01 / before push
Review work in progress.
Ask for code review while changes still live locally, before a branch or pull request exists.
A direct answer
How can ChatGPT access a local repository?
ChatGPT Web can review a local repository through an MCP server that you run on your machine, reached through an authenticated Secure MCP Tunnel. RepoRelay is that local MCP server: it exposes one explicitly approved repository through a narrow set of review tools.
Last updated:
Answer first
What does RepoRelay let ChatGPT access?
One approved repository, through a narrow MCP surface.
ChatGPT can call RepoRelay's inspection tools to list files, read eligible files, and search content inside the one canonical repository you selected. The normal quickstart can also enable three fixed handoff writers for .ai-handoff files.
Does RepoRelay give ChatGPT shell access?
No. RepoRelay does not expose shell, PowerShell, Git, process execution, arbitrary source-file editing, or delete tools. The security page documents the enforced boundary and its limits.
Can it read outside the approved repository?
Containment checks reject traversal, absolute escapes, link-based escapes, and hard-linked files outside the canonical root. RepoRelay is still an application boundary, not an operating-system sandbox against malicious software running as the same user.
Why a bridge is needed
A browser session is not a local file browser.
ChatGPT Web does not automatically receive permission to walk through arbitrary folders on your computer. A local folder contains more than source code: credentials, personal files, build outputs, Git metadata, and unrelated projects may sit nearby.
MCP is an open protocol for connecting AI applications to external systems and for calling tools exposed by a server. The server decides which operations exist and which arguments are accepted. A transport layer can carry those calls, but it does not decide what the server is authorized to read or write.
RepoRelay makes that decision explicit: one canonical repository root, authenticated loopback binding, bounded review operations, and fixed handoff destinations when handoff writes are enabled.
Five components / five jobs
Do not collapse the architecture into one product.
ChatGPT, MCP, the tunnel, and RepoRelay each have a different role. Keeping the roles separate makes the security boundary easier to inspect.
| Component | Role in local repository access |
|---|---|
| ChatGPT Web | The MCP client and reviewer. It calls the tools that the server exposes; it does not receive a general terminal. |
| Model Context Protocol | The protocol used to describe and call tools between a client and a server. MCP itself is not the repository boundary. |
| OpenAI Secure MCP Tunnel | The external connectivity service that allows a private local MCP server to be reached by an eligible ChatGPT workspace. |
tunnel-client | The local forwarder configured to point at RepoRelay's loopback MCP endpoint. |
| RepoRelay | The local MCP server and application boundary that authenticates requests and enforces the approved repository/tool surface. |
Request path
1 / ChatGPTCalls an MCP tool.
2 / TunnelCarries the request.
3 / ClientForwards locally.
4 / RepoRelayAuthenticates and authorizes.
5 / RootReturns bounded data.
What happens next
Review the current working tree without making it the whole computer.
After open_workspace, ChatGPT can use the four inspection tools to list directories, read eligible files, and search repository content. The normal quickstart can also enable three fixed handoff writers: write_next_task, write_review, and update_handoff_state.
Those writers are pathless and limited to predetermined .ai-handoff files. They are not a general editing API. Inspection-only mode uses --no-handoff-writes and exposes exactly four tools.
Where this helps
Local review fills a different gap.
RepoRelay is useful when the local working state is the thing you want reviewed, not necessarily the public repository state.
02 / current state
Use the repository on disk.
Inspect generated configuration or local project files that you intentionally included in the approved root and that pass the sensitive-path rules.
03 / paired workflow
Keep implementation close.
Let ChatGPT write a bounded task or review, while a local coding agent performs the authorized implementation with your own tools.
Get started
The shortest safe explanation is also the setup order.
Start RepoRelay for one path, run reporelay audit, configure the Secure MCP Tunnel, verify the seven-tool or four-tool surface, and test a sensitive path before normal use.