如何透過 MCP 和 Bridgerator 讓 ChatGPT 處理 Windows 電腦上的檔案

Disclosure: I make Bridgerator, the tool used in this walkthrough. I'll try to be specific about what it does and, just as important, what it doesn't protect you from.

ChatGPT is good at reading, summarizing and rewriting text. But your files are on your PC, and ChatGPT lives in a browser tab. The usual workaround is to copy and paste, or to upload files one at a time. That gets old fast if you want help with a whole folder of notes, invoices, logs or a project directory.

The Model Context Protocol (MCP) fixes this. An MCP server exposes "tools" (read a file, search a folder, run a command) to an AI app, and the app calls them when it needs to. ChatGPT supports custom MCP servers, and so do Claude, Codex, Cursor, VS Code and others. The open question is how to expose your own Windows PC to them without opening your network.

This post walks through one way to do it, then goes through the safety model, because that is the part that matters.

What you end up with

After setup you can ask ChatGPT things like:

• "Find all PDFs in my Documents\Invoices folder that mention 'March' and list them."
• "Rename the files in this folder to YYYY-MM-DD - title based on their contents."
• "Read these three config files and tell me what differs."
• "Create a summary.md from the notes in this folder."

Bridgerator can read, search, create and edit files, organize folders, run PowerShell or cmd commands, manage processes, take screenshots with text recognition, and check the PC's health. It works on Windows 10 and 11.

How the connection works

A common worry with local MCP is "do I have to open a port on my router?" Here you don't. A small bridge program runs on your PC and makes an outbound secure WebSocket connection to a hosted MCP endpoint. ChatGPT talks to that endpoint; the endpoint forwards tool calls down the connection you already opened. No inbound ports, no public IP, no port forwarding, and no admin rights.

Two things worth being precise about:

• Traffic uses TLS, but the server has to decrypt requests in order to forward them. So this is not end-to-end encrypted. The security page states that file contents, paths, search results, command text and output pass through server memory and are not stored.
• Each PC gets its own device key when you confirm it in the browser. The key stays in your Windows profile and the server keeps only a one-way hash.

Setup walkthrough (ChatGPT)

1. Create an account at bridgerator.recondeck.com (Google or e-mail).
2. Install the bridge on your PC. Use the download on the website, or, if you have Node.js, run npm i -g bridgerator. No admin rights needed.
3. Confirm the computer. A browser tab opens asking you to approve this PC. That is when the device key is issued.
4. Add the server in ChatGPT. Go to chatgpt.com/plugins and add a custom MCP server with the URL https://mcp.bridgerator.recondeck.com/mcp, using OAuth sign-in. ChatGPT gets access only after OAuth 2.1 sign-in with PKCE, and it sees only your devices.
5. Try something harmless first. For example: "List the files in my Downloads folder."

Other MCP apps (Claude, Codex, Cursor, VS Code) use the same server URL. Apps without OAuth support can use a personal access key. That key gives full access to your PCs, so keep it like a password.

The safety model

Giving an AI access to your files is only reasonable if you can limit it. Here is what is available, with the caveats the documentation itself lists.

Allowed folders

By default there is no folder list, which means ChatGPT may work in any folder except Bridgerator's own folders. That is permissive, and I'd change it right away. If you set a folder list, ChatGPT can only work in those folders. A few details:

• Network and UNC paths are always refused.
• Paths are resolved through symlinks and junctions before checking.
• Excluded paths are removed from search results and listings.
• An optional "Protect sensitive folders" setting (off by default) also excludes things like AppData, Startup, PowerShell profiles, and key and config folders.
• readOnlyDirectories blocks writes in the folders you choose.
• The OneDrive root is open by default, and searching it can download online-only files. Worth knowing before you point ChatGPT at it.

My suggestion: start with one project folder, not your whole profile.

Confirmations

You can require approval on the PC itself for risky actions. Requests show up as native Windows notifications. If you don't answer within 2 minutes, or you close the prompt, the answer is Deny.

By default, delete and dangerous_commands are on. write_files, move, any_command, install and scheduled_scripts are off by default and can be turned on. Confirmations are configured from the command line. The assistant cannot edit confirm.ini; it can only request that confirmations be turned off, and lowering protection requires your approval on the PC.

Undo and the Recycle Bin

• Simple delete commands go to the Recycle Bin by default (scripts and other programs are not caught by this).
• Undo snapshots are on by default: a copy of files is kept before ChatGPT changes them, for 7 days or up to 500 MB, and files over 50 MB get no copy. "Undo AI changes" restores them.
• Pausing on mass deletes or moves exists, but it is off by default (limit is 20 per minute).

What it does not protect you from

I'd rather you read this here than find it out later:

• The terminal is not a folder sandbox. Commands run with your Windows user's rights. The bridge refuses commands that name excluded folders, but that is a courtesy, not a boundary. blockedCommands is a safety net that can be bypassed.
• Code already running on your PC could click the confirmation buttons, and command patterns can be evaded.
• "Allow 10 min" in a confirmation skips checks for 10 minutes.
• The default access preset is Full. Tighten it.
• Results go to ChatGPT, where OpenAI's policies apply. Don't expose anything you wouldn't be comfortable sending there.
• Packages are published from the author's PC without npm provenance. If that matters to you, the security page publishes SHA-256 hashes and describes how to compare the package against the git tag (an empty git diff against v1.1.15 means they match).

The bridge runs as your own user, never as SYSTEM, and the executables are signed. The practical conclusion: treat the AI like a fast, well-meaning colleague who has your login. Scope the folders, turn on confirmations for anything destructive, and keep the undo window on.

What's stored on the server

Account email, password hash, device list, a monthly call counter, and an optional activity log of tool names and times kept for 30 days. Not stored: file contents, paths, search results, command text or output. The bridge also sends install/update events and a daily heartbeat with a random install ID, versions, OS language and per-tool counts. It never sends paths, file names, command text or output, and telemetry can be turned off.

Pricing

Free is 10,000 tool calls per month on any number of PCs. Pro is $10 per month with unlimited calls. The counter is per account, resets on the 1st at 00:00 UTC, and chat messages are not counted. For occasional file chores the free tier goes a long way.

A sensible first session

1. Set a folder list with one test folder.
2. Turn on confirmations for write_files as well, at least for the first week.
3. Ask ChatGPT to organize or rename a few copies of files.
4. Check the result, then try "Undo AI changes".

If the undo works as you expect, widen the scope gradually.

If you try it and something in the safety model is unclear or wrong, I'd like to hear about it: the contact is info@recondeck.com. And if you have a different approach to exposing a Windows PC to MCP apps, tell me in the comments. I'm curious what other people consider the right default.