ChatGPT Local Agent MCP

Item: ChatGPT Local Agent MCP
Rating: 47
Author: M8ven

This MCP server gives ChatGPT controlled access to your Windows PC, enabling it to inspect files, run commands, apply patches, and interact with the desktop under your supervision.

→ XxYouDeaDPunKxX/chatgpt-local-agent-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

4 read-only tools perform write/delete/exec — browser_screenshot (line 1505: fs.mkdir(directory, { recursive: true })); process_list (line 377: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line)); tail_log (line 218: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line))

⚠️

Tool descriptions don’t match what handlers do

2 tools describe read intent but their handlers mutate — process_list (line 377: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line)); tail_log (line 218: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: GITHUB_CLIENT_SECRET, OAUTH_CLIENT_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCLOUDFLARED_CONFIG— C:\Users\you\.cloudflared\config.yml

configCLOUDFLARED_EXE

configCLOUDFLARE_TUNNEL_NAME

configDEV_IDENTITY_LOGIN

configGITHUB_CLIENT_ID

🔐 secretGITHUB_CLIENT_SECRET

configGPT_FS_MCP_BACKUP_DIR

configGPT_FS_MCP_DEFAULT_CWD— only controls the starting directory for relative paths and commands. If it is empty, it falls back to the user Documents\GitHub folder. It does not limit filesystem access by itself.

configGPT_FS_MCP_HOST

configGPT_FS_MCP_JOURNAL_PATH

configGPT_FS_MCP_MAX_POLICY_MODE— destructive

configGPT_FS_MCP_UNTRUSTED_CONTENT_ROOTS

configGPT_FS_MCP_WORKSPACE_PROFILES_JSON— For a safer first workspace, define for one test folder, keep auth enabled, and guard command execution:

configOAUTH_CLIENT_ID

🔐 secretOAUTH_CLIENT_SECRET

configPUBLIC_BASE_URL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/xxyoudeadpunkxx-chatgpt-local-agent-mcp-ulxvdl)](https://m8ven.ai/mcp/xxyoudeadpunkxx-chatgpt-local-agent-mcp-ulxvdl)

commit: 216e78440e18558202a7c894b3eaf6f7b6c28e0f

code hash: bcd56de0cff09398cd024ebd32dcedfe4d4a8d906edf063fcd0e56f0b4f1d811

verified: 6/25/2026, 9:49:13 AM

view raw JSON →