Documentation / Staging preview
Connect your computer,
one authority at a time.
The first-use path is installation → GitHub device authorization → running Runtime → protected endpoint → ChatGPT client OAuth → a real permitted operation. These are separate states, and each has its own verification.
Working with an AI assistant? Send it the exact installation, pairing and verification contract instead of repeating setup steps by hand.
Read the Agent guide ↗Before you begin
Local Computer is available for bounded Staging testing, not as a supported Production release. The latest Linux x64 Build487 preview is unsigned, while macOS Intel Build490 is Apple Development signed but not notarized. Verify each current Staging ZIP/tarball against its SHA-256 and review any macOS security approval yourself. Only the latest candidate for each platform is shown on the download page.
Install & authorize
- Verify the package. Confirm the intended operating system, build, source commit and checksum with the artifact record. Linux Build487 is unsigned; SHA-256 checks file integrity against this Staging site, not an independent publisher signature. Do not run a generic remote shell installer.
- Install locally. macOS uses the signed development App and its OS permission prompts; Linux uses the approved x64 Staging headless package with privileged installation.
- Configure the Staging environment. Use the package's supported bootstrap inspect/apply flow. Confirm the intended working folder and approval scope.
- Approve GitHub authorization. When device setup displays the official GitHub Device Flow page, enter the generated one-time code yourself. Never paste a GitHub token into a website or third-party form.
- Verify network provisioning. Registration must finish and produce an owned Device endpoint before continuing. On a network failure, preserve the original error and device identity: do not repeatedly re-enroll the same unresolved attempt.
Connect ChatGPT
Start the installed Local Computer runtime and inspect its healthy state. Then complete the supported device connect flow and verify the endpoint over HTTPS. The Device MCP endpoint should challenge unauthenticated access rather than exposing your tools anonymously.
In ChatGPT, connect the intended Local Computer MCP server, sign in through its OAuth flow and approve the requested client access. GitHub Device Flow approval for enrollment and OAuth authorization for a ChatGPT client are not interchangeable.
Build487 Staging pairing: The device-side OAuth challenge confirmation currently requires an interactive terminal session under the device's Runtime OS user. Run the installed local-computer-staging oauth-pair confirm command in a real terminal on that device, inspect the displayed Client, Device, scope and resource, then confirm only the intended challenge. Agent-mediated confirmation through a formal, audited API is planned but is not available in Build487; do not emulate a terminal to bypass the existing confirmation boundary.
Prove it with a small task
Ask the connected agent to discover its available tools, open a specific test directory and read a harmless file inside it. Grant exact folder access only where needed, then verify that an out-of-scope path remains unavailable. Start with a read-only operation before editing or commands.
On Linux, a command runs under the local OS user's authority; workspace folder approval should not be mistaken for a general shell sandbox. Third-party capabilities only appear when an enabled source exposes them.
Recovery, revoke & uninstall
- Disconnect
- Stop transport or client access; do not assume the cloud Device has been deleted.
- Client revoke
- End the particular OAuth client's grant; other clients and the Device have separate authority.
- Local reset
- Clear the product-owned local Device identity and stop associated runtime while preserving user workspace files. This does not automatically revoke an unreachable cloud record.
- Uninstall
- Remove product-owned installed components through the supported platform flow; confirm the terminal cleanup receipt, not just an accepted request.
- Cloud Remove
- Remove a remote Device record; it does not automatically erase an offline machine's local credentials.
For a failed installation or Provisioning, record the exact Device ID and error; do not delete unrelated tunnels, DNS entries, or other devices by name.
Feedback & support
When reporting a Staging problem, include platform, exact build, which step failed, and sanitized diagnostic output. Never send one-time GitHub codes, bearer tokens, passwords or private file contents.
Copy the address if no email application is configured.