chatgpt-web-agent
This server is an MCP bridge that lets ChatGPT Web use local tools (files, shell, processes, patches) on the user's machine, plus optional skill discovery, Google Drive file exchange, and Feishu messaging.
Read local text files and images, with offset/limit support for large files.
Apply patches to local files using the apply_patch format.
Execute shell commands with configurable timeout, working directory, environment, background execution, and PTY support.
Manage and interact with long-running shell sessions: list, poll, view logs, send input/keys, paste, kill, etc.
Discover and read locally available OpenClaw Skills, with optional semantic search by task description.
When enabled, use Google Drive tools to list, search, stat, upload, download, export, and create folders (limited to a local exchange directory by default).
When enabled, send Feishu messages and directory-discovery queries for groups, users, members, and bots.
Includes a rescue_exec tool for short-lived diagnostics/repairs when normal exec fails or hangs (no background/PTY/auto-fallback).
Provides tools for interacting with Google Drive, including listing, searching, uploading, downloading, exporting, and managing files and folders, with file exchange restricted to a designated workspace directory.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@chatgpt-web-agentread the src directory and list all TypeScript files"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
chatgpt-web-agent
A local MCP glue layer that lets the ChatGPT web client use local tools via the OpenAI Secure MCP Tunnel.
This is a runnable reference implementation, not a polished one-click install product; its main purpose is to share a proven integration approach. Users can quickly adapt it to their local environment with the help of an Agent.
The project's own MCP interface remains stable; real tools are provided by a replaceable LocalToolBackend. The first backend directly reuses the OpenClaw Plugin SDK, without modifying OpenClaw source code or reimplementing file, shell, patch, and background process tools.
Current Status
P0 provides four OpenClaw tools:
readexecprocessapply_patch
Optional Google Drive file exchange tools:
drive_listdrive_searchdrive_statdrive_uploaddrive_downloaddrive_exportdrive_mkdir
Two read-only OpenClaw Skills tools are enabled by default:
skills_list(query?, limit?)skill_read(name)
skills_list() returns a compact name directory of currently eligible + model-visible Skills; when a natural language query is provided, it returns a small set of candidate names and descriptions via a separate QMD collection. skill_read only accepts a Skill name/key; the canonical SKILL.md path is always resolved from the live OpenClaw skills.status and does not accept a file path from the client. The MCP initialize instructions also hint to the client: only proactively discover Skills when the task clearly might depend on local tools, services, workflows, or operational norms and the current context is insufficient; do not query Skills for ordinary self-contained tasks.
By default, file and patch tools are only allowed to access the configured workspace; exec.workdir must also be within the workspace. OpenClaw's internal host/security/ask/node/elevated parameters are not exposed to the MCP client.
For a standalone Connector only authorized for a trusted ChatGPT workspace, you can set
CHATGPT_WEB_AGENT_WORKSPACE_ONLY=false. In this case, the workspace is only the fallback for relative paths and the default cwd; read/apply_patch/exec.workdir can access external absolute paths. This mode is not a security sandbox.
The
exec.workdirboundary is not a command sandbox. A client withexecpermission may still access other parts of the system in the command text; only authorize the Tunnel for a trusted ChatGPT workspace, and use OpenClaw's allowlist/approval policies as needed.
Related MCP server: mcp-local-files
Development
Requires Node.js 22.22.3 or a compatible OpenClaw Node version, and pnpm.
pnpm install
pnpm check
pnpm smokeRunning
export CHATGPT_WEB_AGENT_WORKSPACE=/path/to/workspace
# 可信独立 Connector 如需把 workspace 仅作为默认工作目录:
# export CHATGPT_WEB_AGENT_WORKSPACE_ONLY=false
pnpm build
node dist/cli.jsThe service uses MCP stdio; standard output only carries the MCP protocol.
Configuration
Copy .env.example to see available environment variables. The default tool allowlist is:
read,exec,process,apply_patchexec uses allowlist + on-miss by default. You can explicitly override:
export CHATGPT_WEB_AGENT_EXEC_SECURITY=allowlist
export CHATGPT_WEB_AGENT_EXEC_ASK=on-missFor an initial trusted local smoke test, you can temporarily use:
export CHATGPT_WEB_AGENT_EXEC_SECURITY=full
export CHATGPT_WEB_AGENT_EXEC_ASK=offArchitecture
ChatGPT Web
→ OpenAI Secure MCP Tunnel
→ chatgpt-web-agent MCP Server
→ LocalToolBackend
→ OpenClawBackend
→ SkillsBackend → OpenClaw Gateway (live status)
→ QMD MCP (optional semantic discovery)
→ NativeBackend / other backend(后续按需)The Skills backend only does capability discovery/read; QMD is only a candidate retrieval accelerator; the live OpenClaw inventory is always the source of truth for eligibility, model visibility, and canonical Skill paths.
Skills semantic discovery
It is recommended to place the semantic catalog in a separate QMD named index, rather than sharing the memory index. QMD 2.5.3's vector ANN first retrieves candidates from the entire index and then applies the collection filter; mixing a few dozen Skills with tens of thousands of memory documents would cause the small collection to be overwhelmed by candidates from the full index.
The current deployment uses:
local catalog: <workspace>/skills-catalog/
M4 mirror: ~/qmd-data/skills-chatgpt-web-agent/
QMD index: skills-chatgpt-web-agent
collection: skills-chatgpt-web-agent
MCP endpoint: http://192.168.0.96:8182/mcpRetrieval uses Qwen3-Embedding-0.6B, vector-only, rerank=false, without query expansion / HyDE. QMD hits are only candidates; they are still intersected with the live skills.status before returning. The catalog schema/inventory uses catalogHash for generation invalidation; when QMD is unavailable or the catalog is stale, it falls back to a live names-only catalog.
Google Drive
Drive is an optional data channel; it does not do background sync, disk mounting, or full disk mirroring. The implementation directly uses the Google Drive API v3; MCP only exposes small, stable file operation primitives.
By default, Drive's local upload/download/export paths can only be located in:
<CHATGPT_WEB_AGENT_WORKSPACE>/exchangeThis restriction is independent of CHATGPT_WEB_AGENT_WORKSPACE_ONLY and is intended to reduce the risk of Drive tools being misused as an arbitrary local data exfiltration channel. If necessary, deployers can adjust it via CHATGPT_WEB_AGENT_DRIVE_LOCAL_ROOT and CHATGPT_WEB_AGENT_DRIVE_LOCAL_ROOT_ONLY.
One-time OAuth configuration
Enable the Drive API in Google Cloud and create a Desktop OAuth client.
Save the downloaded OAuth JSON as:
<workspace>/.credentials/google-drive/credentials.jsonOr set
CHATGPT_WEB_AGENT_DRIVE_CREDENTIALSto point to another local private path.Run:
CHATGPT_WEB_AGENT_WORKSPACE=/path/to/workspace pnpm drive:authAfter browser authorization completes, an authorized-user token with permissions
0600will be generated. The OAuth client secret and refresh token should not be committed to Git, nor returned via MCP.When starting the service, set:
export CHATGPT_WEB_AGENT_DRIVE_ENABLED=true
The folderId / fileId in Drive tools directly use Drive API IDs. Use drive_download for ordinary binary files; use drive_export for Google Docs/Sheets/Slides to export to the specified MIME type.
Available Tools
6 toolsapply_patchapply_patchC
Apply a patch to one or more files using the apply_patch format. The input should include *** Begin Patch and *** End Patch markers.
| Name | Required | Description | Default |
|---|---|---|---|
| input | Yes | Patch content using the *** Begin Patch/End Patch format. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It states the tool applies patches and uses markers, but it does not mention side effects like file modification, potential for partially applied patches, rollback capability, or whether it creates files that don't exist. Key behavioral traits are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with the core purpose. It uses two sentences effectively, but the repeated mention of 'apply_patch format' is slightly redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool modifies files, it lacks details on safety, rollback, or how partial patches are handled. With no output schema and no annotations, the description should cover failure modes and post-conditions, which it omits.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds minor context about the format markers beyond the schema's generic 'Patch content' description. However, it does not explain the patch syntax (e.g., unified diff), allowed operations, or error handling if format is invalid.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool applies a patch to files and specifies the patch format with markers. However, it does not distinguish itself from siblings like 'exec' or 'process', which might also apply changes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like 'read' or 'exec'. The description lacks context on prerequisites, such as whether files must exist or be writable, and does not mention that 'apply_patch' is specifically for applying patch diffs versus directly editing files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execexecA
Execute shell commands with background continuation for work that starts now. Use yieldMs/background to continue later via process tool. For long-running work started now, rely on automatic completion wake when it is enabled and the command emits output or fails; otherwise use process to confirm completion. Use process whenever you need logs, status, input, or intervention. Use pty=true for TTY-required commands (terminal UIs, coding agents).
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | ||
| pty | No | Run in a pseudo-terminal (PTY) when available (TTY-required CLIs, coding agents) | |
| command | Yes | Shell command to execute | |
| timeout | No | Timeout in seconds (optional, kills process on expiry) | |
| workdir | No | Working directory. Blank/whitespace values are invalid; omit to use the default cwd. | |
| yieldMs | No | Milliseconds to wait before backgrounding (default 10000) | |
| background | No | Run in background immediately |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explains backgrounding behavior, automatic completion wake, and the necessity of using 'process' for interaction. However, it does not detail security restrictions, output handling, or timeout effects beyond what is in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences, front-loaded with the core purpose, followed by concise usage rules. Every sentence contributes unique information with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description should clarify return values. It does not mention what the initial call returns (e.g., immediate output or a handle). However, it covers the backgrounding workflow, including the role of 'process' for logs and status, making the overall completeness high despite the ambiguity about immediate response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (86%), so baseline is 3. The description adds usage context for 'yieldMs', 'background', and 'pty', but does not significantly elaborate on parameter meaning beyond what the schema already provides. It ties parameters to scenarios but does not introduce new semantic information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute shell commands' and elaborates on background continuation, distinguishing itself from sibling tools like 'process' which handles logs/status. It provides a specific verb-resource combination and explicitly differentiates usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to use alternative tool 'process' (for logs, status, input, intervention) and when to enable 'pty=true' (TTY-required commands). It also explains the 'yieldMs/background' mechanism for continuing work later, leaving no ambiguity about context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
processprocessA
Manage running exec sessions for commands already started: list, poll, log, write, send-keys, submit, paste, kill. Use poll/log when you need status, logs, quiet-success confirmation, or completion confirmation when automatic completion wake is unavailable. Use poll/log also for input-wait hints. Use write/send-keys/submit/paste/kill for input or intervention.
| Name | Required | Description | Default |
|---|---|---|---|
| eof | No | Close stdin after write | |
| hex | No | Hex bytes to send for send-keys | |
| data | No | Data to write for write | |
| keys | No | Key tokens to send for send-keys | |
| text | No | Text to paste for paste | |
| limit | No | Log length | |
| action | Yes | Process action (list|poll|log|write|send-keys|submit|paste|kill|clear|remove) | |
| offset | No | Log offset | |
| literal | No | Literal string for send-keys | |
| timeout | No | For poll: wait up to this many milliseconds before returning; max 30000 ms, higher values are clamped to 30000 | |
| bracketed | No | Wrap paste in bracketed mode | |
| sessionId | No | Session id for actions other than list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that the tool manages running sessions and that poll can wait up to 30000 ms (clamped). However, it doesn't mention that actions modify session state (e.g., writing data, killing), which is reasonably inferred. It also doesn't state that list returns session IDs needed for other actions, though the schema makes that somewhat clear. Very good but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a tight 4-sentence paragraph. The first sentence front-loads all actions and the tool's purpose. The next two sentences give precise when-to-use guidance. The last sentence covers the remaining actions. Every sentence earns its place; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 12 parameters, 100% schema coverage, and no output schema, the description fills the behavioral gap well. It explains when to use each action type. The only missing element is a brief note that some actions (e.g., kill) are destructive or irreversible, which would have pushed completeness to 5. Still strong and sufficient for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description does not add meaning beyond schema property descriptions – it simply names the action groups. The schema already describes each property's purpose (e.g., 'Hex bytes to send for send-keys'). The description adds no new parameter details or usage patterns, so it stays at baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description lists all eight supported actions (list, poll, log, write, send-keys, submit, paste, kill) and clearly states the tool manages running exec sessions. It even details specific use cases like confirming completion or getting input-wait hints. This fully distinguishes it from siblings like exec (which starts sessions) and read/apple_patch (which operate on files).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells the agent when to use poll/log for status, logs, or input-wait hints, and when to use write/send-keys/submit/paste/kill for input/intervention. It also mentions the fallback when automatic completion wake is unavailable, giving actionable guidance to select among the tool's own actions. No sibling-level exclusions are needed because the tool manages already-started sessions – distinct from siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
readreadA
Read the contents of a file. Supports text files and images (jpg, png, gif, webp, bmp). Images are sent as attachments. For text files, output is truncated to 2000 lines or 50KB (whichever is hit first). Use offset/limit for large files. When you need the full file, continue with offset until complete.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to the file to read (relative or absolute) | |
| limit | No | Maximum number of lines to read | |
| offset | No | Line number to start reading from (1-indexed) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully discloses behavioral traits: truncation to 2000 lines or 50KB, offset/limit pagination, and image handling as attachments. This goes well beyond the input schema's parameter descriptions, providing critical operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long, front-loaded with the purpose, and every sentence provides essential information. No unnecessary words or repetition, making it highly efficient for an AI agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 parameters, no output schema), the description covers purpose, supported file types, truncation limits, and pagination strategy. It does not explicitly describe the return format for text files, but the information provided is sufficient for most use cases. A minor gap for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by explaining the intended use of offset/limit for pagination ('Use offset/limit for large files') and clarifying that offset is 1-indexed, which is implicit in the schema but reinforced here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific verb 'read' and resource 'file', and lists supported file types (text and images). It distinguishes from sibling tools like 'exec' (command execution) and 'skill_read' (reading skills) by focusing on general file reading.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use the tool (for reading text and image files) and how to handle large files via offset/limit pagination ('use offset/limit for large files'). It lacks explicit exclusions (e.g., binary files other than images) but the context is sufficient for correct usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skill_readA
Read one currently eligible/model-visible OpenClaw Skill by its name or skillKey. Use after skills_list identifies a likely match. This tool does not accept filesystem paths.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It mentions 'currently eligible/model-visible' but does not specify behavior on missing skills, read-only guarantee, or potential errors. The description is minimal regarding side effects or failure conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, no redundant wording. Every clause adds value—purpose, usage timing, and a key constraint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description could clarify what is returned (e.g., skill content, metadata). It does not mention output details, but the tool's purpose is clear enough for selection. Slightly incomplete in describing the full interaction.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'name' is clarified to accept either the skill name or skillKey, and explicitly excludes filesystem paths. This adds significant meaning beyond the bare string type, compensating for the lack of schema-level description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a skill by name or skillKey, distinguishing it from sibling tools like skills_list (which lists) and read/apply_patch/exec/process (which operate on files or processes). It is specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs to use after skills_list identifies a likely match, and provides a clear constraint (does not accept filesystem paths). This fully guides when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
skills_listA
Discover local OpenClaw Skills available to ChatGPT Web. Pass a natural-language task description in query to get a small semantic top-k with descriptions. Without query, returns the compact names-only live catalog. Only currently eligible and model-visible Skills are surfaced.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum semantic candidates; defaults to 8. | |
| query | No | Natural-language task or capability to discover. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations present, so description carries full burden. It explains the tool surfaces only 'currently eligible and model-visible Skills' and describes two distinct outputs. This is adequate for a read-operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences pack purpose, dual behavior, and constraints with zero waste. Every sentence contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 optional params, no output schema, no annotations), the description covers core functionality, parameter options, and eligibility. It could mention the return format, but is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description adds value by explaining that 'query' triggers semantic top-k search with descriptions, while omitting it yields a names-only catalog. This clarifies the parameter's effect beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool discovers local OpenClaw Skills for ChatGPT Web. It distinguishes between query and no-query modes, but doesn't explicitly differentiate from sibling tool 'skill_read'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to pass a query vs. not, but does not mention alternatives or when to avoid using this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.1.0- First observed
apply_patch - First observed
exec - First observed
process - First observed
read - First observed
skill_read - First observed
skills_list
TDQS
Each tool has a distinct purpose: file reading, patch application, command execution, process management, and skills listing/reading. Descriptions clearly differentiate them.
Most tools use verb-like names with a mix of underscore and no-underscore styles (e.g., 'read' vs 'skills_list'). The convention is not fully uniform but remains understandable.
Six tools is appropriate for a coding-agent server, covering core operations without being excessive or sparse.
The suite covers file access, modifications, command execution, background process management, and skill discovery, leaving no obvious gaps for common agent workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Search your AI chat history (ChatGPT, Claude, Codex) from any MCP client. Remote, private, read-only
MCP connector that lets ChatGPT list, search, and run your Apple Shortcuts via a local Mac agent
- QuallaaOAuthcom.quallaa
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
The OpenRouter MCP server plugs OpenRouter into the AI tools you already use. Once connected, your assistant can pull live OpenRouter data (models, prices, your credits, rankings, and docs) and send quick test messages, all without leaving your editor.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceLocal MCP server bridging ChatGPT Web to local tools for file, shell, git, test, and process management with secure policy controls.MIT
- AlicenseNot gradedqualityFmaintenanceEnables ChatGPT/Codex to read, search, and edit files in a single allowed folder on Windows through OpenAI Secure MCP Tunnel.ISC
- AlicenseNot gradedqualityBmaintenanceLocal MCP bridge enabling ChatGPT web to access approved local files and execute tasks via local Codex.6MIT
- AlicenseAqualityCmaintenanceEnables ChatGPT web to interact with local Windows/WSL shell and code workspaces via an MCP server, providing file access, shell execution, and snapshot-based workspace management with per-command authorization.18MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/AxelHu/chatgpt-web-agent'
If you have feedback or need assistance with the MCP directory API, please join our Discord server