Kobel vs ChatGPT file access
ChatGPT has excellent approval controls and no way to reach your hard drive. Understanding why those two facts go together explains the whole category.
Last reviewed:
ChatGPT cannot reach your local files through an official connector. Its connectors are cloud-to-cloud OAuth integrations — Google Drive, SharePoint, Slack, GitHub — that talk to another server, not to your disk. The nearest route is developer mode, and even there ChatGPT connects only to remote MCP servers over HTTPS: a server running on your own machine has to be exposed publicly or tunnelled with OpenAI's Secure MCP Tunnel. Full MCP support including write actions is in beta on Business, Enterprise and Edu plans; Pro is limited to read-only connectors.
ChatGPT does have the clearest permission tiering in the consumer market: Always ask, Any changes, Important actions and Never ask, set globally and overridable per app. But those tiers govern when you are asked, not what exists to be asked about. Kobel governs the second question: which folders, apps and accounts are visible at all, and at which of five levels.
At a glance
| ChatGPT apps & connectors | Kobel | |
|---|---|---|
| What it is | An AI assistant with cloud integrations | A local permission layer for AI assistants |
| Official local file connector | None | Core function |
| How local access is possible | Developer mode, beta on Business/Enterprise/Edu — and only against a remote or tunnelled MCP server | Drag a folder in, pick a permission level; an optional built-in tunnel makes the local gateway reachable for ChatGPT |
| Permission granularity | Four approval tiers per app | Five permission levels per resource |
| Approval tiers | Always ask / Any changes / Important actions / Never ask | Enforced by level, not by prompt |
| Where your data is processed | OpenAI's cloud | On your device |
| Write protection for originals | No equivalent | Orange: read original, write copies only |
| Automatic backup before writes | No | Teal level |
| Applies to other AI tools | No | Yes |
| Admin controls | Workspace RBAC, app availability, action and domain restrictions | Team plans with central rules |
| Cost | Included with a ChatGPT plan | Free tier; €49 one-time or €3.90/month |
Why "connect ChatGPT to my files" usually disappoints
The word connector is doing a lot of work in OpenAI's product. A connector authenticates ChatGPT
against another cloud service via OAuth and lets it search or act there. Google Drive is a connector. Your
Documents folder is not, because there is nothing at the other end for OpenAI to authenticate against.
People discover this in a predictable order:
- They upload the files by hand, then get tired of it.
- They sync everything to Google Drive so a connector can see it — which means the AI can now see the whole drive, including everything they never meant to share.
- They find developer mode — available in beta on Business, Enterprise and Edu plans — enable MCP apps, read the warning that write tools are now available, and then discover that ChatGPT will only talk to a server reachable over HTTPS, so the machine has to be exposed or tunnelled.
Step 2 is the dangerous one, and it is the most common. It solves an access problem by removing a boundary.
OpenAI's four approval tiers — genuinely good, but a different axis
Credit where it is due. ChatGPT's global setting under Settings → Apps is the clearest consumer-grade permission UI any AI vendor ships:
- Always ask — confirm every action.
- Any changes — read freely, confirm anything that writes.
- Important actions (default) — confirm sends, deletions, financial transactions and sensitive sharing.
- Never ask — no confirmations.
OpenAI's Apps SDK security guidance also tells developers to request only the scopes they need, to make account linking and write access explicit to the user, and to require human confirmation for irreversible operations.
Approval tiers are a timing control: when should the human be interrupted? A permission layer is a scope control: what is in the set of things the AI could ask about in the first place? "Ask me before you touch my tax folder" and "my tax folder does not exist as far as the AI is concerned" are different guarantees. The second one survives a tired click on the wrong button.
If you do use developer mode
Two things are worth being precise about, because most write-ups get them wrong.
ChatGPT does not run local MCP servers. It connects to remote servers over HTTPS. OpenAI's own documentation says that a server on a private network, on-premises or on a developer machine has to be reached through its Secure MCP Tunnel rather than added directly. So "ChatGPT + local files" always means exposing something on that machine to the internet, one way or another — which is itself a decision worth making deliberately.
Whatever you expose runs with your permissions. The MCP specification's security guidance says clients supporting one-click local server configuration must display the exact untruncated command, flag it as dangerous and require explicit approval, and should sandbox the server and restrict its filesystem and network access. Security reviews of public MCP servers published through 2025 and 2026 have repeatedly reported significant proportions with serious flaws, and Anthropic states plainly that it reviews connectors against listing criteria but does not security-audit or manage any MCP server.
This is the practical reason to put a permission layer underneath whatever you expose: the MCP server can only see what the layer below it makes visible.
How the two work together
This is the part that is genuinely complementary rather than competitive. ChatGPT decides when to ask you. Kobel decides what there is to ask about. Used together you get both.
- Kobel runs locally and exposes only the folders, apps and accounts you have added.
- Each one carries a level: blocked, read-only, edit-a-copy, edit-with-backup, or edit.
- Because ChatGPT reaches only remote MCP endpoints, Kobel ships an optional ChatGPT tunnel that makes the local gateway reachable for it. Only what you have released is on the other side of that tunnel.
- ChatGPT's own approval tiers still apply on top — keep them at Any changes or stricter for anything that writes.
- Every access lands in the local activity log with timestamp, AI identity and permission level, and the log is not exposed to the AI through the gateway.
The tunnel is opt-in and off until you enable it — enabling it means traffic to OpenAI, so treat it as a deliberate decision rather than a default. Full MCP support with write actions is in beta on ChatGPT Business, Enterprise and Edu plans; Pro is limited to read-only connectors. Clients that speak local MCP directly — Claude Desktop, GitHub Copilot, Gemini CLI, Cursor, Ollama — need no tunnel at all. Check kobel.app for the current setup steps.
Verdict
ChatGPT alone is fine if…
- Your data already lives in Google Drive, SharePoint or Slack
- You are happy for it to be processed in OpenAI's cloud
- Approval prompts are enough control for you
- You have no files on disk that must stay invisible
Add Kobel if…
- The files are on your own machine
- Some folders must never be reachable, not merely confirmed
- You do not want to sync private data to a cloud drive just to make it accessible
- You use ChatGPT alongside other AI tools and want one rule set
- You need an activity log you can show a client
Kobel's five permission levels
Every folder, app and account gets exactly one of these five levels. You set it by dragging a folder in and picking a colour — there is no configuration file.
- GreenRead and write. The AI may open files and save changes in place.
- TealWrite with automatic backup. Every change is preceded by a backup copy, so a bad edit is always reversible.
- OrangeRead the original, write only to copies. The AI can work with your data but cannot alter the source file.
- YellowRead only. Look, don't touch.
- RedBlocked. The resource is invisible to the AI.
Keep reading
Sources
Try it on one folder
Install Kobel, drag in a single folder, set it to read-only, connect your assistant. Two minutes. Free Basis tier, no account needed.
Download KobelSee featuresFrequently asked questions
Can ChatGPT access files on my computer?
Not through an official connector. ChatGPT's connectors are cloud-to-cloud OAuth integrations with services such as Google Drive, SharePoint, Slack and GitHub. Even in developer mode, ChatGPT connects only to remote MCP servers over HTTPS — OpenAI's documentation directs you to its Secure MCP Tunnel for anything running on a developer machine or private network. Full MCP support with write actions is in beta on Business, Enterprise and Edu plans.
How do I give ChatGPT access to just one folder?
You need something on your machine that exposes exactly that folder over MCP and nothing else. Kobel does this with a drag-and-drop folder list where each entry gets one of five permission levels; anything not added is invisible. The alternative is to configure a filesystem MCP server yourself with allowed directories passed as command-line arguments.
Is it safe to enable developer mode and MCP in ChatGPT?
It depends entirely on what the MCP servers you run can reach. The MCP specification's security guidance is explicit that local servers should be sandboxed with restricted filesystem and network access, because an MCP server runs with your user permissions. Putting a permission layer underneath means the server can only see what you have deliberately exposed.
What is the difference between ChatGPT's approval levels and Kobel's permission levels?
ChatGPT's four tiers control when you are asked to confirm an action. Kobel's five levels control what is accessible at all, and what may be done with it. One is a timing control, the other is a scope control — and a scope control cannot be defeated by clicking confirm without reading.
Do my files get uploaded to OpenAI if I use Kobel?
Kobel itself processes everything locally and uploads nothing. But ChatGPT is a cloud service: any file content you deliberately allow it to read is sent to OpenAI and handled under OpenAI's terms. Kobel controls what is shared, not what happens to it afterwards.
Does Kobel work with ChatGPT's desktop app?
Yes. Because ChatGPT reaches only remote MCP endpoints, Kobel includes an optional ChatGPT tunnel that makes the local gateway reachable for it; it is off until you switch it on. Clients that speak local MCP directly — Claude Desktop, GitHub Copilot, Gemini CLI, Cursor, Ollama and other MCP clients — are auto-detected and connected in one click, with no tunnel involved.