Give ChatGPT local coding tools for repos you explicitly allow.
CodexPro is a local MCP server. It connects your ChatGPT session to your machine and repos you allow.
ChatGPT can read, search, edit, review, verify, import attachments, and write handoff plans. It stays inside those roots.
It is not a hosted SaaS product, model proxy, quota bypass, account pool, or remote shell service.
Needs:
- Node.js 20+
- A ChatGPT account that can create custom MCP plugins
- An HTTPS URL to your machine for ChatGPT web (tunnel or Tailscale Funnel)
npm install -g codexpro
cd /path/to/your/repo
codexpro setupRepoConnect masks known token formats, private keys, URL passwords, Bearer values, and long high-entropy credential literals. Ordinary code and numeric metrics pass. A write containing a secret literal reports its exact line and column; replace that literal with an environment lookup and retry.
Settings -> Security and login→ turn Developer mode on (keep CSP enforcement on).Settings -> Plugins→ Plugins tab → + beside Search plugins.- Create a plugin named
CodexPro. - Connection: Server URL → paste the URL CodexPro copied.
- Authentication: No Authentication / None (change this if the form defaults to OAuth).
CodexPro auth is the token already in that URL. Do not share the URL.
Open Plugins and click + |
Complete the New Plugin form |
|---|---|
 |
 |
Daily use from the same repo:
codexpro startIf plugin creation fails, run codexpro connection-test and check whether ChatGPT requests reach the local server.
With workspace write mode (the normal agent setup):
- read individual files or bounded batches, search, and inspect the repo
- edit with
write,edit, or guardedapply_patch - import ChatGPT attachments with
import_file - run allowlisted checks with
bash - run bounded managed verification jobs that survive session churn with
start_verification,wait_verification, andcancel_verification - review diffs with
show_changes - write plans under
.ai-bridge - export a context bundle for chats that cannot call tools
One CodexPro process can allow more than one repo:
codexpro settings set --project ~/code/web --project ~/code/api
codexpro settings show
codexpro startAsk ChatGPT to open_workspace on an allowed project. open_current_workspace returns to the launch repo.
For two ChatGPT accounts or hard isolation, run two CodexPro processes on different ports and Server URLs.
codexpro setup
codexpro start
codexpro start --root /path/to/repo
codexpro doctor
codexpro connection-test
codexpro settings
codexpro inspect
codexpro reviewUseful modes:
codexpro start --no-bash
codexpro start --tool-mode minimal
codexpro start --tool-mode full
codexpro start --mode handoff
codexpro start --mode pro
codexpro start --headlessOpt-in tool cards:
CODEXPRO_TOOL_CARDS=1 codexpro startDisable .ai-bridge handoff/context files (persistent workspace-profile switch):
codexpro settings set --ai-bridge off
codexpro settings set --ai-bridge on
codexpro settings showWhen disabled, RepoConnect neither creates nor automatically consumes .ai-bridge artifacts. Existing files are left untouched. Restart required. handoff mode requires AI Bridge to be enabled.
ChatGPT web needs HTTPS:
codexpro start --tunnel cloudflare # quick demo URL (changes)
codexpro ngrok --hostname your.ngrok-free.dev
codexpro stable --hostname codexpro.example.com --tunnel-name codexpro
codexpro tailscale --hostname your-device.your-tailnet.ts.net
codexpro start --tunnel none # local onlyKeep a stable token for stable hostnames:
mkdir -p ~/.codexpro
openssl rand -hex 32 > ~/.codexpro/http-token
chmod 600 ~/.codexpro/http-tokenPrefer Authorization: Bearer <token> when the client supports headers. The ?codexpro_token= query form is a personal compatibility fallback.
- Public tunnels require a CodexPro HTTP token (min 24 bytes)
- Writes stay hidden unless write mode is
workspace - Safe bash is the default
- Blocked paths cover
.env, keys,.git, build caches, and similar - Attachment import only accepts ChatGPT Apps SDK file objects from approved HTTPS hosts. Rejected hosts report a sanitized
hostname (initial URL / redirect N)diagnostic without URL path, query, or signature.
Read SECURITY.md before exposing a tunnel.
npm install -g codexpro@latest
codexpro --versionRestart codexpro start after updating. Saved profiles under ~/.codexpro stay in place.
npm install
npm run build
npm run smoke
npm run stress
npm run release:checkThe source checkout and the installed runtime are separate. npm run build only
updates this checkout's dist/; codexpro start runs the package reached by the
codexpro executable on PATH. Do not permanently npm link the active source
checkout into that command. After an exact candidate is accepted and committed,
deploy it with the full commit SHA:
npm run deploy:local -- <full-40-character-commit-sha>The command refuses a dirty or mismatched checkout, resolves and verifies the
ordinary executable's package root and npm global target, builds and installs the
exact package, and reads back its embedded commit identity and package contents.
It changes package code only: saved profiles and state under ~/.codexpro remain
in place, and the service is not restarted. After DEPLOYED / READY FOR RESTART,
Andrew restarts normally with codexpro start; Hestia can then confirm the live
runtime_status reports the deployed source commit and installed package root.
The runtime identity is embedded in the built package, so later changes to a
development checkout's Git HEAD cannot change an already-installed runtime's
reported identity. Builds without usable local Git metadata report source
identity as unavailable instead of inventing a commit.
Publish only from the CodexPro root:
cd /path/to/codexpro
npm run release:publishRepoConnect delegation, explicit closeout, and its shared-helper ownership limits are documented in Hestia CLI Delegation.