Local Drive MCP

Standalone Streamable HTTP MCP server for ChatGPT Developer Mode.

This is not a Codex plugin. Codex already has local filesystem access. This server exists so ChatGPT can call controlled local-drive tools through an MCP endpoint.

Tools

• list_roots
• stat_path
• list_directory
• read_file
• read_many_files
• write_file
• append_file
• edit_file
• create_directory
• copy_path
• move_path
• delete_path
• search_files
• hash_file

Guardrails

The server only touches paths inside configured roots unless LOCAL_DRIVE_ALLOW_ALL=1.

Current local .env defaults:

LOCAL_DRIVE_ALLOW_ALL=1
LOCAL_DRIVE_ALLOW_WRITE=0
LOCAL_DRIVE_ALLOW_DELETE=0
LOCAL_DRIVE_AUTH_MODE=none

Deletes require both:

LOCAL_DRIVE_ALLOW_DELETE=1
confirm=DELETE

The server refuses to delete a mounted drive root or a configured allowed root.

Install

cd "path\to\local-drive-mcp"
npm install

Run Locally

cd "path\to\local-drive-mcp"
npm start

Local endpoint:

http://127.0.0.1:7331/mcp

Health check:

http://127.0.0.1:7331/health

Test

npm run check
npm run smoke

Connect From ChatGPT Developer Mode

ChatGPT requires a public HTTPS MCP endpoint.

For development, tunnel this local server:

ngrok http 7331

Then use the HTTPS /mcp URL in ChatGPT:

https://<your-ngrok-host>/mcp

In ChatGPT:

1. Open Settings -> Apps & Connectors -> Advanced settings.
2. Confirm Developer Mode is on.
3. Go to Settings -> Connectors -> Create.
4. Use a name like Local Drive MCP.
5. Use the tunnel URL ending in /mcp.
6. Create, inspect the tool list, and test with List my allowed local drive roots.

Authentication

For a private development tunnel, LOCAL_DRIVE_AUTH_MODE=none allows ChatGPT to connect without a custom auth flow. In that mode this server does not advertise write or delete tools because .env sets LOCAL_DRIVE_ALLOW_WRITE=0.

For static reverse-proxy or bearer-token testing, set:

LOCAL_DRIVE_AUTH_MODE=bearer
LOCAL_DRIVE_MCP_TOKEN=<long-random-token>

Requests then require:

Authorization: Bearer <long-random-token>

ChatGPT production use should move to OAuth or a locked-down reverse proxy.

For OAuth 2.1 resource-server mode, set:

LOCAL_DRIVE_AUTH_MODE=oauth
LOCAL_DRIVE_MCP_PUBLIC_BASE_URL=https://your-public-host
LOCAL_DRIVE_OAUTH_AUTHORIZATION_SERVER=https://auth.example.com
LOCAL_DRIVE_OAUTH_ISSUER=https://auth.example.com
LOCAL_DRIVE_OAUTH_AUDIENCE=https://your-public-host
LOCAL_DRIVE_OAUTH_JWKS_URL=https://auth.example.com/.well-known/jwks.json
LOCAL_DRIVE_ALLOW_WRITE=1

The server publishes:

/.well-known/oauth-protected-resource

and returns a WWW-Authenticate challenge when protected requests lack a valid bearer token.