{"id":"4bbb05e8-d000-4842-bc04-a08e56a09f56","slug":"glossa","kind":"mcp","name":"Glossa","summary":"Make ChatGPT your local coding agent","owner":"ariobarin","repoUrl":"https://github.com/ariobarin/Glossa","license":"MIT","licenseTier":"permissive","trust":"community","stars":6,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-07-14T17:34:29.000Z","addedAt":"2026-10-21T09:17:08.181Z","logoUrl":"https://avatars.githubusercontent.com/u/89481178?u=e7dad56cba6861c2b7ee0e45998873c20affb580&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["utilities"],"tags":["chatgpt","developer-tools","local-development"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-25T16:53:08.338Z","sample":false,"url":"https://conduits.dev/tools/glossa","language":"TypeScript","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# Glossa\n\nCodex ran out, and you're still working. Glossa lets you keep going on your computer with the ChatGPT usage still available through your subscription.\n\nChatGPT can use your existing checkout and development tools. Glossa is not another model or coding agent. See [Why Glossa](https://glossa.sh/docs/why).\n\n## Quick start\n\nInstall the CLI with Node.js 22.9 or newer:\n\n```shell\nnpm install --global @ariobarin/glossa\n```\n\nInstall [Glossa from the ChatGPT plugin directory](https://chatgpt.com/plugins/plugin_asdk_app_6ad2768d567c8191a369d9f6e6c79d11). Without directory access, add `https://mcp.glossa.sh/mcp` as a custom OAuth MCP app.\n\nThen open a terminal in the project and start Glossa:\n\n```shell\nglossa\n```\n\nThe first time a computer runs Glossa, it shows a short pairing code. Enter it on the Glossa control panel from any browser to enroll the computer; a headless or SSH-only machine needs no local browser. The CLI stores only its revocable device credential, not a Google or Auth0 refresh token.\n\nFollow the [quickstart](https://glossa.sh/docs/quickstart) for the complete connection flow. Self-contained installers are covered in the [operations guide](docs/operations.md).\n\n## Choose access\n\n| Profile | Read files | Edit files inside the project | Run local commands |\n| --- | --- | --- | --- |\n| `read-only` | Yes | No | No |\n| `workspace` (default) | Yes | Yes | No |\n| `system` | Yes | Yes | Yes |\n\nThe default allows guarded file edits without command execution.\n\n> **`system` is not sandboxed.** Commands have the full environment, credentials, filesystem permissions, and network access of the operating-system account that started Glossa. They are not confined to the selected project.\n\nExpose only a narrow project you trust. Keep credentials and regulated or otherwise sensitive data out of the workspace. See [Security and permissions](https://glossa.sh/security) before enabling `system`.\n\n## How it works\n\n```text\nChatGPT\n  -> OAuth-protected Glossa relay\n  -> outbound worker running on your computer\n  -> one folder you selected\n```\n\nThe worker initiates the connection, so Glossa does not require an inbound port. The relay routes authenticated requests to the active worker and does not store a repository copy.\n\n## Common controls\n\nPress `d` in the worker terminal to list and revoke the account's devices, and `q` or Ctrl+C to disconnect the workspace immediately.\n\n```shell\nglossa unpair\nglossa update --check\n```\n\n## Security boundary\n\nStructured file tools stay inside the selected root and reject absolute paths, parent traversal, and linked-path escapes. The relay and local worker both enforce the selected access profile. The `system` warning above describes the separate command boundary.\n\nRead the [public security overview](https://glossa.sh/security), [technical threat model](docs/security.md), and [private reporting policy](SECURITY.md) for details.\n\n## Local development\n\nNode.js 22.9 or newer and Docker are required:\n\n```powershell\nnpm run dev:setup\nnpm run dev\n```\n\nStop local Postgres with `npm run dev:down`.\n\n### Local integration\n\nThe full flow (pairing, device management, MCP, and a live worker) runs locally against disposable Postgres, without touching the production tenant or relay:\n\n```powershell\nnpm run integration:local\n```\n\nSee [integration tests](docs/integration-tests.md) for what it covers.\n\nFor manual end-to-end work, run the development issuer and the relay in separate terminals:\n\n```powershell\nnpm run dev:auth   # prints the relay .env and CLI environment values\nnpm run dev\n```\n\nPoint the CLI at the local stack with the printed `GLOSSA_RELAY_ORIGIN`. The development issuer signs any requested identity and signs in to the control panel without a prompt, so redeem pairing codes there; never deploy it.\n\n## User documentation\n\n- [Quickstart](https://glossa.sh/docs/quickstart)\n- [Why Glossa](https://glossa.sh/docs/why)\n- [Security and permissions](https://glossa.sh/security)\n- [Support](https://glossa.sh/support)\n- [Privacy](https://glossa.sh/privacy)\n- [Terms](https://glossa.sh/terms)\n\n## Technical documentation\n\n- [Operations guide](docs/operations.md)\n- [Architecture](docs/architecture.md)\n- [Protocol](docs/protocol.md)\n- [Security and threat model](docs/security.md)\n- [Self-hosting](docs/self-hosting.md)\n\n## Maintainer and review documentation\n\n- [Managed identity and reviewer access](docs/managed-identity.md)\n- [MCP metadata operations](docs/metadata-operations.md)\n- [Restricted Data review](docs/restricted-data.md)\n- [Submission readiness](docs/submission-readiness.md)\n- [Plugin submission demo recording](docs/demo-recording.md)\n- [App submission packet](docs/app-submission-packet.md)\n"}