ChatGPT Web, On a Short Leash in Your Repo

What it does

CodexPro runs a local MCP server that connects the ChatGPT web app to your filesystem through OpenAI’s official Developer Mode. It exposes bounded tools for reading files, searching code, making exact edits, checking git status, and running allowlisted shell commands like tests or lint. The model works against your repo context—drawn from AGENTS.md, .ai-bridge handoff files, git state, and selected source files—without broad access to your machine.

The interesting bit

Instead of throwing every possible action at ChatGPT and hoping for the best, CodexPro deliberately limits the default tool surface to a tight coding loop. Safety is treated as a feature: workspace-only writes, blocked secret paths, safe bash defaults, and compact visual cards rather than raw tool dumps. It also keeps agent execution local—ChatGPT can write a plan to .ai-bridge/current-plan.md, but a separate user-started CLI process runs it through Codex, OpenCode, or Pi.

Key highlights

• Three tool modes: minimal, standard (default), and full for controlling ChatGPT’s action catalog
• Context assembly from AGENTS.md, .ai-bridge, git status/diff, and selected files
• Safe bash execution restricted to verification commands like test, lint, and build
• Handoff workflow: ChatGPT drafts plans, local execute-handoff or watch-handoff runs them
• Token-protected public URLs via Cloudflare tunnel or ngrok

Caveats

• Requires ChatGPT Plus or Pro with Developer Mode; free accounts reportedly lack the necessary app flow
• Needs a public tunnel (Cloudflare or ngrok) to bridge localhost to ChatGPT’s web app
• Some ChatGPT model surfaces may still be unable to call MCP tools even with the correct account tier

Verdict

Try it if you want ChatGPT web to act like a restrained local coding assistant with explicit execution boundaries. Skip it if you are looking for an OS sandbox or a way to bypass OpenAI limits.