Canonical containment rejects traversal and link-based escapes.
Give ChatGPT one repository, not your whole machine.
RepoRelay gives ChatGPT a narrow, authenticated MCP surface for reading and searching one approved local repository, without shell access or machine-wide filesystem control.
Last updated:
Open source · reporelay-mcp · MCP io.github.Lukie-81/reporelay · MIT
One approved rootLoopback onlyNo shell or Git
Example review
RepoRelayRequest
Allowed
open_workspaceApproved root
C:\Projects\my-appOne repository selectedRequest
Allowed
list_filessrc/ docs/ README.md .ai-handoff/
Request
Blocked
read_file(".env")Sensitive paths stay outside the review surface.
A small example of the boundary: inspect the approved project, while sensitive paths stay blocked.
What is RepoRelay?
Bounded local repository access for ChatGPT review.
RepoRelay is a local MCP bridge. It lets ChatGPT inspect and search one explicitly approved repository through a narrow, authenticated interface.
It does not provide shell access, Git execution, machine-wide filesystem access, or arbitrary source-file writes. RepoRelay is separate from ChatGPT, OpenAI, Codex, GitHub, and the Secure MCP Tunnel.
Install, audit, connect.
Start one approved root, verify the local bridge, then connect ChatGPT through the separate tunnel layer.
PS> npm install -g reporelay-mcp@latest PS> reporelay quickstart "C:\Projects\my-app" PS> reporelay audit "C:\Projects\my-app" # In a second window PS> reporelay tunnel setup PS> reporelay tunnel doctor PS> reporelay tunnel run
- Use Node.js
>=22.19 <27. - Quote the repository path on Windows.
- Run
reporelay auditbefore connecting.
The useful surface is deliberately small.
RepoRelay keeps review inside one approved root and exposes only the operations needed to inspect it.
Read the local repository guideFour bounded inspection tools keep the review surface focused.
No shell, Git, process launch, arbitrary edits, or deletes.
Optional writers target only three pre-existing handoff files.
Application-level controls are not an operating-system sandbox. Read the full security model.
Transport carries requests. RepoRelay owns the boundary.
ChatGPTMCP client that calls available tools.
Secure MCP TunnelTransport for reaching a private local server.
tunnel-clientLocal forwarder to the loopback endpoint.
RepoRelayAuthenticated server and application boundary.
RepositoryOne approved local directory.
- open_workspace
- list_files
- read_file
- search_files
- 3 fixed handoff writers
Three layers, one decision point
ChatGPT calls MCP tools. The tunnel carries the request. RepoRelay decides whether the requested path and operation are allowed.
Review, then implement locally
Handoff is not execution.
With handoff writes enabled, ChatGPT can leave a task, review, and state update in fixed .ai-handoff files. A local coding agent owns the implementation and RESULT.md.
Source and handoff
Keep review context separate from execution.
ChatGPT can inspect, search, and optionally write three fixed handoff files. Your local agent remains the implementation authority.
ChatGPT reviews
Read the approved repository, search for evidence, and leave a bounded task or review.
Your local agent implements
RepoRelay never launches Codex, Claude, shell commands, or Git.
Answers before installation
Start with the questions developers actually ask.
01 / access
How can ChatGPT access a local repository?
Understand the roles of MCP, the tunnel, and RepoRelay.
02 / securityDoes RepoRelay give ChatGPT shell access?
No. See the exact tool surface and documented limitations.
03 / workflowWhen should I use GitHub instead?
Compare a pushed source of truth with bounded local review.
Read the implementation. Make your own call.
RepoRelay is an independent MIT-licensed project. Open the source, security policy, issues, and package metadata before you use it.