Docs · Connection
Four ways in
All four end at the same loopback MCP server with the same repository policy. What differs is who terminates TLS, how long the URL lives, and whether anything has to be open inbound.
Option 01 · Free
Local loopback
For an MCP client running on the same machine. Nothing leaves the host.
omas serve
endpoint http://127.0.0.1:8787/mcp
health http://127.0.0.1:8787/health
Option 02 · Free
Built-in ngrok flow
The quickest way to get a public HTTPS URL for a development session.
omas connect
https://<id>.ngrok.app/t/<random-token>/mcp
The command starts the server, starts or reuses ngrok, and prints the URL. Paste it into your MCP client as the connector Server URL, exactly as printed including the token segment. In ChatGPT that field lives in Developer Mode; other clients call it a server or connector URL.
Understand the token
The random path segment is guess-resistance, not authentication. Anyone with the full URL can reach the endpoint while the tunnel is running. Treat it as a temporary development endpoint and stop it when you are done.
Option 03 · Free
OpenAI Secure MCP Tunnel
For a longer-lived or private connector setup where supported.
cp .env.example .env
# CONTROL_PLANE_API_KEY, TUNNEL_CLIENT_BIN, TUNNEL_CLIENT_PROFILE
omas connect-secure
The local endpoint stays private at /mcp; the tunnel client opens an outbound connection to OpenAI and forwards requests back. Create the runtime key in the OpenAI Platform with Tunnels Read and Use permissions, and keep it in .env or another local secret store — never a committed file.
Option 04 · Premium
Relay with a stable URL
An enrolled node with its own credential, reached over an outbound connection.
export LIBRAX_RELAY_URL=https://relay.omas.taps.im
export LIBRAX_RELAY_SECRET_FILE=~/.config/librax-relay.secret
./librax-mcp-desktop
connector https://relay.omas.taps.im/t/<token>/mcp
The companion generates a 256-bit connector token and node id in the platform state directory, then dials out over WSS. No inbound port is opened, and the URL survives restarts and IP changes. The relay itself is shipped as Docker Compose if you would rather host it.
Either way
Policy does not widen
Network exposure changes nothing about repository policy. The client still supplies only a repo_id. Approved roots, default excludes, path sandboxing, secret checks, write policy, expected-HEAD checks, and tool schemas all still apply, and mutating tools stay disabled unless that repository enabled them.
Approval prompts belong to your MCP client. The server cannot disable them.