Guide

How to connect ChatGPT to local files securely on a Mac

TunnelGPT lets ChatGPT work with one project folder on your Mac through OpenAI’s Secure MCP Tunnel. Your original files stay on the computer, and the connection starts in read-only mode. The results returned by tools you request do travel to OpenAI so ChatGPT can answer, so local file storage is not the same as offline AI processing.

The safest way to begin is to connect a small, disposable project, verify what read-only access can and cannot do, and only then consider editing, command execution, or a local MCP server. The procedure below is a controlled product check, not a security audit.

Local files do not mean offline AI

TunnelGPT keeps the selected project on your computer and sends requests through the Secure MCP Tunnel to the local TunnelGPT app. TunnelGPT checks the permissions and returns the permitted tool result. ChatGPT receives the result it needs to answer. TunnelGPT’s commercial servers are outside that operational data path during normal operation.

That means TunnelGPT is a fit when you want ChatGPT to work with a selected local project without syncing the whole folder. It is not a promise that the contents requested by ChatGPT remain only on the Mac. If your requirement is that no content ever leaves the computer, use a verified local-model workflow instead.

TunnelGPT is independent software. It connects to OpenAI services with your account and permissions, and it is not affiliated with, sponsored by, or endorsed by OpenAI.

What each part does

ChatGPT is where you ask a question and select the project connector.
Secure MCP Tunnel carries the request without requiring an inbound public port on your Mac.
TunnelGPT on your Mac manages the connection and applies the permissions you chose.
The selected project folder is the boundary for the file tools. Connecting one project does not grant file-tool access to your other projects.

This boundary does not automatically apply to every kind of work. Native Mac jobs and external local MCP servers have separate permissions. A local MCP can have access to signed-in accounts, files outside the project, or external services, depending on the server and the tools you approve. Review those permissions separately.

What you need before connecting

Prepare all of the following:

A ChatGPT account with access to custom connectors or apps and Secure MCP Tunnels.
Permissions in the OpenAI Platform organization to create or manage a tunnel and its restricted credential. The tunnel must be associated with the ChatGPT workspace where you will use it; adding and using the connector also requires the corresponding permissions in that workspace.
Docker 24 or later running on the Mac.
A local project folder you are willing to connect.
A Mac with Apple Silicon for the current TunnelGPT desktop release.

TunnelGPT does not include a ChatGPT subscription or third-party services. Docker Desktop licensing depends on your use and organization.

Use a restricted credential with only the scope the tunnel needs. Keep it in the operating system’s secure storage through the desktop app. Do not put a key in a project file or commit it to a repository.

Your Mac must stay awake, online, running Docker, and connected through TunnelGPT while ChatGPT needs the project. The tunnel does not wake a computer that is asleep or shut down.

Connect one project in read-only mode

The exact labels available in ChatGPT can change with the account and interface. Follow the current in-app flow for the ChatGPT workspace where you will use the connector.

1. Create or reuse a restricted credential

Create or reuse a restricted credential for the tunnel. Creating or managing the tunnel and credential requires the corresponding permissions in your OpenAI Platform organization. Give the credential only the scope the tunnel requires, and keep it in the desktop app’s operating-system secure storage. Associate the tunnel with the ChatGPT workspace where you will use it; adding and using the connector also requires the corresponding permissions in that workspace.

2. Create the tunnel in Platform and associate it with ChatGPT

Create or manage the Secure MCP Tunnel in your OpenAI Platform organization, then associate it with the ChatGPT workspace where you will use the connector. Copy its complete identifier. TunnelGPT does not create the tunnel or credential for you. Adding and using the connector requires the corresponding permissions in that ChatGPT workspace.

3. Create the fictional test tree before the first request

Before making the first request through the selected connector, create a disposable parent directory with this structure:

tunnelgpt-boundary-test/
  allowed.txt
  nested/
    nested.txt
tunnelgpt-boundary-sibling.txt

Put a unique, harmless sentence in each file. Keep the sibling file beside the project folder, not inside it. Record the file list and exact contents before connecting. Do not use credentials, customer data, secrets, or irreplaceable files.

Keep command execution and file editing disabled. Every check in this section must use only the file tools exposed by the selected connector. Do not use command execution, shell scripts, native Mac jobs, or another MCP.

4. Select one project in TunnelGPT

Choose one folder and give the project a recognizable name. Link that project profile to its tunnel and leave file access in read-only mode. A connection to one folder is not a connection to your other project folders.

For a first check, use a disposable folder that contains no secrets, customer data, credentials, or irreplaceable work.

5. Start the connection and wait for ready

Start the profile and wait until TunnelGPT reports that the connection is ready. Keep the Mac awake, online, and running Docker.

6. Add the project connector in ChatGPT

Use the custom connector or app flow available in your ChatGPT account. Select the tunnel for the project, enter the exact identifier when the flow requests it, review the tools shown, and save the connector.

7. Make the first read-only request

Start with a request that only reads one known test file:

List the files in the connected project. Read allowed.txt and quote its contents. Do not edit, create, delete, rename, or run anything.

Check the response and the actual tool result before asking for real project content. Do not treat a natural-language claim that a file was changed as proof that it was changed. The tests below must stay within the selected connector’s file tools.

Run a controlled boundary check with fictional files

This procedure describes checks that you must perform, not verified results. It is not a security audit.

Test read access

Connect only tunnelgpt-boundary-test in read-only mode, with command execution and file editing disabled. Ask ChatGPT to list the project files and read allowed.txt, using only the file tools exposed by the selected connector. Compare the actual tool result with the known file contents. Record the connector, tool name, request, path, and result. The expected condition is that the selected connector’s file tool can read the permitted file.

Test that writing is disabled

While the project is still read-only and file editing remains disabled, ask ChatGPT through the selected connector:

Create write-check.txt containing the exact text READ_ONLY_TEST. Do not use a command or another MCP.

Treat this as a two-part check and do not use command execution, shell scripts, native Mac jobs, or another MCP:

Inspect the actual tool surface and tool result. Record separately whether the complete tool inventory confirms that no write tool is exposed, or whether an exposed write call was denied. If you cannot inspect the complete inventory, tool absence is inconclusive. A refusal in natural-language text without an actual tool result is not technical evidence.
Inspect the project directory before and after the request. Confirm that write-check.txt was not created and that allowed.txt was unchanged.

Record the outcome as one of: not exposed, call denied, inconclusive, or not run. A missing write call, timeout, ambiguous response, or filesystem state you cannot verify is inconclusive. The current product description says that write tools are unavailable and the project is mounted read-only in the default mode. Confirm the behavior in your own setup rather than treating this guide as a test report.

If a write succeeds, the file changes, or the response is ambiguous, stop the connection and do not continue with real data. Review the active project permissions before doing anything else.

Test the sibling boundary

Ask ChatGPT through the selected connector’s file tool to read the explicit relative path ../tunnelgpt-boundary-sibling.txt, if that relative path is admitted by the tool. If the tool requires a different explicit outside-path form, record the exact supported form before using it. Record the connector, tool name, exact path, and actual tool result.

Not found, timeout, no tool call, a path rejected before the file tool runs, or a path that was not actually outside the project is inconclusive, not evidence of isolation. Do not try alternative paths or methods to work around a rejection. If the file tool returns the sibling content, stop and investigate. Do not generalize this file-tool boundary to native Mac commands or an external local MCP, because those have separate permissions and may have additional readable paths.

Test exclusions only when the product exposes them

If the current file tool and app expose a documented exclusion control, add one harmless fictional file to that exclusion and test that the file tool refuses it. Record the control name and the tool result. If no supported exclusion control is visible, skip this test. Do not describe exclusions as a user-configurable feature based on assumption alone.

Stop the connection, check job state, then request never-read content

Stop the project connection in TunnelGPT. Stopping the connection does not prove that earlier jobs have finished. Use the documented job controls to retrieve the status, logs, and results of any prior job, and record that state before continuing. Do not infer completion from a finished chat response.

After checking the documented job state, create or modify a local test file with a new unique sentence that has never been shown in the chat and has not been exposed to another connector. Share only its path through the selected connector’s file tool, and ask for an actual file-tool call to read it. Record the connector, tool name, exact path, tool call status, and result. Do not presuppose that disconnection succeeded. A missing call, timeout, no result, or ambiguous response is inconclusive. Do not use another connector, command, shell script, native Mac job, or MCP, and do not try alternatives to bypass a rejection.

Enable more permissions only after the read-only check

File editing is separate from reading

Enable editing only for the project that needs it. File tools check whether a file has changed, and the client handles the confirmation required for a file change.

Use a private copy or version control before approving changes. TunnelGPT cannot undo direct changes to the project.

Command execution is a different permission

Command and shell-script execution requires a separate execution grant. Choose the execution environment, workspace mode, and additional readable folders deliberately.

Linux jobs run in Docker without external network access. If downloads are allowed for dependency preparation, that is a separate permission and scope. Advanced native Mac jobs use a macOS sandbox with approved toolchain folders, and their network and readable-path behavior must be reviewed separately. Direct commands can change project files without a confirmation for every edit.

Do not describe the file-service isolation controls as if they automatically cover native Mac jobs. The product documentation explicitly separates those controls.

Local MCP servers have their own risk boundary

When you connect a local MCP, inspect its available tools and approve only the ones you intend to use. A local MCP supplied by another developer has its own permissions and data practices. Running it locally does not prevent it from sending data to external services.

What stays on the Mac and what travels to OpenAI

During normal operation, TunnelGPT says that the following remain under your control on the computer:

The original project files.
Project paths and local runtime state.
Connection credentials stored in operating-system secure storage.
The local TunnelGPT and MCP connection process.

The whole folder is not synced as a single upload. However, the results of tools you request are sent through the tunnel to OpenAI so ChatGPT can answer. Review OpenAI’s terms and data controls for the ChatGPT account you use. TunnelGPT’s commercial servers are outside that operational data path during normal operation.

This distinction also applies to local MCPs. TunnelGPT cannot make a third-party MCP’s own data practices disappear. Review the server before connecting it, and do not use a sensitive project until you understand which tools can reach which services.

Common connection problems have different fixes

The connector was added before the profile was ready. Start the profile, wait for the ready state, and add or refresh the connector afterward.

The tunnel identifier is rejected. Copy the complete identifier again and check for missing characters or surrounding whitespace. The identifier must match exactly.

Docker is not running. Start Docker before starting the TunnelGPT profile.

The credential or tunnel lacks the required permission. Check your permissions in the OpenAI Platform organization for tunnel management and credential scope, then check the corresponding permissions in the ChatGPT workspace for adding and using the connector. Issue or reuse a restricted credential with only the scope the tunnel needs.

The project is too broad. Use a dedicated project folder and keep secrets outside it. Start with a fictional test project before connecting a real repository.

A write or command happens unexpectedly. Stop the connection, return to read-only mode, and review the permission granted to the file tool, command runner, or local MCP. Do not assume that project-level file controls govern commands or external MCPs.

The computer is unavailable. Keep the Mac awake, online, running Docker, and connected for the duration of the task.

Questions to answer before connecting sensitive files

Is connecting local files the same as using ChatGPT offline?

No. The original files remain on the Mac, but requested tool results travel to OpenAI for ChatGPT to answer. Local storage and local AI processing are different requirements.

Is my whole project uploaded to ChatGPT?

TunnelGPT says the whole folder is not synced as a single upload. ChatGPT still receives the results of the tools you request, and those results can contain project content.

Can TunnelGPT run commands?

Yes, when you explicitly enable command or shell-script execution for the project. Linux jobs, advanced native Mac jobs, workspace modes, and additional readable folders have separate controls. Direct commands can change files without per-edit confirmation, so review the execution permissions before enabling them.

Can I work on my Mac project from ChatGPT on my phone?

Often, yes, but it depends on your account and the interface. Open ChatGPT on your phone or another computer and use the project's connector when it is available in that interface. Mobile and voice availability, and what the model can do there, vary by account, plan and rollout, and OpenAI's public documentation may not match features that are still rolling out.

Your Mac is still where the files live. It must stay awake, online, running Docker and connected through TunnelGPT while you work from the phone. The same boundary applies: the project stays on the Mac and the tool results ChatGPT requests travel to OpenAI. Use the 3 free days to confirm that your phone and account show the connector before you buy.

Can a local MCP access more than the connected project?

It can have separate permissions and data practices. A local MCP may access signed-in accounts, files outside the project, or external services depending on the server and approved tools. Review it separately from the project file connection.

Does TunnelGPT receive my files or my key?

The local app needs access to the selected project and uses your connection credential. TunnelGPT says project content and MCP request and response content do not pass through its commercial servers during normal operation, and credentials saved by the app remain in operating-system secure storage. Requested tool results still travel to OpenAI when you use ChatGPT.

Is TunnelGPT an official OpenAI app?

No. TunnelGPT is independent software that connects to OpenAI services using your account and permissions. It is not affiliated with, sponsored by, or endorsed by OpenAI.

The practical starting point is narrow: connect one disposable project, keep it read-only, verify the tool result and filesystem state, and only then decide whether the task justifies editing, commands, or a local MCP.