{"slug": "i-built-a-way-to-let-chatgpt-web-review-your-local-repo", "title": "I built a way to let ChatGPT Web review your local repo", "summary": "RepoRelay, a local MCP bridge, lets ChatGPT Web inspect exactly one approved local repository without granting shell, Git, or arbitrary write access, using OpenAI's Secure MCP Tunnel. The tool, installed via npm as reporelay-mcp, requires Node.js >=22.19 and <27 and provides seven read/search tools plus fixed handoff file writes, positioning itself as a security boundary between ChatGPT and the user's machine.", "body_md": "**Give AI access to your repository — not your machine.**\n\nRepoRelay lets ChatGPT safely inspect one local repository without giving it control of the rest of your computer.\n\n**ChatGPT → Secure MCP Tunnel → tunnel-client → RepoRelay → one approved repository**\n\n**Read safe files · Search code · One approved repository · No shell · No Git · No arbitrary writes**\n\n[Quick Setup](#quick-setup) ·\n[Use It](#youre-connected--what-now) ·\n[Handoff](#chatgpt--coding-agent-handoff) ·\n[Troubleshooting](#troubleshooting) ·\n[Security](#security)\n\nRepoRelay is a local, first-party MCP bridge that gives ChatGPT **bounded\naccess to exactly one approved repository on your computer** — nothing more.\n\nChatGPT reviews your code through RepoRelay, and can leave a structured task for a separate local coding agent (like Codex or Claude) through fixed handoff files. RepoRelay is the security boundary between ChatGPT and your machine.\n\n```\nChatGPT reviews/plans\n        ↓\nRepoRelay\n        ↓\nRepository reads/searches\n+\nfixed .ai-handoff writers\n        ↓\nCodex / another local coding agent implements\n```\n\nMCP (Model Context Protocol) is the standard that lets ChatGPT call tools.\nChatGPT is the MCP client. RepoRelay is the local MCP server and security\nboundary: it decides what ChatGPT may access and exposes exactly one approved\nrepository at a time. `tunnel-client`\n\nis only the secure networking pipe that\ncarries ChatGPT traffic to your computer.\n\n| Component | Job |\n|---|---|\n| ChatGPT | MCP client — chooses RepoRelay tools. |\n| Secure MCP Tunnel | Carries traffic from ChatGPT to your computer. |\n`tunnel-client` |\nLocal network forwarder; points the tunnel at RepoRelay. |\n| RepoRelay | MCP server + security boundary; enforces authentication and allowed access. |\n| Repository | The one directory ChatGPT is allowed to inspect. |\n\n**What ChatGPT can do through RepoRelay (the normal 7-tool setup):**\n\n```\n✓ inspect files          open_workspace, list_files, read_file\n✓ search the repository  search_files\n✓ write to three predetermined handoff targets\n                         write_next_task, write_review, update_handoff_state\n```\n\n**What ChatGPT cannot do:**\n\n```\n✗ run shell commands\n✗ run PowerShell\n✗ run Git\n✗ launch processes\n✗ arbitrarily edit source files\n✗ delete files\n✗ choose arbitrary write targets\n✗ access outside the approved repository\n```\n\nThis is one of RepoRelay's strongest differentiators: ChatGPT can read and plan\nagainst your code, but it gets **no execution capability** and can only write to\na few fixed handoff files you control.\n\nYou need:\n\n**Node.js**`>=22.19`\n\nand`<27`\n\n(npm is included). Check with`node --version`\n\n.**An existing local project or repository** you want ChatGPT to review. It must be a real folder on your computer — not a drive root and not your whole user folder.**OpenAI Secure MCP Tunnel access.** RepoRelay reaches ChatGPT through OpenAI's Secure MCP Tunnel. See the current[OpenAI Secure MCP Tunnel guide](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels)for availability, permissions, and plan details.**Permission to create/use a custom MCP app** in the target ChatGPT workspace (ChatGPT developer mode).\n\nYou do **not** need to download anything else. RepoRelay installs the official\nOpenAI `tunnel-client`\n\nautomatically during `reporelay tunnel setup`\n\n.\n\nDo not worry about the handoff protocol yet. The quickstart sets up working handoff files for you and explains them as you go.\n\nWindows paths.Always quote the full path and keep the backslashes:\n\n```\nreporelay quickstart \"C:\\Users\\you\\Projects\\my-app\"\n```\n\n`C:\\Users\\you\\Projects\\my-app`\n\nis correct.`C:Users\\you\\Projects\\my-app`\n\nis not — the backslashes matter.\n\n```\nnpm install -g reporelay-mcp@latest\n```\n\nCheck the install:\n\n```\nreporelay --version\n```\n\nIf `reporelay`\n\nis not recognized, see [Troubleshooting](#troubleshooting).\n\n```\nreporelay quickstart \"C:\\Projects\\my-app\"\n```\n\nReplace the path with the repository you want to expose. Keep this PowerShell window open.\n\nYou should see:\n\n```\nReady.\nLocal MCP: http://127.0.0.1:7676/mcp\n```\n\nThe normal quickstart enables the **7-tool handoff surface** (4 inspection\ntools + 3 fixed handoff writers). RepoRelay now creates a small `.ai-handoff`\n\nworkspace and an `AGENTS.md`\n\nnote so ChatGPT can leave structured tasks and\nreviews for a separate local coding agent:\n\n```\n.ai-handoff/NEXT_TASK.md\n.ai-handoff/REVIEW.md\n.ai-handoff/RESULT.md\n.ai-handoff/STATE.json\nAGENTS.md\n```\n\n**Why does RepoRelay create these?** ChatGPT still cannot run commands, use\nGit, or arbitrarily edit your repository. These files are simply a place where\nChatGPT can leave a task, and a separate local coding agent (running on your\nown machine, with your own permission) can leave its result. More below in\n[ChatGPT ↔ coding-agent handoff](#chatgpt--coding-agent-handoff).\n\nTo stop RepoRelay later, press **Ctrl+C** in this window. There is no\n`reporelay quickstart --stop`\n\n.\n\nImmediately after quickstart, verify RepoRelay's actual security boundary:\n\n```\nreporelay audit \"C:\\Projects\\my-app\"\n```\n\nYou should see:\n\n```\nRESULT: PASS\n```\n\nAudit starts its own temporary loopback listener and exercises the real\nauthenticated MCP surface, containment checks, and handoff restrictions. It\ndoes not modify your repository. This validates RepoRelay *before* ChatGPT is\nconnected.\n\nIn a **second** PowerShell window, run:\n\n```\nreporelay tunnel setup\n```\n\nThis starts the RepoRelay setup wizard. It does everything for you:\n\n```\n✓ installs a RepoRelay-supported OpenAI tunnel-client\n✓ verifies it (pinned version + official SHA-256)\n✓ opens OpenAI tunnel setup\n✓ asks for your tunnel ID\n✓ opens OpenAI runtime-key setup\n✓ securely stores the pasted key\n✓ creates the tunnel profile\n✓ tests the complete connection\n```\n\nYou provide exactly two things, both in OpenAI Platform:\n\n**Your Secure MCP Tunnel ID**— the wizard opens[https://platform.openai.com/settings/organization/tunnels](https://platform.openai.com/settings/organization/tunnels)in your browser. Create or select a tunnel, associate it with your ChatGPT workspace, and paste its`tunnel_id`\n\nback in the terminal.**A runtime API key**— the wizard opens[https://platform.openai.com/settings/organization/api-keys](https://platform.openai.com/settings/organization/api-keys). Create a secret key for the project you use with the tunnel and paste it in the terminal. Input is hidden: nothing appears while you paste. This key authenticates`tunnel-client`\n\nto OpenAI; it is**not** the RepoRelay bridge secret.\n\nCreating or editing a tunnel needs the **Tunnels Read + Manage** permission;\nrunning `tunnel-client`\n\nor selecting the tunnel needs **Tunnels Read + Use**.\nThese are organization-level permissions granted by your org owner or RBAC\nadmin. Follow the current\n[OpenAI Secure MCP Tunnel guide](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels)\nfor the exact UI and permission details.\n\nWhen the wizard finishes, you should see:\n\n```\nTesting connection...\n✓ OpenAI runtime credential\n✓ RepoRelay reachable\n✓ Bridge authentication\n\nSetup complete.\n\nNext:\n  reporelay tunnel run\n```\n\nThese checks are genuine: setup validates the runtime API key against the\nOpenAI control plane (the same read-only tunnel lookup `tunnel-client`\n\nperforms\nat startup) and verifies the bridge secret against the RepoRelay that is\nactually running. A wrong, expired, or mis-pasted key is caught here with a\nclear message — not after `tunnel run`\n\nstarts.\n\nIf your RepoRelay runs on a custom port (for example `--port 7677`\n\n),\nquickstart already recorded the live endpoint and setup follows it\nautomatically — no extra flags needed.\n\nUseful options:\n\n`reporelay tunnel setup --no-open`\n\n— do not launch the browser (headless, SSH, or CI); the URLs are still printed.`reporelay tunnel setup --replace-tunnel`\n\n— prompt for a new tunnel ID.`reporelay tunnel setup --replace-runtime-key`\n\n— prompt for a new runtime API key.`reporelay tunnel setup --tunnel-client-path \"C:\\custom\\tunnel-client.exe\"`\n\n—**advanced override** for unusual environments; RepoRelay does not verify or manage a custom binary.\n\nRe-running `reporelay tunnel setup`\n\nreuses your existing verified client,\ntunnel ID, and stored key, and re-tests the connection without asking for\nanything again.\n\n```\nreporelay tunnel run\n```\n\nKeep this window open alongside the RepoRelay quickstart window. Stop it with Ctrl+C when you are done.\n\nIf the connection ever stops working, `reporelay tunnel doctor`\n\nremains\navailable as a standalone troubleshooting command (expect `Ready.`\n\nwhen\neverything is healthy; add `--verbose`\n\nfor redacted diagnostics).\n\nIn ChatGPT, using the current OpenAI flow (see the\n[ChatGPT developer-mode and MCP apps guide](https://help.openai.com/en/articles/12584461-developer-mode-and-mcp-apps-in-chatgpt)):\n\n```\nChatGPT\n→ Apps / developer features\n→ create custom MCP app\n→ connection: Tunnel\n→ choose RepoRelay's tunnel\n→ authentication: No authentication\n→ Scan Tools\n→ verify 7 tools\n→ create/use the app\n→ start a new chat\n```\n\nFollow this sequence:\n\n- Create the custom MCP app.\n- Choose the\n**Tunnel** connection. - Select the RepoRelay/OpenAI Secure MCP Tunnel.\n- When ChatGPT asks for authentication, select\n**No authentication**. - Save or create the app.\n- Run\n**Scan Tools**. - Verify the expected RepoRelay tools appear.\n- Start a new chat and select the RepoRelay app.\n\nAuthentication: No authentication.RepoRelay already authenticates the local bridge through the protected`X-RepoRelay-Bridge-Secret`\n\nused by the tunnel. Do not configure OAuth or another ChatGPT-side authentication method.\n\nNever paste `127.0.0.1`\n\n, `localhost`\n\n, the RepoRelay bridge secret, or an OpenAI\nruntime API key into ChatGPT. The tunnel connection does all the networking.\n\nIn the ChatGPT app flow, run **Scan Tools** and confirm RepoRelay exposes\nexactly these seven tools:\n\n```\nopen_workspace\nlist_files\nread_file\nsearch_files\nwrite_next_task\nwrite_review\nupdate_handoff_state\n```\n\nThat is the expected normal surface. If Scan Tools shows shell, Git, process\nexecution, generic file editing, delete, patching, or any other unexpected\ncapability, **stop and investigate** before using the app — run\n`reporelay audit \"C:\\Projects\\my-app\" --json`\n\nand confirm the tool list.\n\nStart a new chat, select the RepoRelay app, and try:\n\n```\nOpen the approved repository and list its top-level files.\n```\n\nThen test the boundary:\n\n```\nTry to read .env.\n```\n\nThe second request should be blocked.\n\nYou now have ChatGPT reviewing your repository through a verified security boundary. Useful prompts:\n\n```\nRead README.md and explain how this project starts.\nSearch the repository for \"authentication\".\nReview src/server.ts for error-handling issues and write your findings.\n```\n\nThe normal RepoRelay setup lets ChatGPT plan and review while a separate local\ncoding agent (Codex, Claude, or another) does the implementation. RepoRelay\ncoordinates them through a small `.ai-handoff`\n\nworkspace:\n\n```\n.ai-handoff/\n├── NEXT_TASK.md   ChatGPT writes the task here\n├── RESULT.md      the local coding agent writes its result here\n├── REVIEW.md      ChatGPT writes its review here\n└── STATE.json     coordinates the cycle\n```\n\nConceptually:\n\n```\nChatGPT\n  ↓ writes NEXT_TASK.md\n\nCodex / local coding agent\n  ↓ implements\n  ↓ writes RESULT.md\n\nChatGPT\n  ↓ reviews result\n  ↓ writes REVIEW.md\n```\n\n`STATE.json`\n\ncoordinates the cycle. RepoRelay itself **does not run Codex or\nClaude** — they are separate local applications you start yourself. The\nhandoff files are just a structured place to hand work back and forth.\n\nChatGPT can only write `NEXT_TASK.md`\n\n, `REVIEW.md`\n\n, and `STATE.json`\n\n. The\nimplementer-owned `RESULT.md`\n\nis never writable by ChatGPT.\n\nSee [docs/handoff-cycle.md](/Lukie-81/RepoRelay/blob/main/docs/handoff-cycle.md) for the detailed protocol\nand [examples/](/Lukie-81/RepoRelay/blob/main/examples) for reviewer and implementer prompts.\n\nAfter the one-time setup, do not recreate the tunnel or the ChatGPT app. Each day:\n\n-\nStart RepoRelay:\n\n```\nreporelay quickstart \"C:\\Projects\\my-app\"\n```\n\n-\nStart the tunnel (in a second window):\n\n```\nreporelay tunnel run\n```\n\n-\nOpen ChatGPT, start a new chat, and select the existing RepoRelay app.\n\nKeep both windows open while you use the app. If the connection stops working,\nrun `reporelay tunnel doctor`\n\nagain.\n\n**RepoRelay exposes one repository at a time.**\n\n-\nPress\n\n**Ctrl+C** in the RepoRelay terminal. -\nStart RepoRelay for the new repository:\n\n```\nreporelay quickstart \"C:\\Projects\\another-repo\"\n```\n\n-\nKeep\n\n`tunnel-client`\n\nrunning. It reconnects to the restarted RepoRelay automatically (same port and protected bridge-secret file). If you used a different port, the managed tunnel follows it automatically. -\nStart a new ChatGPT conversation and select the RepoRelay app.\n\n-\nAsk ChatGPT to open the new repository.\n\nDo not rescan tools just because the approved repository changed. Rescan only if the tool definitions changed or ChatGPT asks you to.\n\n| You see | What to do |\n|---|---|\n`'node' is not recognized` |\nNode.js is not installed, or PowerShell was opened before the install finished. Install Node.js from\n`node --version` . |\n\n`RepoRelay requires Node.js >=22.19 and <27`\n\n`node --version`\n\n.`'reporelay' is not recognized`\n\n`npm install -g reporelay-mcp@latest`\n\n, close and reopen PowerShell, and try `reporelay --version`\n\n.`Cannot find module ... dist\\cli.js`\n\n`cd`\n\ninto the `RepoRelay`\n\nfolder and run `npm run build`\n\nfirst.`C:Users\\you\\...`\n\n(path looks mangled)`reporelay quickstart \"C:\\Users\\you\\Projects\\my-app\"`\n\n.`Port 7676 is already in use`\n\n`--port 7677`\n\n) — the managed tunnel follows the new port automatically. There is no `quickstart --stop`\n\n; stop RepoRelay with **Ctrl+C**. On Windows, find the listener with `Get-NetTCPConnection -LocalPort 7676 -State Listen` AGENTS.md`\n\n`AGENTS.md`\n\nwithout the RepoRelay marker. RepoRelay will not overwrite it. Review the file first; if you want RepoRelay to preserve it and append the marked handoff instructions, rerun `reporelay quickstart \"...\" --append-agent-instructions`\n\n.`tunnel-client`\n\nmissing`reporelay tunnel setup`\n\n; it re-downloads and verifies the managed client.`tunnel_`\n\nfollowed by 32 hex characters. Copy it again from Platform tunnel settings.**Tunnels Read + Use**. Rerun`reporelay tunnel setup`\n\n.`reporelay tunnel doctor`\n\n.`reporelay tunnel doctor`\n\n.`reporelay tunnel setup`\n\n.`reporelay tunnel doctor`\n\nreports `Ready.`\n\n, then rescan in a **new** app/chat.`reporelay audit \"C:\\Projects\\my-app\" --json`\n\nand confirm the expected 7-tool list.`reporelay quickstart \"C:\\Projects\\my-app\"`\n\n, then try again in a new chat.`tunnel-client`\n\nstopped. Restart it with `reporelay tunnel run`\n\n, then try again in a new chat.`reporelay tunnel doctor`\n\nreports as the local MCP endpoint. Quickstart records the live endpoint automatically, or set it explicitly with `reporelay tunnel setup --port <port>`\n\n.For anything else, run `reporelay doctor`\n\n. It prints configuration and security\nstatus without printing secret values.\n\nThe normal RepoRelay experience is the **7-tool handoff surface** above, and it\nis the recommended beginner setup. If you specifically want ChatGPT to\n**inspect only** — no handoff files, no writes at all — start with:\n\n```\nreporelay quickstart \"C:\\Projects\\my-app\" --no-handoff-writes\n```\n\nIn this optional mode RepoRelay exposes exactly four tools:\n\n```\nopen_workspace\nlist_files\nread_file\nsearch_files\n```\n\nRead-only mode does **not** create `.ai-handoff`\n\n, does **not** create or modify\n`AGENTS.md`\n\n, and leaves the approved repository unchanged. All containment,\nauthentication, and security checks still apply. Use the matching audit flag:\n\n```\nreporelay audit \"C:\\Projects\\my-app\" --no-handoff-writes\n```\n\nWhen you use this mode, expect **4 tools** in Scan Tools instead of 7.\n\nRepoRelay's enforced boundary includes:\n\n- loopback-only binding and authentication required;\n- exactly one existing canonical approved root;\n- sensitive paths blocked, including\n`.env`\n\n, VCS metadata, credential stores, and private-key formats; - traversal, absolute outside-root paths, symlink/junction/reparse escapes, and hard-link bypasses blocked;\n- bounded reads, searches, results, and handoff content;\n- no shell, PowerShell, Git, process, generic write, patch, delete, artifact, worktree, skill, subagent, or local-agent tool;\n- handoff writes limited to the three fixed pre-existing targets.\n\nRepoRelay is a least-privilege application boundary, not an operating-system sandbox against malicious software already running as the same local user. An external Secure MCP Tunnel is a separate security boundary and must be secured independently. Choose the approved repository carefully.\n\nSee [SECURITY.md](/Lukie-81/RepoRelay/blob/main/SECURITY.md) for the full security model and\n`reporelay audit`\n\ndocumentation.\n\nMost users never need these. When you do:\n\n[Configuration](/Lukie-81/RepoRelay/blob/main/docs/configuration.md)—`REPORELAY_*`\n\nenvironment variables, bridge authentication, ports, logging, and handoff mode.[ChatGPT Web setup details](/Lukie-81/RepoRelay/blob/main/docs/chatgpt-web.md)— the full tunnel and app reference.[Windows operations](/Lukie-81/RepoRelay/blob/main/OPERATIONS.md)— lifecycle scripts, scheduled tasks, and managed Windows setup.— placeholder configuration only. Never put a real bridge secret or tunnel credential in it.`.env.example`\n\n**Local MCP clients**— if your MCP client runs on the same computer as RepoRelay, you do not need the tunnel: point it at the local MCP URL printed by quickstart and send the`X-RepoRelay-Bridge-Secret`\n\nheader loaded from the protected file.\n\nFor configuration and security status without printing secret values:\n\n```\nreporelay doctor\n```\n\n- Node.js\n`>=22.19 <27`\n\n(npm is included); - Git for the clone-based install — optional if you download the ZIP instead.\n\nThe quickstart in this README works on Windows, macOS, and Linux. Windows 10/11 is the fully validated lifecycle and operational platform, including the PowerShell scripts and tunnel-managed runbook.\n\n- One approved repository is exposed at a time.\n- RepoRelay is not an operating-system sandbox.\n- ChatGPT Web needs external OpenAI Secure MCP Tunnel infrastructure to reach a private local bridge.\n- Windows is the fully validated lifecycle platform; other platforms do not have identical PowerShell/tunnel operations.\n- Codex, Claude, and other coding agents are separate local applications, not components of RepoRelay.\n\n[ChatGPT Web setup](/Lukie-81/RepoRelay/blob/main/docs/chatgpt-web.md)[Security model](/Lukie-81/RepoRelay/blob/main/SECURITY.md)[Configuration](/Lukie-81/RepoRelay/blob/main/docs/configuration.md)[Windows operations](/Lukie-81/RepoRelay/blob/main/OPERATIONS.md)[Setup notes](/Lukie-81/RepoRelay/blob/main/docs/setup.md)[Handoff cycle](/Lukie-81/RepoRelay/blob/main/docs/handoff-cycle.md)[Handoff examples](/Lukie-81/RepoRelay/blob/main/examples)[Contributing](/Lukie-81/RepoRelay/blob/main/CONTRIBUTING.md)\n\nRepoRelay is released under the [MIT License](/Lukie-81/RepoRelay/blob/main/LICENSE). The project keeps its\nrequired upstream attribution and does not bundle the SDKs or runtimes of\nCodex, Claude, or other implementers.\n\n```\nnpm ci\nnpm run typecheck\nnpm test\nnpm run verify:release\nnpm audit --audit-level=low\nnpm pack --dry-run --json\ngit diff --check\n```\n\n", "url": "https://wpnews.pro/news/i-built-a-way-to-let-chatgpt-web-review-your-local-repo", "canonical_source": "https://github.com/Lukie-81/RepoRelay", "published_at": "2026-08-18 09:32:15+00:00", "updated_at": "2026-08-18 09:40:59.652392+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "ai-safety", "developer-tools"], "entities": ["RepoRelay", "ChatGPT", "OpenAI Secure MCP Tunnel", "Codex", "Claude", "Node.js"], "alternates": {"html": "https://wpnews.pro/news/i-built-a-way-to-let-chatgpt-web-review-your-local-repo", "markdown": "https://wpnews.pro/news/i-built-a-way-to-let-chatgpt-web-review-your-local-repo.md", "text": "https://wpnews.pro/news/i-built-a-way-to-let-chatgpt-web-review-your-local-repo.txt", "jsonld": "https://wpnews.pro/news/i-built-a-way-to-let-chatgpt-web-review-your-local-repo.jsonld"}}