steroids, or a Mac app such as TunnelGPT. If you work in Codex on the same computer, it can start a local MCP server directly. These options solve different problems: a network tunnel carries traffic, while the MCP server and the client decide which files, tools and permissions are available.

Compiled with Omnia's AI visibility research. The original options were reviewed against their documentation on 25 October 2026; the FileMCP, MCP Bridge and LMCP additions were checked on 26 October 2026. The Remote Desktop Commander and StudioCat additions were checked on 28 October 2026.

This comparison is published by TunnelGPT, which is independent software and is not affiliated with OpenAI. Each entry below is checked against the tool's own documentation, linked in the sources. Versions, defaults and prices change, so check the current release before connecting files or tools.

Compare the options by how you want to operate them

Options for connecting ChatGPT to local files and MCP servers; original review 25 October, additions checked 26 and 28 October 2026
OptionHow it connectsBest fitWhat you operateMain trade-off
OpenAI Secure MCP Tunnel with `tunnel-client`Outbound HTTPS from tunnel-client to OpenAI. No public listener.Developers who want to run OpenAI's tunnel themselves on a VM, as a service, in a container or in Kubernetes.tunnel-client (Apache-2.0), a tunnel ID, a runtime key with Tunnels Read + Use, the MCP server and its process lifecycle.Full control, but you set up, supervise and update everything. OpenAI's guide states no separate tunnel price.
ngrokPublic HTTPS URL in front of a Streamable HTTP (or HTTP + SSE) MCP server.A public MCP endpoint that several AI clients, not only ChatGPT, can use.The ngrok agent, the HTTP MCP server, Traffic Policy and authentication.stdio servers need HTTP mode or a bridge. ChatGPT cannot send a bearer token, so ngrok suggests a secret path or OAuth.
Cloudflare TunnelOutbound-only cloudflared connection to Cloudflare's network, reached through a public hostname.Teams already running services behind Cloudflare.cloudflared, a named tunnel and hostname, the access policy and the MCP server.A network connector, not an MCP permission system. Quick Tunnels do not support SSE and change hostname each time.
MCP SuperAssistantChrome or Firefox extension plus a local proxy. It detects tool calls in the model's reply and inserts the results into the chat.People who want MCP tools across many chat sites: ChatGPT, Gemini, Perplexity, Grok and more.The extension, the npx proxy, its config.json and the MCP servers behind it.Depends on the model writing calls in a set format and on each site's page. MIT-licensed, no price listed.
Chat On SteroidsDesktop app with MCP tools over OpenAI Secure MCP Tunnel (or a Cloudflare tunnel), plus a browser extension that automates the ChatGPT page.Codex-style local coding in a regular ChatGPT conversation on Windows, macOS or Linux.The app, the companion extension, approved folders, the OpenAI tunnel and a restricted key.MIT, no price listed. A solo-maintained beta with unsigned installers; read-only mode is off on fresh installs.
FileMCPNative workspace app using OpenAI Secure MCP Tunnel and your OpenAI credentials.People who want open-source native code and can build the macOS or Windows app themselves.The source build, one workspace root, the tunnel and its credentials; optional command execution.Apache-2.0. No published GitHub releases at review; local builds are unsigned. Optional shell commands are not OS-sandboxed.
MCP BridgeLinux/Windows tray app using OpenAI Secure MCP Tunnel, with local-file and Chrome tools.Linux or Windows users who want packaged file, browser and optional terminal tools.The desktop app, your OpenAI tunnel and key, per-root read-only/read-write choices and terminal settings.MIT. Restricted shell is a guardrail, not a complete OS sandbox; full shell runs with your user privileges.
LMCPOAuth connection to LMCP's endpoint; its Cloud Relay forwards requests to your computer.People who want ChatGPT to use local apps and data, including files, email and calendar.The local app, enabled integrations and approval of the ChatGPT connection.Proprietary binary. Free plan after a 14-day trial; paid prices were not yet published at review. Results travel through its relay to ChatGPT.
Remote Desktop CommanderOAuth connection to a hosted MCP relay, with a paired device agent executing tools locally.People who want files and terminal tools on macOS, Windows or Linux through an OAuth connection.Node.js 18+, a running agent on each paired computer, the account and its permissions.Free and paid Pro plans. The hosted service is proprietary; calls and results cross its relay, and tools run with your user permissions.
StudioCatOpenAI Secure MCP Tunnel using your own tunnel credentials, with a native Mac project workbench.Mac users who want local coding, Review Diff and rollback alongside ChatGPT on the web.macOS 14+, the app, your project toolchains and per-project permissions.Free during beta. Project editing starts enabled; terminal and commits start off. Other AI providers are planned.
Remote deployment on a VPS or cloud serviceA stable public HTTPS endpoint that speaks Streamable HTTP.An always-on MCP server shared by a team, or a published ChatGPT plugin.Hosting, HTTPS, authorization on every request, updates and monitoring.The server moves away from your local files, signed-in accounts and installed tools.
TunnelGPTOpenAI's Secure MCP Tunnel, with your own OpenAI account and credentials.Apple Silicon Mac users who want one project folder or local MCP servers in ChatGPT, starting read-only.A macOS app, Docker 24+, and the OpenAI tunnel and credentials you own.$9.97 USD one-time, Version 1 Perpetual License, with 3 free days. Mac only today; Windows is planned with no release date.

When each one is the right choice

  • You want full control and can run a service: OpenAI's Secure MCP Tunnel, run by yourself.
  • You need one public URL for several AI clients: ngrok or a named Cloudflare Tunnel, with authentication in front of it.
  • You use many chat sites and accept automation inside the page: MCP SuperAssistant.
  • You want a free, open-source bridge on Windows, macOS or Linux and will review its permission defaults: Chat On Steroids.
  • You want native open-source code and accept building it: FileMCP for macOS Apple Silicon or Windows.
  • You want Linux/Windows packages and Chrome tools: MCP Bridge, after reviewing its file and shell permissions.
  • You prefer app integrations and an OAuth connection without an OpenAI runtime API key: LMCP, using its Cloud Relay.
  • You want an OAuth-connected agent on macOS, Windows or Linux and accept a hosted relay: Remote Desktop Commander.
  • You want a Mac coding workbench with diffs and rollback and will review the edit defaults: StudioCat's free beta.
  • The server must stay on for a team, or be published: remote deployment.
  • You want a Mac app that starts read-only and keeps your project off its maker's servers: TunnelGPT.
  • You already work in Codex on the same computer: configure the MCP server in Codex directly.

Run OpenAI Secure MCP Tunnel yourself when you want control over the host

OpenAI's Secure MCP Tunnel connects private MCP servers to ChatGPT, Codex and the Responses API without opening inbound firewall ports. You run `tunnel-client`, an Apache-2.0 agent, somewhere that can reach the server. It opens an outbound HTTPS connection to OpenAI, pulls queued MCP requests, forwards them to the server and returns the responses. The private server does not need a public listener.

This route fits developers who want to decide where the client runs and how the MCP server starts, restarts and is monitored. OpenAI documents a Kubernetes sidecar, a dedicated Kubernetes deployment, and a VM or systemd service; the tunnel-client README also covers container images and, on macOS, Homebrew. You need a tunnel ID from OpenAI Platform and a runtime key whose user has Tunnels Read + Use, and for ChatGPT the tunnel must be associated with the target workspace.

The tunnel does not create the MCP server or decide which tools are safe to expose. tunnel-client either starts a local stdio command or forwards to a Streamable HTTP URL; what that server can read or change is up to you. OpenAI's guide lists no separate price for the tunnel. For a walkthrough, see ChatGPT Secure MCP Tunnel: setup, tunnel ID and errors.

Use ngrok when a public HTTP endpoint is part of the design

ngrok's guide, Expose an MCP Server to ChatGPT, Claude, Grok, and Cursor, gives a local MCP server a public HTTPS URL without opening inbound ports. Every account, including the free one, gets a dev domain that stays the same across restarts, so you configure each client once.

There is a transport boundary: a remote client cannot launch a stdio process on your computer. The server must speak Streamable HTTP, or the older HTTP + SSE, or you put a stdio-to-HTTP bridge in front of it. A generic HTTP URL is not automatically an MCP endpoint.

The public endpoint also changes the security boundary. ngrok recommends rejecting unauthenticated requests at its edge with Traffic Policy. Because ChatGPT cannot send a bearer token, the guide suggests a secret path, or OAuth once real users and data are involved. A tunnel carries traffic; it does not replace the authorization rules in the server.

Use Cloudflare Tunnel for general network connectivity, not as an MCP permission layer

Cloudflare Tunnel runs a lightweight daemon, cloudflared, that makes outbound-only connections to Cloudflare's network, so the origin needs no publicly routable IP address and no inbound listener. Cloudflare describes it for HTTP web servers, SSH servers, remote desktops and other protocols.

For MCP, it still needs a server with a compatible endpoint, normally Streamable HTTP. cloudflared does not turn a stdio process into a remotely launchable server, and it does not scope file access or approve MCP tools. You still design the route, authentication, access policy and MCP permissions.

Use a named tunnel for anything you keep. Quick Tunnels are for testing: they have no uptime guarantee, get a new hostname each time, allow up to 200 in-flight requests and do not support Server-Sent Events (SSE), so an HTTP + SSE MCP server will not work through one.

Consider MCP SuperAssistant if you use MCP tools across many chat sites

MCP SuperAssistant is an MIT-licensed browser extension for Chrome and Firefox that brings MCP tools into ChatGPT, Gemini, Perplexity, Grok, Google AI Studio, DeepSeek, OpenRouter, Mistral and other chat sites. Instead of a ChatGPT connector, it works on the chat page. You list your MCP servers in a config.json and start a local proxy with npx -y @srbhptl39/mcp-superassistant-proxy; the extension connects to that proxy on localhost:3006 over SSE, Streamable HTTP or WebSocket.

The model writes a tool call in a set text format, the extension detects it, the proxy runs it on the MCP server and the result is inserted back into the conversation. You can click Run for each call or turn on Auto-Execute and Auto-Submit. That makes it flexible across sites, but it depends on the model following the format and on each site's page, and it can do whatever the MCP servers behind the proxy allow. The project lists no price; its author says it is built in their spare time, with optional sponsorship.

Consider Chat On Steroids if its combined workflow matches your needs

Chat On Steroids pitches itself as “Turn ChatGPT into Codex-style local coding … Your files. Your terminal. Your ChatGPT plan.” It is an MIT-licensed desktop app for Windows 10/11, macOS 13 or later and current desktop Linux. Its local tools reach ChatGPT as a custom MCP server over OpenAI's Secure MCP Tunnel, using a restricted key with Tunnels Read and Use and a bundled, checksum-verified tunnel-client; a Cloudflare tunnel is an alternative. A companion extension for Chrome, Edge or Brave “observes and automates the ChatGPT browser UI”, which the README notes “is not a public ChatGPT automation API”.

It works in your ChatGPT conversation rather than invoking Codex directly, and adds features such as parallel workers and desktop control. It is not a way around limits: the README says “ChatGPT Work and Codex share usage limits” and that your account's model availability, usage and context limits still apply.

Check the defaults before connecting a project. Its security policy says “Fresh installs start Core permissions enabled and read-only mode off”, that exec_command is “intentionally not confined to approved folders” and runs with your account's normal privileges, and that it is “a solo-maintained beta”. The Windows installer is not publisher-signed, and the macOS build is unsigned and unnotarized. For a side-by-side view, see TunnelGPT vs open-source ChatGPT bridges.

Choose FileMCP when you want native open-source code and can build it

FileMCP is an Apache-2.0 native app for macOS Apple Silicon and Windows x64/ARM64. It gives ChatGPT tools for one selected workspace through OpenAI Secure MCP Tunnel. It is a reasonable choice if you want to inspect or change the code and can follow the source-build setup. At the 26 October review, its Releases page had no published releases, and the README described local builds as unsigned.

Review file access and command execution separately. The workspace tools can modify or delete files inside the selected directory; optional shell execution is off by default, but enabled commands run with your user privileges without an OS sandbox. An open-source license or a tunnel does not establish that every tool is confined in the same way.

Choose MCP Bridge for Linux/Windows packages and Chrome tools

MCP Bridge, whose repository is named ChatGPT-MCp, is an MIT-licensed tray app for Linux and Windows. Its documented packages include .deb, AppImage and a Windows installer. It connects local-file and Chrome tools to ChatGPT over OpenAI Secure MCP Tunnel using your tunnel and API key. It fits users who want those desktop and browser tools, particularly on Linux or Windows.

Choose read-only or read/write access per root, and review the terminal setting separately. The project describes its restricted shell as a partial guardrail rather than a complete OS sandbox; full shell runs with your user privileges. Do not assume that selecting a root or disabling file writes automatically confines every command.

Choose LMCP for local-app integrations and its OAuth connection

LMCP's ChatGPT guide describes an OAuth connection to its own MCP endpoint, followed by approval in the local app. Its encrypted Cloud Relay forwards requests to the computer and returns requested results to ChatGPT. This connector flow does not require your own OpenAI runtime API key. LMCP covers local apps and data, including files, email, calendar and work integrations; availability varies by platform. It can be a better fit when those integrations and that connection flow are your priority.

The LMCP binary is proprietary; the repository documentation and scripts use MIT. Its download page advertises a signed and notarized Mac app. At the 26 October review, pricing described a 14-day trial followed by a free plan, with paid-plan prices still to be announced. Check current terms rather than assuming an unpublished price. Its relay and enabled integrations are part of the data-access decision.

Choose Remote Desktop Commander for OAuth-connected files and terminal tools

Remote Desktop Commander is a third-party service; OpenAI lists Desktop Commander as its developer. Its repository describes OAuth access through a hosted relay at mcp.desktopcommander.app, with a device agent running on each paired computer. It requires Node.js 18+ and supports macOS, Windows and Linux; the agent must keep running.

The security policy says calls and results pass through that relay, and tools run with your user account's permissions. Directory and command restrictions are guardrails, not a sandbox. The hosted service is proprietary, distinct from the open-source local DesktopCommanderMCP; its public repository contains documentation and manifests. There are Free and paid Pro plans, so check the current usage limits.

Consider StudioCat for a Mac coding workbench with review and rollback

StudioCat is a Mac coding workbench for ChatGPT on the web, using your own OpenAI Secure MCP Tunnel credentials. It requires macOS 14+ and your project's toolchains. It is free during beta; other AI providers are planned, rather than currently available.

Its documentation enables reading, searching, editing and patches by default inside an approved project. Terminal commands and commits are off by default and enabled per project. Review Diff supports rollback but refuses to revert a card after the file changes again; checkpoints are not backups. Its security design also says that terminal permissions are not an OS sandbox.

The vendor describes its DMG as signed and notarized; we have not verified the installer. Check the current release and permissions before connecting a project.

Choose remote deployment when the MCP server needs to stay available to a team

Hosting an MCP server on a VPS or cloud service fits an always-on service used by several people or systems, and it is the route OpenAI requires for public plugin submission. Its deployment guide asks for a stable, publicly reachable HTTPS endpoint that supports Streamable HTTP, on serverless, container, edge or traditional infrastructure.

You operate the server, hosting, HTTPS, updates and monitoring, and OpenAI's guide says to enforce authorization in the MCP server on every request rather than rely on the model. Remote hosting is not the same as access to files on a personal computer: moving the server to a VPS moves it away from your local files, signed-in accounts and installed tools. For that trade-off in detail, see how to use local MCP servers with ChatGPT.

Choose TunnelGPT for a guided ChatGPT workflow on an Apple Silicon Mac

TunnelGPT is a macOS app for Apple Silicon that connects ChatGPT to one selected local project folder and to MCP servers already running on the Mac, through OpenAI's Secure MCP Tunnel, using your own OpenAI account and credentials. Project files start read-only. Turning on Allow writing enables previewed, confirmed writes and remote development jobs. The file service runs in a container with no network access, and you approve each local MCP tool before ChatGPT can use it.

It requires Docker 24 or later. It costs $9.97 USD one-time for a Version 1 Perpetual License, with 3 free days: 72 consecutive hours from the first successful connection. Your ChatGPT plan is separate. The core file engine is open source under MIT as TunnelGPT MCP Core.

Project content, prompts, tool calls, results and keys never pass through TunnelGPT's servers; the privacy page explains the data path. The tool results ChatGPT requests do go to OpenAI so it can answer. A connected local MCP keeps its own permissions and data practices, and the Mac must stay awake and online while ChatGPT uses it.

TunnelGPT is a poor fit if you need Windows or an Intel Mac today, want a headless server deployment, cannot run Docker, or need every requested result to stay off OpenAI's services. It is independent software, not affiliated with OpenAI. For how it compares with building the same setup by hand, see TunnelGPT vs DIY MCP tunnels.

On Windows? TunnelGPT for Windows is planned, with no release date yet. Join the Windows waitlist to reserve the launch price.

Start with a direct local connection when you work in Codex

Not every local MCP needs a tunnel. Codex in the ChatGPT desktop app, the Codex CLI and the IDE extension share one MCP configuration and can start local stdio servers or connect to Streamable HTTP servers directly, according to OpenAI's Codex MCP documentation. That avoids a public endpoint and another network layer.

ChatGPT on the web does not use that local configuration: it reaches MCP servers as plugins or custom MCP servers, which is why it needs one of the routes above. Choose the route by the client and the transport, then set permissions in the MCP server and the client.

Check permissions and data flow before connecting a project

A tunnel name does not tell you what a tool can access. Before using any option, check which project folders or services the MCP server can reach, whether changes are enabled by default, how commands run, how credentials are stored, and where requested tool results go.

With every option above, the tool results the chat asks for are sent to that chat's provider so it can answer. ngrok and Cloudflare also carry the traffic across their networks, and browser extensions work inside the chat page. TunnelGPT keeps project content, prompts, tool calls, results and keys off its own servers and starts read-only. For details, see how to connect ChatGPT to local files, how to use local MCP servers with ChatGPT and the privacy page.

Sources

Product