RepoRelay
About
Secure MCP access to local repositories from ChatgptWeb without shell, Git, or arbitrary writes.
Details
- Author
- lukie-81
- Categories
- Productivity, Other, Developer Tools, Security
Jump to
Setup
Install RepoRelay in your MCP client (Claude Desktop, Cursor, Windsurf, and others).
Repository: https://github.com/lukie-81/RepoRelay
Follow the installation instructions in the repository README, then restart your MCP client.
7. Scan and verify the 7 RepoRelay tools
In the ChatGPT app flow, runScan Toolsand confirm RepoRelay exposes exactly these seven tools:
open_workspace list_files read_file search_files write_next_task write_review update_handoff_state
That is the expected normal surface. If Scan Tools shows shell, Git, process execution, generic file editing, delete, patching, or any other unexpected capability,stop and investigatebefore using the app — runreporelay audit "C:\Projects\my-app" --jsonand confirm the tool list.
Start a new chat, select the RepoRelay app, and try:
Open the approved repository and list its top-level files.
You now have ChatGPT reviewing your repository through a verified security boundary. Useful prompts:
Read README.md and explain how this project starts.
Search the repository for "authentication".
Review src/server.ts for error-handling issues and write your findings.
The normal RepoRelay setup lets ChatGPT plan and review while a separate local coding agent (Codex, Claude, or another) does the implementation. RepoRelay coordinates them through a small.ai-handoffworkspace:
.ai-handoff/ ├── NEXT_TASK.md ChatGPT writes the task here ├── RESULT.md the local coding agent writes its result here ├── REVIEW.md ChatGPT writes its review here └── STATE.json coordinates the cycle
ChatGPT ↓ writes NEXT_TASK.md Codex / local coding agent ↓ implements ↓ writes RESULT.md ChatGPT ↓ reviews result ↓ writes REVIEW.md
STATE.jsoncoordinates the cycle. RepoRelay itselfdoes not run Codex or Claude— they are separate local applications you start yourself. The handoff files are just a structured place to hand work back and forth.
ChatGPT can only writeNEXT_TASK.md,REVIEW.md, andSTATE.json. The implementer-ownedRESULT.mdis never writable by ChatGPT.
See](https://help.openai.com/en/articles/12584461-developer-mode-and-mcp-apps-in-chatgpt)docs/handoff-cycle.mdfor the detailed protocol andexamples/for reviewer and implementer prompts.
After the one-time setup, do not recreate the tunnel or the ChatGPT app. Each day:
reporelay quickstart "C:\Projects\my-app"
Open ChatGPT, start a new chat, and select the existing RepoRelay app.
Keep both windows open while you use the app. If the connection stops working, runreporelay tunnel doctoragain.
RepoRelay exposes one repository at a time.
reporelay quickstart "C:\Projects\another-repo"
Keeptunnel-clientrunning. It reconnects to the restarted RepoRelay automatically (same port and protected bridge-secret file). If you used a different port, the managed tunnel follows it automatically.
Start a new ChatGPT conversation and select the RepoRelay app.
Do not rescan tools just because the approved repository changed. Rescan only if the tool definitions changed or ChatGPT asks you to.
For anything else, runreporelay doctor. It prints configuration and security status without printing secret values.
The normal RepoRelay experience is the7-tool handoff surfaceabove, and it is the recommended beginner setup. If you specifically want ChatGPT toinspect only— no handoff files, no writes at all — start with:
reporelay quickstart "C:\Projects\my-app" --no-handoff-writes
In this optional mode RepoRelay exposes exactly four tools:
open_workspace list_files read_file search_files
Read-only mode doesnotcreate.ai-handoff, doesnotcreate or modifyAGENTS.md, and leaves the approved repository unchanged. All containment, authentication, and security checks still apply. Use the matching audit flag:
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
