Localant

LocalAnt

English · 日本語

> Use ChatGPT as the brain. Use your local computer as the hands.

LocalAnt lets you use ChatGPT as the brain and your local computer as the hands.

Demo

ChatGPT drives a real task on the local machine through LocalAnt. ▶ Full-quality MP4

Before (Task Start) After (PR Created & Validated)

It exposes safe, permissioned local skills to ChatGPT through MCP: run approved commands, inspect projects, manage files, call coding agents like Claude Code or Codex, control browser/ADB, publish articles, and create your own local skills — all behind a default-deny security model with local approval and full audit logging.

ChatGPT
  ↓ Apps SDK / MCP Connector (Streamable HTTP /mcp)
LocalAnt  ── Gateway · Risk engine · Approval queue · Audit log · Dashboard
  ↓ Local PC
  ├─ Shell · Filesystem · Git (deny-list by default · allow-list in strict mode)
  ├─ Claude Code / Codex (plan → approve → execute → validate → diff)
  ├─ Browser (Playwright, isolated profile) · Android (ADB) · Computer Use (macOS desktop)
  ├─ Articles (Zenn / Qiita / note, via skill) · Custom Skills
  └─ Adapters: any downstream MCP server (Desktop Commander, etc.)

---

What is LocalAnt?

A local-first MCP Gateway for ChatGPT. ChatGPT is the conversational UI and decision-maker; your PC is the execution environment. The gateway publishes a catalog of 200+ permissioned tools over the Model Context Protocol, which ChatGPT's Developer-Mode connectors can call.

The design is inspired by OpenClaw (local gateway + skills + registry), Desktop Commander (local PC control + audit + hardening), supergateway (stdio→Streamable-HTTP /mcp), and mcp-proxy (bundling MCP servers) — but the brain is ChatGPT, and every capability is wrapped in permissions, approval, and audit.

Why ChatGPT as brain, local PC as hands?

• ChatGPT is great at reasoning, planning, and conversation.
• Your PC is where your code, files, devices, and tools actually live.
• Handing ChatGPT a raw shell is dangerous. Instead, this gateway gives it a

curated, permissioned surface with local approval for anything risky.

Features

• 🔒 Layered security: deny-list by default (sensitive-path blocklist +

always-blocked commands), optional strict allow-list mode, path & symlink traversal prevention, secret vault + redaction.

• ✅ Local approval queue: risk-2+ tools require explicit approval in the

dashboard or CLI — ChatGPT's confirmation is never trusted alone.

• 🧾 Full audit log: every tool call recorded (with secrets redacted).
• 🧩 Skill system: create, validate, enable, run, install-from-git,

publish, and generate skills from ChatGPT (always saved disabled).

• 🤖 Autopilot: one high-level autopilot tool delegates natural-language

tasks (plan / execute / review / fix / pr) to a local automation backend you pick in the dashboard — Claude Code / Codex / opencode / OpenClaw / Antigravity / Hermes — with an ordered fallback chain. ChatGPT never names a backend.

• 🩺 Diagnostics: localant_doctor — a read-only, structured health report.
• 🧭 ChatGPT UI widgets: localant_ui opens a LocalAnt Home panel inside ChatGPT; focused panels render approvals, git, shell processes, browser state, MCP servers, skills, and images. See [docs/chatgpt-ui.md](docs/chatgpt-ui.md).
• 🖥️ Local dashboard: status, approvals, audit, skills, secrets, Autopilot.
• 🌐 3-minute setup with Tailscale Funnel by default, plus Cloudflare Tunnel / ngrok fallbacks and clipboard copy.
• 🖱️ Computer Use: screenshot + mouse + keyboard control of the macOS

desktop (screencapture + cliclick). Screenshots come back as inline MCP images whose pixels map 1:1 to click coordinates; all input actions are risk 3 and audited. See [docs/computer-use.md](docs/computer-use.md).

• 🔌 Adapters for arbitrary downstream MCP servers (e.g. Desktop Commander).

ChatGPT as a local coding agent

LocalAnt is also a ChatGPT-native local coding-agent runtime. ChatGPT can read, search, edit, run, test, and diff a project on your machine through MCP — behind the same approval / audit / security pipeline as everything else.

It exposes the standard Codex / Claude Code / OpenCode-style tool names:

| Category | Tools | |----------|-------| | Read / search | read · read_file_range · grep · glob · list_files · get_file_info | | Edit | write · edit · multi_edit · apply_patch · move_file · copy_file · create_directory · delete_file | | Run | bash · shell_run_background · shell_get_output · shell_stop · command_exists | | Git | git_status · git_diff · git_add · git_commit · git_restore · git_stash · git_reset · git_apply_patch · git_is_dirty | | Validate | project_run_tests · project_run_lint · project_run_typecheck · project_run_build · project_run_validation · project_get_package_scripts | | Code intel | lsp_status · lsp_diagnostics · lsp_document_symbols · lsp_go_to_definition · lsp_find_references · lsp_hover · lsp_rename_symbol | | Approve | approval_request (the human approves in the dashboard / CLI) | | Delegate | autopilot (high-level; selects an internal provider from the dashboard's Autopilot tab — ChatGPT never names a backend) |

> No web search / web fetch / todo / "ask the user" tools — ChatGPT already > does web search, browsing, planning, and asking you directly, so tool-ifying > those would only bloat the surface. LocalAnt exposes only what it uniquely > provides: your local files, shell, git, toolchain, language server, browser, > device, and agents.

bash runs through a real shell (pipelines and && work) but every command is screened by CommandGuard (blocked tokens, rm -rf, …), the cwd is validated by PathGuard, and the call is gated by the security mode (approval in strict, audited-but-ungated in open, ungated in yolo — with CORE_BLOCKED_COMMAND_TOKENS rejected even in yolo).

Tool profiles keep the advertised surface sharp:

• minimal — the small delegation core (shell / agent / skill + read-only fs).
• coding — the full coding surface above (recommended for ChatGPT-as-coder).
• full — every tool (browser, adb, skill authoring, destructive git, secrets).

localant tools profile coding   # switch profile
localant tools list             # see what's exposed

Optional product surfaces such as LocalAnt Video Studio and the generated-image Asset bridge are disabled for ChatGPT by default. Enable them from Dashboard → Settings → Optional ChatGPT tools when you want those tools advertised over MCP.

Every tool's risk level (0–4) and how each family is gated is documented in [docs/tools.md](docs/tools.md).

Then just ask ChatGPT:

> "Look at this repo, fix the bug, run pnpm validate, and show me the git diff."

ChatGPT will check project/git state, grep/glob for the code, edit/apply_patch the fix, bash the validation, iterate on errors, and return git_diff.

3-minute setup

npx -y localant setup

or:

npm install -g localant
localant setup

setup checks your environment, initializes config, generates an auth token, enables built-in skills, starts the gateway + dashboard, opens a public tunnel, copies the MCP URL to your clipboard, and prints the ChatGPT connection steps.

✅ LocalAnt is running

  Local Gateway:  http://127.0.0.1:8787
  Dashboard:      http://127.0.0.1:8788
  MCP Endpoint:   https://your-machine.your-tailnet.ts.net/mcp?key=********

Connect ChatGPT:
  1. Open ChatGPT → Settings → Apps & Connectors
  2. Advanced settings → Developer Mode ON
  3. Connectors → Create
  4. Paste the MCP URL above
  5. Set Authentication to "None"
  6. Name it: LocalAnt

> From source (this repo): pnpm install && pnpm build && node packages/cli/dist/bin.js setup

ChatGPT setup

1. ChatGPT → Settings → Apps & Connectors
2. Advanced settings → Developer Mode ON
3. Connectors → Create
4. Paste the MCP URL (https://…/mcp?key=)
5. Set Authentication to None
6. Name it LocalAnt
7. Ask ChatGPT: "Run health check on my local app"

The token is embedded in the URL so the connector authenticates even where custom headers aren't available. You can also send Authorization: Bearer . See [docs/chatgpt-setup.md](docs/chatgpt-setup.md).

> Tip — Tailscale Funnel is the default tunnel. Configure your stable > Funnel FQDN (machine.tailnet.ts.net) in the dashboard Settings tab or > with localant config set tunnel.domain . The auth token is > persistent, so a stable URL means you connect ChatGPT once. Cloudflared, > ngrok, localtunnel and serveo remain available as fallback providers. > Full instructions: [docs/chatgpt-setup.md → Keep a fixed URL](docs/chatgpt-setup.md#keep-a-fixed-url-dont-recreate-the-connector-every-time).

Security model

LocalAnt has three security modes (set security.mode in config or the dashboard Settings tab):

| Mode | Filesystem / shell | Approval gates | For | |------|--------------------|----------------|-----| | open (default) | deny-list — everything allowed except the sensitive blocklist + core blocked tokens | only risk-4 (destructive/publish) | personal single-user machines | | strict | allow-list — only allowed directories & commands | per risk level (see below) | shared / multi-user environments | | yolo | deny-list (same as open) | none at all | trusted automation only |

The default is open: a deny-list model for personal use. There is no directory or command allow-list to maintain — ChatGPT can read/write anywhere and run any command except the always-blocked items below.

Strict-mode approval matrix:

| Risk | Meaning | Approval (strict) | Approval (open) | |------|---------|-------------------|-----------------| | 0 | read-only | none | none | | 1 | safe write draft | config (default none) | none | | 2 | file modification | required | none | | 3 | shell / agent / network write | required | none | | 4 | destructive / publish / deploy | double approval | double approval |

Always enforced, in every mode (including open and yolo):

• Sensitive paths (~/.ssh, ~/.aws, ~/.gnupg, /etc, Keychains, …) are

never readable or writable; symlink escapes are caught.

• Core blocked commands — sudo, su, dd, mkfs, fdisk, diskutil,

shutdown, reboot — and rm -rf / chmod 777 are always rejected and cannot be removed from the blocklist.

• Secrets live in an encrypted local vault and are redacted from tool

output and the audit log.

• Generated/installed skills are disabled by default until you review them.

Full details: [SECURITY.md](SECURITY.md).

Dashboard

A local-only dashboard (http://127.0.0.1:8788) is a full control panel — every setting that's available on the CLI is editable from the web, and vice versa. A live status badge and a pending-approvals counter update automatically.

Tabs: Home · Tools · Security · Approvals · Audit · Secrets · Agents · Settings.

• Home — status, MCP endpoint (copy), tunnel start/stop/restart, **Test

connection** (fetches the public URL to confirm ChatGPT can reach you), health check.

• Tools — browse every exposed tool, with Skills (create, enable/disable,

inspect permissions, uninstall) and MCP (add/test/remove downstream stdio servers) sub-tabs.

• Security — read-only view of the active mode, allowed directories/commands

(strict mode only), always-blocked command tokens, and the risk policy.

• Approvals — live pending-approval queue (approve/deny, per-session option).
• Audit — full-text search and click-through to the full input/output of any

entry.

• Secrets — add/remove with reveal toggle (names only).
• Agents — enable/disable (e.g. Codex), launch plan/execute tasks against

a working directory and live-tail their logs.

• Settings — security mode (open/strict/yolo), risk policy, tool profile,

auth token reveal/rotate (rotation takes effect with no restart), tunnel provider + fixed-URL config with Save & restart, gateway/dashboard ports, allowed directories/commands, blocked tokens (core tokens shown but locked), and a raw JSON editor with validation.

Skills

Skills are the unit of extension. Layout:

skills//
  skill.json     # manifest: permissions + risk + tool schemas
  README.md  LICENSE  CHANGELOG.md
  src/index.ts   # defineSkill({...})
  tests/index.test.ts
  examples/

Manage them with skill_list/info/enable/disable/run/validate/... tools or the CLI (localant skills ...). See [docs/skills.md](docs/skills.md).

How to create a skill

import { defineSkill, z } from "@localant/skill-sdk";

export default defineSkill({
  name: "hello-world",
  tools: {
    hello: {
      description: "Say hello",
      riskLevel: 0,
      inputSchema: z.object({ name: z.string() }),
      handler: async ({ name }) => ({ content: `Hello ${name}` }),
    },
  },
});

How to generate a skill from ChatGPT

> "Create a skill named qiita-private-post that posts private Qiita articles > using a QIITA_TOKEN secret."

ChatGPT calls skill_generate_from_prompt. The gateway scaffolds the manifest, README, source and tests, infers permissions, sets it disabled, and runs validation. You review permissions in the dashboard, then skill_enable (which requires approval). See [docs/skills.md](docs/skills.md).

How to delegate with Autopilot

Pick your automation backend in the dashboard → Autopilot tab (primary + enabled providers + ordered fallback chain + fallback policy). The page shows the resolved chain with live availability and lets you run a read-only test to confirm the configured agent answers. Then ChatGPT delegates with one tool, in plain language — it never names a backend:

autopilot(task:"Plan SEO improvements",      cwd:"/Users/me/Documents/my-app", mode:"plan")
# review the plan, approve, then:
autopilot(task:"Implement the SEO plan",     cwd:"/Users/me/Documents/my-app", mode:"execute")
# or: mode:"review" (read-only), mode:"fix" (diagnose + repair + validate), mode:"pr"

Execution is risk-3 (approval required), runs on a fresh branch, and falls back through the chain on failure per your fallback policy. Push / PR / publish stay behind explicit approval. The low-level bash/git/file/browser/adb tools remain available. See [docs/coding-agents.md](docs/coding-agents.md).

Codex example

Same flow with agent:"codex" once codingAgents.codex.enabled = true and the codex CLI is on PATH.

Article publishing

Article publishing is provided by the bundled article-publisher skill (disabled by default — enable it with skill_enable / localant skills enable article-publisher first):

• Zenn: GitHub-repo method — writes articles/.md with

published:false, can open a PR branch. (zenn_*)

• Qiita: official API with QIITA_TOKEN from the vault; private-first.

(qiita_*)

• note: local drafts only (note has no official public write API).

(note_*)

Publish actions are risk 4 (double approval). See [docs/articles.md](docs/articles.md).

Asset bridge (images → repo)

One tool, asset_save_image, lands an image produced or referenced in a ChatGPT conversation as a real file on disk. source.kind selects how the bytes arrive:

• base64 — inline data (best for small generated icons/diagrams; base64 is

kept out of the audit log).

• url — fetch a public http(s) image, SSRF-guarded (no

localhost/private/metadata hosts; redirects re-validated and capped).

• latest_download — adopt the newest image from your Downloads folder.

All routes share one validation path (magic-byte sniff → MIME allowlist → SVG-safety scan → sha256 → at

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: yuga-hashimoto
• Source: yuga-hashimoto/localant
• License: MIT

Install and usage instructions live in the source repository linked above.