RepoRelay questions, answered without the marketing fog.

RepoRelay is an open-source local MCP bridge for tightly controlled repository review and structured coding-agent handoffs. It exposes one explicitly approved local repository through an authenticated loopback server.

Yes. RepoRelay is published under the MIT License in the public GitHub repository.

MCP, or Model Context Protocol, is an open protocol used for an AI client such as ChatGPT to discover and call tools exposed by a server. RepoRelay is the local MCP server and application boundary; MCP itself is not the security boundary.

Yes, but only through an explicit connection to a local MCP server and an approved repository. The file content or search results returned by an allowed tool still travel through that connection, so do not approve credentials or private material. RepoRelay's local-files guide explains the no-upload workflow and why it does not expose a whole computer.

No. RepoRelay approves exactly one existing canonical repository directory at a time and does not expose general filesystem, shell, process, Git, or arbitrary mutation tools.

No. The public review server does not register shell, PowerShell, process-launch, or local-agent execution tools.

No. Git is not an exposed RepoRelay tool. Git operations remain local operator or coding-agent actions.

ChatGPT cannot arbitrarily edit source files. When handoff writes are enabled, it can write only three predetermined handoff targets: NEXT_TASK.md, REVIEW.md, and STATE.json under .ai-handoff.

The three fixed writers are write_next_task, write_review, and update_handoff_state. They are pathless and can replace only pre-existing .ai-handoff/NEXT_TASK.md, .ai-handoff/REVIEW.md, and .ai-handoff/STATE.json. RESULT.md remains implementer-owned.

Run quickstart with --no-handoff-writes. RepoRelay then exposes exactly open_workspace, list_files, read_file, and search_files, does not initialize .ai-handoff, and does not create or modify AGENTS.md.

Sensitive-path policy is intended to block .env and other credential locations. This is defense in depth, not a complete secret scanner, so do not approve a repository containing credentials the reviewer should not receive.

The containment checks reject traversal, absolute escapes, symlink, junction, or reparse-point escapes, and hard-linked files outside the canonical root. RepoRelay is still not an operating-system sandbox against malicious same-user software.

ChatGPT Web connects through OpenAI's Secure MCP Tunnel to the local tunnel-client, which forwards to RepoRelay's authenticated loopback MCP endpoint. ChatGPT Web cannot connect directly to the local loopback URL.

It is the external connectivity layer used to reach an eligible private local MCP server from ChatGPT Web. It is separate from RepoRelay, which remains the local MCP server and security boundary.

No. Codex, Claude, and other coding agents are separate local applications. RepoRelay can provide fixed handoff files for coordination but does not launch or orchestrate an agent.

The audit validates the canonical root, loopback and authentication configuration, a temporary authenticated listener, the actual MCP tool surface, and disposable fixtures for sensitive paths, traversal, outside-root access, links, hard links, generic writes, fixed handoffs, and protected result files. It does not test ChatGPT Web or an external tunnel.

The README states that the quickstart works on Windows, macOS, and Linux. Windows 10/11 is the fully validated lifecycle and operational platform, including the PowerShell scripts and tunnel-managed runbook.

RepoRelay requires Node.js >=22.19 and <27. npm is included with Node.js.

The RepoRelay project is MIT-licensed and published as open source. OpenAI Secure MCP Tunnel availability, permissions, and any account or organization requirements are separate from RepoRelay's license.