Unlimited Agent

Unlimited Agent lets a private ChatGPT app operate the Windows PC that its owner paired: files, PowerShell, programs, screenshots, mouse and keyboard, clipboard, and Chrome.

It uses ChatGPT as the brain. It does not call a model API, consume Codex tokens, or install an OpenAI model API key. A user still needs a restricted Secure MCP Tunnel runtime credential (Tunnels: Read + Use) so the local bridge can authenticate to their own tunnel; that credential cannot perform model inference and is encrypted with Windows DPAPI.

[!WARNING] Full remote control is powerful. Install only on a computer whose owner has knowingly consented. Keep the default balanced + dangerous approval policy unless you understand the consequences of changing it.

What it can do

• Read, search, create, edit, copy, move, and delete accessible files
• Run PowerShell commands immediately or as background jobs
• Launch local programs and inspect Windows/system information
• Capture the primary or virtual desktop
• List, focus, resize, minimize, maximize, or close windows
• Send mouse clicks, scrolling, hotkeys, and text input
• Read or replace clipboard text
• Open URLs, select a Chrome profile, and control tabs/navigation
• Make HTTP requests and download files without inheriting the tunnel credential
• Reconnect automatically after Windows sign-in

The full 21-tool contract is in docs/TOOL_CONTRACT.md.

Requirements

• Windows 10 or 11, x64
• A ChatGPT account that can enable Developer mode and private apps/connectors
• Access to OpenAI Platform Secure MCP Tunnels
• Google Chrome for the Chrome-specific tools (the other tools do not require it)

Install and pair

1. Download Unlimited-Agent-Setup-v0.1.0.exe and SHA256SUMS.txt from the latest release.

2. Optionally verify the download:

   Get-FileHash .\Unlimited-Agent-Setup-v0.1.0.exe -Algorithm SHA256
   

3. Run the installer and accept the informed-consent notice. Windows SmartScreen may warn because community builds are not code-signed; verify the SHA-256 before choosing Run anyway.

4. In the setup window, select Open Secure MCP Tunnels. Create a tunnel in the OpenAI Platform tunnel settings, then copy its tunnel_... ID.

5. In OpenAI Platform API keys, create a dedicated project key restricted to Tunnels: Read + Use. Do not grant model or other API permissions. Paste it into the setup window.

6. Choose permissions. The recommended defaults are:

   • Permission mode: balanced
   • Local approval: dangerous
   • Sensitive-read approval: enabled
   • Allowed folder: your Windows user profile

7. Select Save and connect. The bridge starts in the background and is registered for the current Windows user at sign-in.

8. In ChatGPT, open Settings → Apps & Connectors → Advanced settings, enable Developer mode, create a private app, and select the tunnel you just paired. Name it Unlimited Agent.

Open the desktop shortcut Unlimited Agent Status. CONNECTED and ready means the tunnel can serve the private ChatGPT app. Ask ChatGPT: “Use Unlimited Agent to show my Windows system information.”

OpenAI currently documents Secure MCP Tunnels as a private Developer-mode testing feature. They do not support public ChatGPT app-directory submission or one shared public tunnel. Consequently, every user must create their own private tunnel and private app even though the installer and source code are public. See the official Secure MCP Tunnel guide.

Permission modes

Mode	Behavior
read_only	Only inspection tools run. Changes, input, launches, and network calls are denied.
balanced	Paths must stay inside Allowed folders. Dangerous actions follow the approval setting. PowerShell remains available only after the configured approval because a command can address arbitrary resources.
full	All paths accessible to the signed-in Windows user are in scope. Approval settings still apply.

Approval	Behavior
dangerous	A local review window appears for writes, commands, input, launches, browser/network actions, and other mutations. With the recommended sensitive-read option, it also covers screenshots, window titles, and clipboard reads.
always	Every tool call requires local approval.
never	No local prompts. Use only on a fully trusted private installation.

Open Unlimited Agent Settings on the desktop to re-pair, change the tunnel credential, or change permissions. Settings apply without reinstalling. A denied tool call returns a structured PERMISSION_DENIED result to ChatGPT. Tool calls are serialized, so Unlimited Agent cannot use its own mouse/keyboard tool to click a pending approval window.

Example requests

• “Find all .docx files modified this week in Documents and summarize their names. Don’t change anything.”
• “Create a folder on my desktop named Trip, move the selected photos into it, and verify the count.”
• “Run the test suite in C:\work\my-app; keep polling until it finishes and fix the first failure.”
• “Take a screenshot, focus Chrome, open the project dashboard, and tell me what is visible.”
• “Start Notepad, type this meeting note, save it to Documents, then confirm the file exists.”

For GUI tasks, ChatGPT should iterate screenshot → window focus → input → screenshot. Unlimited Agent cannot bypass passwords, CAPTCHAs, MFA, UAC secure desktop, or locked Windows sessions.

Architecture

flowchart LR
  A[Private ChatGPT app] --> B[OpenAI Secure MCP Tunnel]
  B -->|outbound HTTPS session| C[tunnel-client]
  C -->|stdio MCP| D[Unlimited Agent server]
  D --> E[Central policy + local approval]
  E --> F[Files / PowerShell / HTTP]
  E --> G[Windows UI / Chrome / clipboard]

• server.mjs registers the MCP tools and contains their implementations.
• policy.mjs wraps every tool registration with canonical-path permission, reparse/hardlink-resistant folder checks, complete local approval details, overrides, and audit checks.
• scripts/windows-ui.ps1 provides screen, window, input, and clipboard primitives through Windows APIs.
• scripts/start-tunnel.ps1 decrypts the per-user runtime credential just long enough to start tunnel-client. The MCP server deletes credential environment variables before handling calls, and child processes receive a sanitized environment.
• scripts/watch-tunnel.ps1 provides single-instance background recovery.
• scripts/settings.ps1 owns pairing and permission settings. Credentials use DPAPI CurrentUser; non-secret policy is JSON.
• installer/ produces one self-contained x64 Windows setup executable.

No inbound listener or firewall exception is created. The local server is stdio-only; tunnel-client provides the remote MCP endpoint selected by ChatGPT.

Local development

git clone https://github.com/yungsuk53-pixel/unlimited-agent.git
cd unlimited-agent
npm ci --ignore-scripts
npm test

npm test reaches validation level 2: schema/annotation checks, a real stdio MCP session, file operations, PowerShell credential isolation, local HTTP, screenshots, windows, input plumbing, system policy, and background jobs.

Build and fresh-install test:

npm run build:installer
npm run test:install

The build downloads pinned Node.js, tunnel-client, and ripgrep x64 releases and verifies them against immutable SHA-256 values committed in the build script. CI repeats the MCP tests, installer build, DPAPI round trip, synthetic fresh install, and installed-runtime tool tests. Test credentials are synthetic and never contact OpenAI.

To test a real tunnel, install the generated EXE, pair a dedicated tunnel credential, check Unlimited Agent Status, and connect the private app in ChatGPT Developer mode.

Data locations

Installed files and current-user data are under:

%LOCALAPPDATA%\UnlimitedAgent\
  config\config.json          non-secret policy and tunnel ID
  config\credential.dpapi     DPAPI-encrypted restricted runtime key
  data\audit.jsonl            tool decision audit (names, decisions, hashes)
  data\logs\                  tunnel and watchdog diagnostics

The project never logs the plaintext tunnel credential. Logs redact strings matching OpenAI key formats, and tool-launched processes receive a minimal allowlist of ordinary Windows environment variables instead of inheriting ambient tokens or secrets.

Troubleshooting

Status says reconnecting or unavailable

• Open Unlimited Agent Settings and re-enter the tunnel ID and a valid restricted runtime key.
• Confirm the key has Tunnels: Read + Use and belongs to the organization/workspace that owns the tunnel.
• Check %LOCALAPPDATA%\UnlimitedAgent\data\logs\bridge.log and watchdog.log.
• A 404 commonly means ChatGPT selected a different tunnel/app, the runtime is stopped, or the private app was not created from the same ChatGPT/OpenAI organization context.

A tool is denied

• The local response states whether read-only mode, an Allowed folders boundary, a per-tool override, or a rejected approval caused it.
• Open Unlimited Agent Settings to change the policy. Do not weaken permissions merely to hide a genuine safety boundary.

Mouse or keyboard actions do nothing

• Windows must be signed in and unlocked.
• UAC secure desktop, login screens, some elevated apps, games using exclusive input, and protected media cannot be reliably automated from a normal user process.

Chrome opens the wrong profile

• Ask ChatGPT to call open_url or browser_control with the Chrome profile directory name, such as Default or Profile 2.

Uninstall and revoke

Run the desktop shortcut Uninstall Unlimited Agent. It stops/removes the local runtime, deletes autostart entries, removes the encrypted credential, and deletes the installation directory.

Then revoke the dedicated restricted key in OpenAI Platform and delete the tunnel if it will no longer be used. Revocation is important if the PC or Windows account may be compromised.

Security and license

Read SECURITY.md before enabling full access. Security reports should use GitHub private vulnerability reporting, not public issues.

Unlimited Agent is available under the MIT License. Bundled runtime notices are in THIRD_PARTY_NOTICES.md.