TunnelGPT

Guide

Fix ChatGPT's "Unsafe URL" error for a localhost MCP server

ChatGPT rejects an address such as http://localhost:8000/mcp when you enter it as a custom MCP server URL; users report the message Unsafe URL. ChatGPT calls MCP servers from OpenAI's side, not from your browser, and localhost always means the machine making the request, so the address could never reach your Mac anyway. To keep the server private, run OpenAI's Secure MCP Tunnel and choose Tunnel under Connection instead of typing a URL. Otherwise, serve it from a public HTTPS endpoint protected by authentication.

This guide explains the cause, how to tell which connection type you need, and the checks that fix most failed setups. For a broader comparison of the options, see how to use local MCP servers with ChatGPT.

Checked on 25 October 2026

We checked OpenAI's Secure MCP Tunnel guide, its Add custom MCP server page and the openai/tunnel-client documentation on 25 October 2026. OpenAI's documentation does not quote the "Unsafe URL" message; the wording comes from user reports in the OpenAI Developer Community. Labels and availability can change with your account and workspace.

Drafted with Omnia's AI visibility research and reviewed against OpenAI's documentation on 25 October 2026.

Why ChatGPT cannot use a localhost URL

localhost and 127.0.0.1 are loopback addresses: each machine resolves them to itself. When ChatGPT connects to a custom MCP server, the request starts on OpenAI's side, so a loopback address would point at OpenAI's own machine, not at your Mac. A private network address such as 192.168.1.20 or 10.0.0.5 has the same problem, because it only exists inside your network. The error says the address cannot work from ChatGPT as entered; it does not mean your MCP server is broken.

First, identify your connection type

Private server, through OpenAI's Secure MCP Tunnel. The server keeps no public address. You run OpenAI's tunnel-client on a machine that can reach the server; it opens an outbound HTTPS connection to OpenAI, picks up ChatGPT's MCP requests and forwards them. In ChatGPT, add a custom MCP server, choose Tunnel under Connection, then select your tunnel or paste its tunnel_id. tunnel-client must be running and ready while you create the server and on every call. Our Secure MCP Tunnel setup guide walks through each step.

Public HTTPS endpoint. The server, or a tunnel service such as ngrok or Cloudflare Tunnel, gives it an internet address. OpenAI lists SSE and streaming HTTP as the supported protocols for a server URL, so a stdio-only server needs an HTTP wrapper first. Set up authentication and an access policy before the endpoint goes live: ChatGPT offers OAuth or no authentication, and an open endpoint exposes every tool on it to anyone who finds the address.

Check these common causes

  1. Wrong connection mode. A localhost or private address was typed as a server URL. If you use Secure MCP Tunnel, switch Connection to Tunnel; there is no URL to enter.
  2. Tunnel not associated with the workspace. The tunnel must list the ChatGPT workspace where you are adding the server. A tunnel tied only to a personal Platform organization does not automatically appear in an Enterprise or Edu workspace.
  3. Missing Tunnels permissions. Running tunnel-client or selecting the tunnel in ChatGPT needs Tunnels Read + Use. Creating or editing the tunnel needs Read + Manage. A 401 or 403 while the client polls usually means the key's owner lacks Use.
  4. Client running but not ready. Check /readyz, not only /healthz: liveness does not prove the MCP probe or OAuth discovery finished. Running tunnel-client doctor --profile <name> --explain reports most configuration errors.
  5. Mismatched tunnel ID or server address. ChatGPT and tunnel-client must use the same tunnel_id, and the MCP server's HTTP address or start command must work from the machine where tunnel-client runs. For a stdio server, run only one tunnel-client per tunnel ID, even during a restart.
  6. Custom MCP servers not allowed for your account. Workspace permissions and security restrictions, including Lockdown, apply to adding and using custom MCP servers. In a shared workspace, ask its admin.

Choosing a safe route

Secure MCP Tunnel keeps the server off the public internet: tunnel-client only makes outbound HTTPS requests, so you open no inbound port. A public endpoint from ngrok, Cloudflare or a VPS is a different design. It works with any client that can reach the address, but traffic passes through that provider and you are responsible for authentication, transport and access control. Either way, MCP requests and the tool results ChatGPT uses go through OpenAI, and OpenAI recommends connecting only servers you trust. Write actions ask for confirmation by default.

To compare packaged apps, open-source bridges and do-it-yourself tunnels side by side, see tools that connect ChatGPT to local files and MCP servers.

Where TunnelGPT fits

TunnelGPT is an independent Mac app for Apple Silicon, not affiliated with OpenAI, that needs Docker 24 or later. It connects ChatGPT to one selected local project folder and to MCP servers already running on your Mac, through your own OpenAI Secure MCP Tunnel, so you never paste a localhost URL. Project access starts read-only, and you approve each local MCP tool before ChatGPT can use it. The tool results ChatGPT requests are sent to OpenAI; our privacy policy explains the rest.

You can try it for 3 free days, meaning 72 consecutive hours from the first successful connection. After that it costs $9.97 USD one-time for a Version 1 Perpetual License.

Frequently asked questions

Can I use 127.0.0.1 or my Mac's network IP instead?

No. 127.0.0.1 is the same loopback address as localhost, and a home or office IP such as 192.168.x.x is only reachable inside that network. ChatGPT needs either a Secure MCP Tunnel or a public HTTPS address.

Which ChatGPT plans can add custom MCP servers?

OpenAI's developer guides do not list plans; they say workspace permissions and security restrictions apply. Check OpenAI's Help Center article on developer mode and MCP apps in ChatGPT for your account.

Does Secure MCP Tunnel work with a stdio MCP server?

Yes. tunnel-client can start a stdio server itself with --mcp-command, or forward to an HTTP server with --mcp-server-url. ChatGPT never starts a process on your Mac directly.

Does my Mac need to stay on?

Yes. If the machine running tunnel-client sleeps, goes offline or the process stops, requests fail until it reconnects. The tunnel does not wake a sleeping computer.

Sources

Product