How to let ChatGPT work with files on your own Windows PC over MCP

Disclosure: I make Bridgerator, the tool used in this walkthrough. I'll try to be specific about what it does and, just as important, what it doesn't protect you from.

ChatGPT is good at reading, summarizing and rewriting text. But your files are on your PC, and ChatGPT lives in a browser tab. The usual workaround is to copy and paste, or to upload files one at a time. That gets old fast if you want help with a whole folder of notes, invoices, logs or a project directory.

The Model Context Protocol (MCP) fixes this. An MCP server exposes "tools" (read a file, search a folder, run a command) to an AI app, and the app calls them when it needs to. ChatGPT supports custom MCP servers, and so do Claude, Codex, Cursor, VS Code and others. The open question is how to expose your own Windows PC to them without opening your network.

This post walks through one way to do it, then goes through the safety model, because that is the part that matters.

After setup you can ask ChatGPT things like:

Bridgerator can read, search, create and edit files, organize folders, run PowerShell or cmd commands, manage processes, take screenshots with text recognition, and check the PC's health. It works on Windows 10 and 11.

A common worry with local MCP is "do I have to open a port on my router?" Here you don't. A small bridge program runs on your PC and makes an outbound secure WebSocket connection to a hosted MCP endpoint. ChatGPT talks to that endpoint; the endpoint forwards tool calls down the connection you already opened. No inbound ports, no public IP, no port forwarding, and no admin rights.

Other MCP apps (Claude, Codex, Cursor, VS Code) use the same server URL. Apps without OAuth support can use a personal access key. That key gives full access to your PCs, so keep it like a password.

Giving an AI access to your files is only reasonable if you can limit it. Here is what is available, with the caveats the documentation itself lists.

By default there is no folder list, which means ChatGPT may work in any folder except Bridgerator's own folders. That is permissive, and I'd change it right away. If you set a folder list, ChatGPT can only work in those folders. A few details:

My suggestion: start with one project folder, not your whole profile.

You can require approval on the PC itself for risky actions. Requests show up as native Windows notifications. If you don't answer within 2 minutes, or you close the prompt, the answer is Deny.

By default, delete and dangerous_commands are on. write_files, move, any_command, install and scheduled_scripts are off by default and can be turned on. Confirmations are configured from the command line. The assistant cannot edit confirm.ini; it can only request that confirmations be turned off, and lowering protection requires your approval on the PC.

I'd rather you read this here than find it out later:

The bridge runs as your own user, never as SYSTEM, and the executables are signed. The practical conclusion: treat the AI like a fast, well-meaning colleague who has your login. Scope the folders, turn on confirmations for anything destructive, and keep the undo window on.

Account email, password hash, device list, a monthly call counter, and an optional activity log of tool names and times kept for 30 days. Not stored: file contents, paths, search results, command text or output. The bridge also sends install/update events and a daily heartbeat with a random install ID, versions, OS language and per-tool counts. It never sends paths, file names, command text or output, and telemetry can be turned off.

Free is 10,000 tool calls per month on any number of PCs. Pro is $10 per month with unlimited calls. The counter is per account, resets on the 1st at 00:00 UTC, and chat messages are not counted. For occasional file chores the free tier goes a long way.

If the undo works as you expect, widen the scope gradually.

If you try it and something in the safety model is unclear or wrong, I'd like to hear about it: the contact is info@recondeck.com. And if you have a different approach to exposing a Windows PC to MCP apps, tell me in the comments. I'm curious what other people consider the right default.