Orcel

Computer Orchestration & Trusted Runtime Access

Orcel is an open-source, local-first MCP gateway that lets ChatGPT work with an explicitly trusted folder on your Windows computer through a small set of bounded tools, with local approval for anything that changes your computer. It connects through the OpenAI Secure MCP Tunnel, so no inbound port is opened on your machine.

Orcel is not a remote shell, a remote desktop, or a “run anything” agent.

Identity migration: Orcel is the current product and repository name. Older client installations, credentials, and state are not automatically migrated to the newly named CLI, packages, or environment variables. See the Orcel identity record before upgrading.

Website: https://thehalfmoon.github.io/Orcel/

Canonical releases: https://github.com/TheHalfMoon/Orcel/releases

What ChatGPT can do through Orcel

Exactly these 31 tools are exposed over local MCP:

Everything else is denied. Remote clients (ChatGPT through the tunnel or relay, and other providers) see only the 26-tool core profile: desktop observation, clipboard, and network fetch are local-only and cannot be reached remotely. Browser automation, screenshots, coordinate input, and UI actuation remain unreachable over MCP entirely.

Current limitations

• process_spawn on Windows launches only locally registered, hash-pinned native executables with constrained argv; adding or changing a registry entry requires Windows Hello on the machine.
• git_fetch and git_push require destination policies that the current compatibility runtime does not configure yet, so they fail closed in an installed Orcel runtime.
• Release binaries are not code-signed (there is no paid certificate under the project’s zero-cost rule). Windows SmartScreen may warn; verify the archive with SHA256SUMS.txt and the GitHub build-provenance attestation.
• Orcel runs only while you are signed in, because approvals appear on your desktop.

How approvals work

• SOFT approval — a Orcel dialog appears on your desktop describing the exact action (for example, the file and content hash). Approve or deny it yourself. Each approval is used once, expires quickly, and is bound to that exact action, workspace, and policy.
• STRONG approval — Windows Hello (PIN, fingerprint, or face) for trust changes and emergency revoke.
• ChatGPT cannot approve its own actions: approvals come only from the local broker, and Orcel’s own windows are excluded from automation.
• orcel approvals lists recent decisions; orcel emergency-revoke invalidates every pending approval.

Requirements

• Windows 10 version 1809 (build 17763) or later, or Windows 11, x64.
• Node.js 20 or later.
• The official OpenAI tunnel client executable, and a Secure MCP Tunnel id (tunnel_…) and runtime key from OpenAI for your ChatGPT workspace. Follow OpenAI’s documentation to create them; Orcel does not create, download, or redistribute them.
• No administrator rights. Do not use “Run as administrator”.

Install

The current transition release keeps the existing archive and executable names for compatibility.

1. Download orcel--windows-x64.zip and SHA256SUMS.txt from the project’s GitHub Releases page (release automation only prepares drafts; a release appears there once the maintainer publishes it) and verify the hash:

   $zip = "orcel--windows-x64.zip"
   $expected = ((Get-Content .\SHA256SUMS.txt) | Where-Object { $_ -like "*  $zip" } | ForEach-Object { $_.Split(" ")[0] })
   $actual = (Get-FileHash ".\$zip" -Algorithm SHA256).Hash.ToLower()
   if (-not $expected -or $actual -ne $expected) { throw "checksum mismatch: do not extract $zip" } else { "checksum OK" }
   

   On Linux or WSL, sha256sum -c --ignore-missing SHA256SUMS.txt does the same. Optionally verify provenance: gh attestation verify .\orcel--windows-x64.zip --repo TheHalfMoon/Orcel.
2. Extract the archive and run, from the extracted folder: .\orcel.exe install Every file is checked against manifest.json before anything is copied. The compatibility installer currently installs to %LOCALAPPDATA%\Orcel, readable only by you (and Windows itself), and adds %LOCALAPPDATA%\Orcel\bin to your user PATH (--no-path to skip). Open a new terminal afterwards.

Configure

1. Add a workspace (a folder ChatGPT may use): orcel workspace add myproject C:\path\to\project Folders that contain Orcel’s own protected data are refused.
2. Optionally grant workspace trust with Windows Hello: orcel workspace trust myproject.
3. Configure the tunnel: orcel tunnel setup --client C:\path\to\tunnel-client.exe --tunnel-id tunnel_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx You are prompted for the runtime key without echo (or pass --key-file ). The key is stored only in the protected local folder, passed to the tunnel client by file reference, and never printed or logged.

Connect ChatGPT

1. orcel start — starts the official tunnel client under Orcel’s supervisor. It reports running only when the tunnel client is alive and its local health endpoint answers.
2. In ChatGPT, connect to your Secure MCP Tunnel as described in OpenAI’s documentation. ChatGPT then sees the 26-tool core profile above.

Connect local MCP clients (no tunnel required)

Local clients that can launch a command use orcel mcp stdio. It starts the same authoritative MCP server over standard input and output, with the same 31 tools and the same local approvals. No tunnel setup is needed. Standard output stays the MCP channel, so run it only through the client configuration below, not by hand.

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "orcel": {
      "command": "orcel",
      "args": ["mcp", "stdio"]
    }
  }
}

Codex and other command-based clients use the same command and arguments:

{
  "command": "orcel",
  "args": ["mcp", "stdio"]
}

Mistral Vibe Code accepts a stdio entry in its MCP server list with command orcel and arguments ["mcp", "stdio"]. Generic MCP clients and the MCP Inspector connect with transport stdio, command orcel, and arguments ["mcp", "stdio"].

orcel here is the retained compatibility command at %LOCALAPPDATA%\Orcel\bin\orcel.exe on your user PATH after install. It resolves the active verified release on every launch, refuses tampered or inactive payloads, and fails closed when no workspace is configured. Tested per-client files live in examples/mcp-clients (Claude Desktop JSON and Desktop Extension manifest, Codex TOML, Vibe Code TOML, generic shapes, and the Inspector qualification script).

Connect over loopback HTTP (no tunnel required)

orcel mcp serve exposes the same 31 tools over Streamable HTTP on 127.0.0.1 only. It never binds a LAN address. Every request needs a per-user bearer credential:

$env:ORCEL_LOOPBACK_TOKEN = ""
orcel mcp serve

The listener prints its URL, for example http://127.0.0.1:54321/mcp, on standard error. Pass --port to choose the port instead of an ephemeral one. The credential is required on every request as Authorization: Bearer ; missing or wrong credentials fail closed, as do forged Host or browser Origin values. Browser pages on other origins cannot drive the listener. Keep the token on your machine and never commit it.

Mistral Vibe Code HTTP mode and generic Streamable HTTP clients connect to the printed URL with the bearer header. Clients that can launch a command should prefer orcel mcp stdio above.

Everyday commands

Diagnose problems

Run orcel doctor. Each check reports PASS, WARN, FAIL, or ???? (could not be checked) with one line of evidence — Orcel never reports health it did not observe. Logs are currently stored in the compatibility path %LOCALAPPDATA%\Orcel\logs (tunnel.log, supervisor.log, lifecycle.log); tunnel output is redacted before it is written.

Update

Orcel never checks for or downloads updates by itself.

1. Download and verify the new release as in Install, then extract it.
2. orcel update --source C:\path\to\extracted-release --check shows the version change.
3. orcel update --source C:\path\to\extracted-release stops the runtime, switches versions, has the new version verify itself, and restarts it. If the new version fails its own check, the previous version is restored automatically and orcel doctor reports why.
4. orcel rollback returns to the previous version. Older versions require --allow-downgrade.

Uninstall

• orcel uninstall stops Orcel and removes its programs and the PATH entry. Your configuration, tunnel key, logs, and audit/approval/trust history are kept and listed.
• orcel uninstall --purge-data --yes also deletes that data.
• Your workspaces are never touched.

Security model and governance

• Architecture and delivery plan
• Current canonical state
• Threat model and v0.2 regression matrix
• Installer and lifecycle design
• Dependency and license review
• Diffcipline
• Orcel identity record

Building from source

npm ci --ignore-scripts && npm run build, then cargo build --release --locked -p orceld -p orcel-lifecycle --bins, then node scripts/package-release.mjs --out to assemble a release directory and node scripts/archive-release.mjs --release --out .zip to archive it. CI builds with the deterministic flags in .github/actions/build-package-qualify/action.yml and checks that an independent rebuild is byte-identical.

The orcel* Cargo and release identifiers in this command are compatibility identifiers retained during the Orcel rename and are not the current product brand.

License

Apache License 2.0. Third-party components and their licenses are listed in THIRD_PARTY_NOTICES.txt in each release.