Inspection tools
- open_workspace
- list_files
- read_file
- search_files
These tools read or search eligible content inside the opened repository. Reads and searches are bounded.
Read the source of truth
A narrow application boundary, with explicit limits.
RepoRelay is an authenticated, loopback-only MCP bridge for one explicitly approved repository. Its controls limit the tools and paths exposed to the reviewer; they do not turn the process into an operating-system sandbox.
Last updated:
Answer first
Does RepoRelay give ChatGPT shell access?
No. RepoRelay's public review server does not register shell, PowerShell, Git, process-launch, arbitrary source-file edit, patch, delete, or local-agent execution tools.
What does it protect?
It enforces an authenticated loopback bridge, one canonical approved root, containment checks, sensitive-path defenses, bounded operations, and fixed handoff destinations when those writers are enabled. These are application controls, not an operating-system sandbox.
Tool surface
The default is small enough to inspect.
The normal CLI quickstart exposes seven tools. The general server profile and optional inspection-only quickstart expose only the four read/search tools.
Fixed handoff writers
- write_next_task
- write_review
- update_handoff_state
When enabled, they can replace only pre-existing .ai-handoff/NEXT_TASK.md, .ai-handoff/REVIEW.md, and .ai-handoff/STATE.json. RESULT.md remains implementer-owned.
Enforced protections
The boundary has several independent checks.
| Control | What RepoRelay documents and enforces |
|---|---|
| Listener | REPORELAY_HOST must be 127.0.0.1. The review bridge is loopback-only. |
| Approved root | REPORELAY_ALLOWED_ROOTS must name exactly one existing canonical directory. Drive roots, the user home, and its ancestors are rejected. |
| Host and request authentication | Host allowlists are explicit and wildcard-free. The required X-RepoRelay-Bridge-Secret header rejects missing, incorrect, and duplicate values before request-body parsing. Secret comparison uses fixed-length SHA-256 digests with constant-time comparison. |
| Containment | Traversal, absolute escapes, symlink/junction/reparse-point escapes, and hard-linked files are rejected. Open-file identity is rechecked around reads and fixed-target writes. |
| Sensitive paths | Credential and private-key paths, .env, VCS metadata, and other sensitive locations are blocked as defense in depth. Do not approve a repository containing credentials the reviewer should not receive. |
| Bounds | Reads, searches, results, and handoff documents have bounded sizes. The server does not offer caller-selected arbitrary write destinations. |
| Absent capabilities | No shell, PowerShell, Git, process launch, arbitrary file creation or edits, patches, deletes, artifacts, worktrees, local-agent execution, skills, subagents, OAuth, database persistence, or UI workspace-management tools are part of the public review server. |
Executable verification
reporelay audit checks the live local surface.
It is a verification command, not a status badge.
PS> reporelay audit "C:\Projects\my-app" PS> reporelay audit "C:\Projects\my-app" --json RESULT: PASS
The audit validates the canonical root, loopback/authentication configuration, starts a temporary authenticated loopback listener, checks missing and incorrect credentials, discovers the actual MCP tools, and rejects unexpected or dangerous capabilities. It also exercises disposable fixtures for sensitive paths, traversal, outside-root access, links, hard links, generic writes, fixed handoffs, and protected result files.
The audit does not inspect or operate ChatGPT Web, an external tunnel, or a public deployment. It does not modify the approved repository.
Inspection-only mode
Use reporelay quickstart "..." --no-handoff-writes when you want exactly four tools, no .ai-handoff initialization, and no creation or modification of AGENTS.md. Run the audit with the same flag.
Least privilege is a choice
Choose the smaller surface when handoff is not needed.
The normal quickstart is seven tools because the handoff workflow is part of RepoRelay's documented use case. It is still optional.
Limitations
What these controls do not promise.
Not an OS sandbox
RepoRelay does not sandbox malicious software already running as the same local user. Same-user races are narrowed by canonical and handle identity checks but cannot be eliminated.
Not a complete secret scanner
The sensitive-path list is defense in depth, not a guarantee that every secret in every repository will be found. Review what you approve.
The tunnel is separate
An external HTTPS tunnel is another security boundary. It must be authenticated, loopback-restricted, and monitored independently of RepoRelay.
Public documentation is not a release attestation
Read the current source, tests, and security policy for the version you run. Do not infer live ChatGPT or tunnel acceptance from this static site.
Operator rule: Never place bridge secrets, tunnel keys, personal paths, or runtime logs in source, examples, issues, or handoff files. Do not connect a repository containing credentials the reviewer should not receive.