Comparison

TunnelGPT vs open-source ChatGPT bridges: an honest comparison

Choose an open-source bridge if you want to inspect or modify the code, run on Windows or Linux today, pay nothing or prefer a CLI; choose TunnelGPT if you want a signed Mac app with guided setup, one connection per project, a read-only start, commands in an offline Docker container and a person answering support. Neither kind of tool adds OpenAI usage: your plan's limits, model access and connector permissions still apply.

Checked on 25 October 2026. Star counts, versions and features change; each project's README or website is the source of truth. TunnelGPT is our product, so verify every claim in the linked repositories.

Two different approaches

These tools reach ChatGPT in two different ways, and that split matters more than any feature.

1. Automating the ChatGPT web interface or the Codex app

Some projects drive an interface that was built for people. Codex ChatGPT Web calls itself “unofficial browser automation, not an OpenAI API”. Chat On Steroids ships a browser extension that “observes and automates the ChatGPT browser UI”, which it says “is not a public ChatGPT automation API”. Codex with ChatGPT lets Codex drive ChatGPT web through Computer Use. codex-web-ui says it reverse-engineered the Codex Desktop bundle to “patch the app at runtime”; its successor, codexui, serves the Codex app UI in a browser.

This can reach things a connector cannot, such as the model picker, but it depends on interface details the authors do not control.

2. Using ChatGPT's custom MCP server feature

The other approach uses a documented feature: ChatGPT calls tools on a custom MCP server, and OpenAI's Secure MCP Tunnel lets it reach a localhost server through an outbound connection. TunnelGPT, dotlink, FileMCP and MCP Bridge work this way with the official tunnel-client. Chat On Steroids uses the same tunnel for its MCP tools alongside its extension, and Codex ChatGPT Web's Full harness mode routes tool calls through tunnel-client. codex-chatgpt-bridge puts the DevSpace MCP server behind a Cloudflare tunnel. LMCP takes a third route: ChatGPT connects to a custom connector on LMCP's own server, whose Cloud Relay forwards each request to the app on your computer.

You work in ordinary ChatGPT, which asks for confirmation before write actions by default. You need an account that can add custom MCP servers and permission to create a tunnel and a restricted key in your OpenAI Platform organization.

Side-by-side comparison

TunnelGPT, open-source bridges and LMCP, from each project's README or website (25 October 2026)
Tool	Where you work	How it connects	Commands run	Read-only by default	Platforms	Packaging	License/price
TunnelGPT	ChatGPT Chat on chatgpt.com	Custom MCP server over OpenAI Secure MCP Tunnel, one per project	Separate grant; offline Linux container in Docker or macOS sandbox	Yes; editing and commands are separate grants	Mac with Apple Silicon; Windows 64-bit: see its page; Linux planned	Developer ID signed and notarized DMG (Apple Silicon)	Commercial: $9.97 USD one-time, Version 1 Perpetual License; 3-day trial; MIT core
Chat On Steroids (~5.1k stars, v2.1.46)	Its desktop app plus ChatGPT in Chrome, Edge or Brave	Extension automating the ChatGPT UI, plus MCP tools over OpenAI Secure MCP Tunnel (Cloudflare optional)	`exec_command` runs with your user privileges, not confined to approved folders, per its security policy	No: “Fresh installs start Core permissions enabled and read-only mode off”	Windows 10/11, macOS 13+, desktop Linux	Unsigned beta: “macOS is unsigned and unnotarized”; checksums published	MIT, free
FileMCP	ChatGPT, as a custom MCP app	Native app (Swift on macOS, .NET on Windows) running a loopback MCP server over OpenAI Secure MCP Tunnel, with the official tunnel-client bundled	Optional `run_command`, off by default; shell commands are “not OS-sandboxed” and run with your user's permissions	Not described; its file tools “can modify or delete files inside the directory you choose”	macOS Apple Silicon, Windows x64 and ARM64	Build from source; no published releases; “The local build is unsigned”	Apache-2.0, free
MCP Bridge (ChatGPT-MCp, v0.2.11)	ChatGPT, as custom MCP apps: one for local files, one for your Chrome session	Electron tray app over OpenAI Secure MCP Tunnel, one tunnel per service, with the official tunnel-client bundled	Optional terminal: a restricted shell that is “a guardrail, not a complete OS sandbox”, or a full shell with your user's privileges	Per folder: you choose read-only or read/write; file writing and the terminal are separate switches	Linux x86_64 (packages for Debian, Ubuntu and Mint) and Windows x64	.deb, AppImage and Windows installer, each with a SHA-256 file that the built-in updater checks	MIT, free
Codex ChatGPT Web (~14.9k stars, v6.1.13)	Codex, with ChatGPT Web models in its model picker	Embedded browser automating ChatGPT Web; Full harness adds MCP over tunnel-client	Through Codex, which “remains responsible for its sandbox, approval” and command sessions	Follows your Codex sandbox and approval settings	macOS 13+ (Apple Silicon and Intel), Windows x64, Linux x64	Launcher; builds “not yet platform-signed”; SHA-256 verified	MIT, free
dotlink	ChatGPT Web via `@dotlink`; also Claude.ai and local MCP clients	Single binary over OpenAI Secure MCP Tunnel; HTTP/ngrok or stdio for other clients	Separate shell grant; Bubblewrap sandbox on Linux; `--allow-all --no-sandbox` on macOS and Windows	Yes: “the launch directory is read-only by default”	Linux, macOS Apple Silicon, Windows (x86_64/ARM64)	CLI only, no UI; install script verifies SHA-256	MIT, free
codex-web-ui / codexui	The Codex app UI in any browser, including a phone	Serves the Codex app over HTTP + WebSocket; codexui starts a public Cloudflare tunnel by default	Codex's own execution, with your Codex login and Codex usage	Not described in the README	codex-web-ui: macOS with Codex Desktop; codexui: Linux, Windows, Termux on Android	npx package and scripts	MIT, free
codex-chatgpt-bridge (~280 stars)	Codex hands planning to ChatGPT; Codex executes	Codex skill and PowerShell scripts around DevSpace MCP, behind a Cloudflare tunnel	DevSpace `run_shell`; the README says “`run_shell` is not sandboxed”	No: its levels are “policy that Codex instructs ChatGPT to follow, not something the bridge enforces”	Windows	PowerShell install script; DevSpace from npm	MIT, free
LMCP (not open source)	ChatGPT on the web as a custom connector; also Claude, Cursor and other MCP clients	ChatGPT calls LMCP's server, whose Cloud Relay forwards each request to your computer over an encrypted WebSocket; desktop clients use stdio	Not a project tool: more than 200 tools for Mail, Calendar, Teams, Slack, Office files and other apps	Not stated; you turn each app on or off and approve the ChatGPT connection on your computer	macOS 13+ (Apple Silicon and Intel), Windows 10+ x64; integrations vary by platform	Mac download “Signed & notarized by Apple”; Homebrew cask	Proprietary binary; its site lists a $0 price, a free plan and paid plans under “Pricing coming soon”

Codex with ChatGPT (~7.5k stars, MIT) is left out: it is a planning helper with a read-only MCP connection, and Codex keeps execution. MCP SuperAssistant (~2.6k stars, MIT), a Chrome and Firefox extension that brings MCP tools to ChatGPT and other chat sites through a local proxy, is compared in use local MCP servers with ChatGPT.

What TunnelGPT adds that you would otherwise build or operate

An MCP server plus a tunnel gives ChatGPT tools. TunnelGPT is the harness around them, which other setups leave to you or handle differently:

One project, one connection. Each project has its own profile and its own Secure MCP Tunnel.
Read-only start. Find, read, search, list and git status/diff only; editing is a separate per-project switch and commands need their own grant.
Checked writes. Writes check the expected hash, re-read to confirm and are journaled with receipts.
Commands in isolation. An isolated Linux container in Docker with no external network (--network none, --cap-drop ALL) or an advanced macOS sandbox. Only dependency preparation may use the network, when you allow it.
Private copy by default. A job works on a copy and you review and publish its changes; direct mode is opt-in.
Jobs that outlive the chat. A job keeps running on the Mac if the chat stops; check its status, logs and results from a new conversation. Reconnecting does not resume a ChatGPT response.
Task memory. Save the goal and next step, then resume in another conversation with the same connector.
Local MCPs with their own connection. Add one by HTTP address or command and approve which tools ChatGPT may use. No VPS needed; the Mac must stay awake and online.
Credentials in secure storage. The restricted key and local MCP secrets are kept in the macOS keychain, not in a file.
Signed distribution. A Developer ID signed, notarized DMG for Apple Silicon Macs, and the official tunnel-client, pinned and hash-checked.
No relay server. Project files, credentials and MCP content do not pass through TunnelGPT's servers, which handle only accounts, licenses and updates.

This is not local-only AI: original files stay on the Mac, but the tool results ChatGPT requests go to OpenAI so it can answer, and connected MCPs keep their own data practices. More in use local MCP servers with ChatGPT; for tunnels you run yourself, see TunnelGPT vs DIY MCP tunnels.

When open source is the better choice

You want to read and change the code. Every open-source project above is MIT-licensed, except FileMCP, which uses Apache-2.0. TunnelGPT's desktop app is commercial; only its MIT core is open.
You need Windows or Linux today. Chat On Steroids, Codex ChatGPT Web and dotlink ship for all three systems, MCP Bridge ships for Linux and Windows, and FileMCP builds for Windows. Check TunnelGPT for Windows for its current status; Intel Macs are not supported.
You want to stay in Codex. Codex ChatGPT Web puts ChatGPT Web models in Codex's picker, and codexui puts the Codex UI in a browser.
You prefer a CLI or a server. dotlink is a single binary with named profiles, a NixOS service, Claude.ai support and a Bubblewrap shell sandbox on Linux.
You want features TunnelGPT lacks. Chat On Steroids offers parallel workers, desktop control and Compact & Resume. MCP Bridge comes with Chrome control built in, and FileMCP can save a ChatGPT conversation to your Codex history.
You do not want to pay. The open-source tools are free. TunnelGPT costs $9.97 USD and needs Docker 24+ running.

Quota claims: read them carefully

Codex ChatGPT Web says you get “ChatGPT Web’s separate usage limits, without spending your Work or Codex quota”. That is the project's claim, not OpenAI's. codex-chatgpt-bridge advertises “Save Codex tokens”.

OpenAI's pricing page says: “ChatGPT Work usage inside ChatGPT uses the same pricing, credits, and usage limits as Codex.” Chat On Steroids' README agrees: “ChatGPT Work and Codex share usage limits.” When Codex limits are reached, OpenAI lists waiting for the reset, buying credits on Plus and Pro, or upgrading.

Our claim is narrower. In October 2026 our team tested continuing in regular ChatGPT Chat, with reading, editing and commands, after using up Codex and Work usage on Plus and Pro; in our testing that work used Chat usage. That holds only until December 2026: from then, OpenAI shares one allowance across ChatGPT and Codex (OpenAI help center), so no bridge, ours included, saves Codex usage by moving to Chat. Limits depend on the plan and can change, and no tool, open source or commercial, can promise more OpenAI usage. See what to do when your Codex limit is reached.

Questions to ask any tool before connecting a project

Does it use a documented ChatGPT feature or automate an interface?
Which folders can it read, and does it stay read-only until you change that?
Are editing and commands separate permissions you can grant and revoke per project?
Do commands run with your user privileges, in a sandbox, or in an offline container?
Can a write overwrite a file that changed after ChatGPT read it?
Does it create a public URL, or route traffic through a relay you do not control?
Where are API keys and browser sessions stored?
Are the installers signed, and how do updates arrive?
Who answers when something breaks?

Is TunnelGPT a Chat On Steroids alternative?

For a Mac project in ChatGPT, yes, with a different design. Both use OpenAI's Secure MCP Tunnel. Chat On Steroids also automates the ChatGPT page, runs on three systems and is free; TunnelGPT does not automate the page, starts read-only, runs commands in an offline container and is a paid Mac app.

Can I use ChatGPT models inside Codex?

Codex ChatGPT Web does that by automating ChatGPT Web. TunnelGPT works the other way round: you stay in ChatGPT Chat and the project comes to it as a connector.

Is there a signed FileMCP download?

Not yet. FileMCP's GitHub repository has no published releases: you build the app with its macOS or Windows script, and the README says “The local build is unsigned.” It is Apache-2.0 and gives ChatGPT one workspace folder; if you are comfortable building it and want Windows support, it is a reasonable free choice.

Is LMCP an open-source alternative?

No. LMCP's releases repository says “The LMCP binary is proprietary software”; only its documentation and scripts are MIT. It also does a different job: it connects ChatGPT, Claude and other AI clients to Mail, Calendar, Teams, Slack, Office files and other apps on a Mac or Windows PC, and ChatGPT on the web reaches it through LMCP's Cloud Relay. Its site lists a free plan, with paid-plan prices “coming soon”. If you want ChatGPT in your email and calendar rather than in a code project, LMCP is the better fit.

Do these tools need an OpenAI API key?

The tunnel-based ones do: TunnelGPT, dotlink, FileMCP, MCP Bridge and Codex ChatGPT Web's Full harness use an OpenAI tunnel and API key, as does Chat On Steroids unless you pick Cloudflare. LMCP does not: ChatGPT connects to LMCP's own server, and you approve the connection on your computer. TunnelGPT's guided setup walks you through creating a restricted key (Tunnels Read + Use) but does not create it for you.

Is TunnelGPT open source?

Its core is: tunnelgpt-mcp-core is MIT-licensed, with single-folder file tools and confirmed writes. The desktop app is commercial: $9.97 USD once for a Version 1 Perpetual License, a 3-day trial (72 hours from the first successful connection, no card) and refunds within 14 calendar days. See pricing.

Who supports each tool?

Chat On Steroids' security policy calls it “a solo-maintained beta”, and its README says “Use at your own risk”. At TunnelGPT, a person reads every message sent to support@tunnelgpt.com. TunnelGPT is independent software, not affiliated with OpenAI. To try it, start with the setup guide.

Product