Guide
How to use local MCP servers with ChatGPT (no VPS)
ChatGPT on the web cannot reach an MCP server at localhost on your computer, so you need one of four routes: a public HTTPS tunnel such as ngrok or Cloudflare, hosting the server on a VPS or cloud service, OpenAI's Secure MCP Tunnel run by yourself, or a packaged app like TunnelGPT that runs a Secure MCP Tunnel for each local MCP and lets you approve its tools. The ChatGPT desktop app's Codex mode can run local stdio MCP servers directly, but that work uses your Codex usage.
This guide covers the error you see, how the options compare, and how to connect a local MCP with TunnelGPT on a Mac. For connecting project folders rather than MCP servers, see how to connect ChatGPT to local files.
Checked on 25 October 2026
We checked OpenAI's Secure MCP Tunnel guide, the Codex MCP documentation and ChatGPT's custom MCP server documentation on 25 October 2026. Those pages carry no date stamps, and labels and availability can change with your account and plan.
Why localhost fails with "Unsafe URL"
ChatGPT on the web uses remote MCP tools, added as plugins or custom MCP servers. An address like http://localhost:3000/mcp only means something on your own computer. When you enter a localhost address as a custom MCP server, ChatGPT rejects it with Unsafe URL.
So the server must be reachable some other way. Either you give it a public HTTPS address, or you use OpenAI's Secure MCP Tunnel, which lets you connect private and localhost MCP servers without a public listener. With the tunnel, OpenAI's tunnel-client runs on your computer, forwards requests to the local MCP server and returns the responses.
Ways to connect a local MCP server to ChatGPT
| Option | Public endpoint? | What you operate | Cost | Best for |
|---|---|---|---|---|
| VPS or cloud hosting | Yes | The server, hosting, HTTPS, authentication, updates and monitoring. | Your hosting provider's price. | Always-on servers shared by a team. |
| ngrok or Cloudflare Tunnel | Yes | An HTTP MCP server, the tunnel agent, authentication and access policy. | Depends on the provider's plan. | Clients outside OpenAI, or a public HTTPS endpoint you control. |
| OpenAI Secure MCP Tunnel yourself | No | tunnel-client, a tunnel_id from Platform, an API key with Tunnels Read and Use, and the process lifecycle. | OpenAI's documentation does not state a standalone tunnel price. | Developers who want scripts, containers or headless hosts. |
| ChatGPT desktop app or Codex CLI (local stdio) | No | The MCP configuration in Codex. | Uses your Codex usage. | Working inside Codex on the same computer. |
| TunnelGPT | No | A Mac app, Docker, and the OpenAI tunnel and restricted key you create once. | $9.97 USD one-time, Version 1 Perpetual License, after a 3-day trial. | Mac users who want local MCPs in regular ChatGPT Chat on the web or phone. |
Codex and the Codex CLI support local stdio MCP servers, as described in the Codex MCP documentation. Using local MCP tools in desktop Chat sessions has an open bug report. For a deeper comparison of self-managed tunnels, see TunnelGPT vs DIY MCP tunnels.
Do you need a VPS?
No. A VPS solves the reachability problem by moving the server to a public machine. That also moves the server away from what it may need on your computer: local files, signed-in accounts and tools you already have installed. With a Secure MCP Tunnel, the server stays on your machine and the connection is outbound, so there is no public endpoint to protect.
Step by step with TunnelGPT
TunnelGPT is a paid desktop app for Mac with Apple Silicon (M1 or later). It needs Docker 24 or later running. You also need a ChatGPT account that can add custom MCP servers on chatgpt.com, and permission in your OpenAI Platform organization to create a Secure MCP Tunnel and a restricted key with Tunnels Read and Use. TunnelGPT does not create the tunnel or the key for you; the guided setup walks you through both.
- Add the MCP server in TunnelGPT. Use its local HTTP address, for example
http://127.0.0.1:8000/mcp, or the command that starts it if it is a stdio server. - Review and approve its tools. Approve only the tools you want ChatGPT to use. The rest stay unavailable.
- Let it get its own connection. Each local MCP gets its own connection with its own Secure MCP Tunnel, separate from your project connections.
- Start the connection and wait until it is ready.
- Add it in ChatGPT. In the custom MCP server flow on chatgpt.com, select the tunnel for that MCP, review the tools shown and save.
- Keep the Mac awake. The Mac must stay awake, online and connected while ChatGPT uses the MCP. The tunnel does not wake a sleeping computer.
No TunnelGPT relay server sits in the data path. MCP requests and responses travel between OpenAI and your Mac through OpenAI's Secure MCP Tunnel, using tunnel-client pinned to a known version and checked by hash.
Safety checklist before you connect
- Approve only the tools you need. A smaller tool list means fewer actions ChatGPT can take.
- Remember the MCP keeps its own permissions. If the server is signed in to an account or can read folders, it keeps that access. Approving it in TunnelGPT does not narrow what it can already do.
- Results go to OpenAI. The tool results ChatGPT requests are sent to OpenAI so it can answer. This is not local-only AI, and the MCP may have its own data practices.
- Write actions ask for confirmation. ChatGPT asks you to confirm write actions by default. Read what it is about to do before you accept.
- Start with something harmless. Connect a server whose tools only read data first, check the results, then add more.
Troubleshooting
ChatGPT says "Unsafe URL". You entered a localhost or private address directly as the server URL. ChatGPT does not accept those. Connect the MCP through a Secure MCP Tunnel instead and select the tunnel in the custom MCP server flow.
The tunnel does not appear in ChatGPT. The tunnel must be associated with the ChatGPT workspace where you are adding the server, and your account needs permission to add custom MCP servers there. Check the tunnel in OpenAI Platform and the restricted key's Tunnels Read and Use scope.
The connection never becomes ready. Check that TunnelGPT is open and that the MCP server itself starts: the HTTP address answers, or the command runs.
Tools are missing in ChatGPT. Confirm the tools are approved in TunnelGPT, then refresh the connector's tools in ChatGPT. If you approved tools after adding the server, ChatGPT can keep showing the old list until you refresh it.
It worked, then stopped. The Mac went to sleep, lost its network or the connection was stopped. Wake the Mac, check the connection is ready and try again. Reconnecting does not automatically resume an interrupted ChatGPT response.
Does it work from my phone?
Yes, when the connector is available in that ChatGPT interface and the Mac is awake and connected. You can also use it from ChatGPT on another computer, and in voice sessions that can call the MCP. What works depends on the model and your account.
Does it work with stdio MCP servers?
Yes. Add the server by the command that starts it, and TunnelGPT runs it on the Mac. HTTP servers are added by their local address.
Which ChatGPT plans does it work with?
Our team tested TunnelGPT on ChatGPT Plus and Pro in October 2026. The requirement is an account that can add custom MCP servers on chatgpt.com, plus permission to create a Secure MCP Tunnel in your OpenAI Platform organization. Availability can change, so check it during the free trial: 3 days, meaning 72 consecutive hours from the first successful connection, with no card required.
Is TunnelGPT an OpenAI product?
No. TunnelGPT is independent software, not affiliated with OpenAI. It uses OpenAI's official Secure MCP Tunnel and ChatGPT's documented custom MCP server feature, with your own account and permissions.
Next steps
- Do the one-time setup
- See the price and the license
- Keep working when your Codex or Work limit is reached