ChatGPT Local Agent MCP
This MCP server gives ChatGPT controlled access to your Windows PC, enabling it to inspect files, run commands, apply patches, and interact with the desktop under your supervision.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
XxYouDeaDPunKxX
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
browser_cdp_connectEscape hatch for attaching to an existing Chromium-based browser/profile through Chrome DevTools Protocol. Prefer browser_session_create for isolated browsing unless you explicitly need an already logged-in profile or existing tab state.
browser_session_createPreferred browser entry point for web work. Creates an isolated local Playwright browser session; use this instead of browser_cdp_connect unless an existing logged-in profile is required.
browser_session_listList active local Playwright browser sessions.
browser_session_closeClose a local Playwright browser session and release its browser process.
browser_page_listList pages/tabs available inside a browser session.
browser_page_selectSelect the active page/tab inside a browser session by pageIndex from browser_page_list.
browser_navigateNavigate a browser session to a URL.
browser_snapshotPreferred structured read of a web page. Return an ARIA snapshot optimized for AI use; use this before element interactions and prefer it over screenshots unless pixels/layout must be inspected.
browser_clickClick an element by CSS selector or ARIA snapshot ref. Prefer ariaRef from browser_snapshot when available. On CDP existing-profile sessions, confirm=true is required.
browser_fillFill an input-like element by CSS selector or ARIA snapshot ref. Prefer ariaRef from browser_snapshot when available. On CDP existing-profile sessions, confirm=true is required.
browser_typeType text into an element by CSS selector or ARIA snapshot ref. Prefer browser_fill for replacing input values. On CDP existing-profile sessions, confirm=true is required.
browser_press_keyPress a keyboard key in the active page. Prefer browser_click/fill/type for semantic interactions when possible. On CDP existing-profile sessions, confirm=true is required.
browser_waitWait for time, selector visibility, URL match, or load state in a browser session.
browser_screenshotCapture a PNG screenshot of the current browser page. Prefer browser_snapshot for DOM/ARIA understanding; use screenshot when visual layout, pixels, or rendering must be inspected.
browser_consoleReturn recent console messages captured for a browser session.
browser_networkReturn recent network response/failure events captured for a browser session.
desktop_mouse_positionReturn current Windows desktop mouse position, screen bounds, and active window.
desktop_mouse_moveFallback tool for coordinate-level desktop UI control when browser/CDP/structured tools cannot act. Move the Windows desktop mouse cursor to absolute screen coordinates. Defaults to dryRun=true.
desktop_mouse_clickFallback tool for coordinate-level desktop UI control when browser/CDP/structured tools cannot act. Move and click the Windows desktop mouse at absolute screen coordinates. Defaults to dryRun=true.
desktop_key_pressFallback tool for active-window keyboard control when browser/CDP/structured tools cannot act. Send a SendKeys key string to the active Windows desktop application. Defaults to dryRun=true.
desktop_hotkeyFallback tool for active-window hotkeys when browser/CDP/structured tools cannot act. Send a structured hotkey to the active Windows desktop application, e.g. CTRL+L. Defaults to dryRun=true.
desktop_text_typeFallback tool for active-window text entry when browser/CDP/structured tools cannot act. Type text into the active Windows desktop application. Defaults to dryRun=true. Journal redacts text content.
statReturn metadata for a local path.
stat_manyReturn metadata for multiple local paths.
read_file_rangeRead a byte range from a local file.
read_manyRead multiple local files.
hashHash a local file.
treeReturn a bounded recursive tree of a directory.
list_dirList directory entries on the local machine. Use this to inspect filesystem state.
read_fileRead a local text file from the machine running the MCP server.
write_filePreferred tool for creating or replacing a local text file. Use this instead of shell redirection, Set-Content, Out-File, echo > file, or heredoc writes when writing a whole file. Prefer the narrowest practical cwd plus a short relative path; the tool returns warnings when cwd is broader than the ta…
mkdirPreferred tool for creating directories. Use this instead of shell mkdir, md, or New-Item -ItemType Directory when practical.
deletePreferred tool for deleting a file with dry-run, confirm, backup, and journal effects. Use this instead of shell Remove-Item, del, erase, or rm when practical. Directory deletion is intentionally not supported yet.
movePreferred tool for moving or renaming a file with dry-run, confirm, backup, and journal effects. Use this instead of shell move, mv, Rename-Item, or Move-Item when practical. Directory moves are intentionally not supported yet.
copyPreferred tool for copying a file with dry-run, confirm, backup-on-overwrite, and journal effects. Use this instead of shell copy, cp, or Copy-Item when practical. Directory copy is intentionally not supported yet.
searchPreferred tool for bounded text search under a directory. Use this instead of shell grep, rg, or Select-String when practical so secret guards and search limits apply.
apply_patchPreferred tool for targeted edits in existing files and multi-file changes represented as a unified diff. Use this instead of shell heredocs, Set-Content, or ad-hoc file rewrite commands when practical; supports dry-run, touched file detection, backups, and journal effects.
rollback_backupRestore a file from a local backup created by a destructive tool.
git_statusPreferred tool for repository status. Use this instead of shell git status when practical.
git_diffPreferred tool for repository diffs. Use this instead of shell git diff when practical.
git_commitPreferred tool for creating a git commit with dry-run and confirm semantics. Use this instead of shell git commit when practical. By default commits currently staged changes.
process_listList local operating-system processes.
port_listList local TCP/UDP ports using netstat.
wait_for_portWait until a TCP host:port becomes reachable.
tail_logPreferred tool for reading log tails or stdout/stderr from a managed process. Use this instead of shell Get-Content -Tail, tail, or polling log files when practical.
start_processPreferred tool for starting long-running local processes such as dev servers. Use this instead of shell Start-Process, npm run dev, npm start, vite, or watch commands when the process should keep running; stdout/stderr are captured to managed log files and stop_process can clean it up. Prefer the na…
stop_processStop a process started by start_process.
process_killKill a local process by PID.
window_listPreferred desktop-observation tool before coordinate fallback actions. List visible top-level desktop windows on the local Windows session. Window titles are redacted by default.
screen_screenshotVisual fallback for desktop inspection. Capture a PNG screenshot of all screens, the primary screen, or an explicit region; prefer window_list, browser_snapshot, browser_console, or browser_network when structured data is enough.
screen_ocrVisual text fallback over a screen_screenshot artifact. Prefer browser_snapshot or structured tools when available; OCR is best-effort and requires local tesseract executable.
shellEscape hatch for local command execution when no dedicated MCP tool covers the action. Use shell for tests, builds, one-shot CLI commands, and true fallback cases. Do not use it for file writes, git operations, long-running processes, log tailing, search, delete/move/copy/mkdir when dedicated tools …
workspace_infoReturn runtime information about the local MCP runner and its default workspace.
CLOUDFLARED_CONFIGC:\Users\you\.cloudflared\config.ymlCLOUDFLARED_EXECLOUDFLARE_TUNNEL_NAMEDEV_IDENTITY_LOGINGITHUB_CLIENT_IDGITHUB_CLIENT_SECRETGPT_FS_MCP_BACKUP_DIRGPT_FS_MCP_DEFAULT_CWDonly controls the starting directory for relative paths and commands. If it is empty, it falls back to the user Documents\GitHub folder. It does not limit filesystem access by itself.GPT_FS_MCP_HOSTGPT_FS_MCP_JOURNAL_PATHGPT_FS_MCP_MAX_POLICY_MODEdestructiveGPT_FS_MCP_UNTRUSTED_CONTENT_ROOTSGPT_FS_MCP_WORKSPACE_PROFILES_JSONFor a safer first workspace, define for one test folder, keep auth enabled, and guard command execution:OAUTH_CLIENT_IDOAUTH_CLIENT_SECRETPUBLIC_BASE_URLDependencies
8 dependencies, 1 flagged: playwright
Tool annotations match behaviour
4 read-only tools perform write/delete/exec — browser_screenshot (line 1505: fs.mkdir(directory, { recursive: true })); process_list (line 377: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line)); tail_log (line 218: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line))
Either remove the readOnlyHint:true annotation, or remove the write/delete call from the tool handler.
Destructive tools are labelled
2 tools perform destructive updates without destructiveHint — browser_screenshot deletes at line 1509 (fs.unlink(filePath)); screen_screenshot deletes at line 396 (fs.rm(filePath, { force: true }))
Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.
Descriptions match behaviour
2 tools describe read intent but their handlers mutate — process_list (line 377: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line)); tail_log (line 218: /^(\d+)\s+(\d+)\s+(\S+)\s*(.*)$/.exec(line))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
49/53 tool handlers declare input schemas (92%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool test coverage
Only 4/53 tools referenced in tests (8%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
5 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Tool description accuracy
process_list: description implies read-only but handler writes/deletes/executes; tail_log: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/xxyoudeadpunkxx/chatgpt-local-agent-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check