# Connect ChatGPT to your self-hosted MCP memory server.

Let ChatGPT recall and contribute selected knowledge from the same Keep used by
your coding agents—**without opening a public inbound port to the Keep**.

[Open the setup guide](https://firekeep.ai/chatgpt-self-hosted-mcp-memory.html#setup) ·
[See the connection path](https://firekeep.ai/chatgpt-self-hosted-mcp-memory.html#architecture) ·
[Read the complete Firekeep docs](https://firekeep.ai/docs.html)

Outbound HTTPS · Curated chat tools · One person or a team

Published and updated August 28, 2026 by the Firekeep team.

## The direct answer

Yes—ChatGPT can use a private, self-hosted Firekeep server through OpenAI Secure
MCP Tunnel.

Run OpenAI's `tunnel-client` beside an enrolled Firekeep Client Kit. It makes an
outbound HTTPS connection, receives ChatGPT's MCP requests, and forwards them to
a Firekeep gateway limited to recall, learning, feedback, skills, and sessions.

The Keep does not need a public listener. The tunnel is the request path, so
tool arguments and tool responses handled through it transit OpenAI.
Read the current
[official Secure MCP Tunnel guide](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels)
before enabling the connection.

## A narrow route into the Keep—not a public door

ChatGPT cannot launch a local stdio process on your server. Secure MCP Tunnel
gives it an OpenAI-hosted endpoint while `tunnel-client`, running inside your
boundary, polls for work and forwards each request to Firekeep locally.

1. **ChatGPT chooses a tool.** You ask it to recall, learn, check a skill, or
   update a session.
2. **OpenAI routes the MCP call.** The request reaches the tunnel endpoint
   associated with your workspace.
3. **Your host collects it.** `tunnel-client` initiates outbound HTTPS and
   forwards the call over local stdio.
4. **Firekeep returns selected context.** The curated gateway calls the
   self-hosted Keep and sends the response back on the same route.

**Network boundary:** no public inbound port opens on the Keep host.
**Data boundary:** the MCP requests and responses carried by the tunnel pass
through OpenAI's control plane.

## Native memory and shared organizational knowledge

Use ChatGPT's own memory and a shared Keep for different jobs.

- **Inside ChatGPT:** use the product's own memory and conversation features
  for continuity within ChatGPT. Firekeep does not replace or silently
  synchronize that layer.
- **Across your work:** use Firekeep for selected knowledge, procedures, and
  working state that should survive a tool switch—from ChatGPT to Claude Code,
  Codex, Kiro, or the next teammate.

Every solved problem can make the next one easier. ChatGPT can explicitly
preserve useful experience with `memory_learn`; another connected agent can
recall it later. For one person, that means less re-explaining. For a group, it
means context can become shared organizational knowledge instead of staying
inside one chat.

## Before you start

Firekeep side:

- An enrolled Client Kit version 1.4.0 or later.
- `firekeep doctor` green for the account that will run the gateway.
- A Linux host with systemd for the service setup below.
- Outbound HTTPS to OpenAI's documented tunnel endpoint.

OpenAI side:

- A `tunnel_id` and runtime API key from Platform tunnel settings.
- Tunnels Read + Use permission to run and select the tunnel.
- Tunnels Read + Manage permission for whoever creates or edits it.
- ChatGPT developer-mode access in the target workspace.

Plan availability, workspace policy, and interface labels can change. Check
[OpenAI's current permissions guidance](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels#permissions-and-access)
rather than relying on a saved screenshot.

## Connect ChatGPT to Firekeep

Run these commands in Bash while logged in as the same Linux account that installed and
enrolled Firekeep. The service unit below pins that account and its home
directory explicitly. You will need `sudo` to install the binary and system
service.

### 1. Verify Firekeep for the service account

On the Keep host, install or enroll the Client Kit for the current account if
needed. Confirm version 1.4.0 or later, then verify the complete path:

```bash
if ! command -v firekeep >/dev/null 2>&1; then
  curl -fsSL https://firekeep.ai/latest/install | sh
fi
firekeep version
firekeep doctor
```

Already enrolled and green on 1.4.0 or later? Keep that installation. If
`firekeep version` reports an older release, run `firekeep update`, then repeat
the version and doctor checks before continuing.

### 2. Install OpenAI's tunnel client

Download the current `tunnel-client` for your architecture from
[OpenAI's release page](https://github.com/openai/tunnel-client/releases/latest),
verify its published checksum, and place the binary on the path:

```bash
sudo install -m 0755 tunnel-client /usr/local/bin/tunnel-client
tunnel-client --version
```

[Inspect the curated gateway source](https://github.com/kapella-hub/FirekeepHQ/blob/78d9cb053be1c819849ede59d87cd1f9d54fb2f3/client/firekeep_client/gateway.py#L41-L65).

### 3. Create a fail-closed gateway wrapper and tunnel profile

Create a tunnel in
[OpenAI Platform settings](https://platform.openai.com/settings/organization/tunnels).
This block writes the small gateway wrapper locally, stores the runtime key in a
service-account-owned `0600` file, initializes the profile, and validates the
route before enabling the service:

```bash
FIREKEEP_OS_USER="$(id -un)"
FIREKEEP_OS_GROUP="$(id -gn)"
sudo install -d -m 0750 -o "$FIREKEEP_OS_USER" -g "$FIREKEEP_OS_GROUP" \
  /etc/firekeep/chatgpt-tunnel
sudo tee /etc/firekeep/chatgpt-tunnel/run-gateway.sh >/dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
unset FIREKEEP_TOOLS_ALLOW
export FIREKEEP_TOOLSET=chat
exec "$HOME/.firekeep/shims/firekeep" gateway --runtime chatgpt
EOF
sudo chmod 0755 /etc/firekeep/chatgpt-tunnel/run-gateway.sh
sudo install -m 0600 -o "$FIREKEEP_OS_USER" -g "$FIREKEEP_OS_GROUP" \
  /dev/null /etc/firekeep/chatgpt-tunnel/tunnel.env

read -rp 'OpenAI tunnel ID: ' FIREKEEP_TUNNEL_ID
read -rsp 'OpenAI tunnel runtime key: ' CONTROL_PLANE_API_KEY; printf '\n'
export CONTROL_PLANE_API_KEY
printf 'CONTROL_PLANE_API_KEY=%s\n' "$CONTROL_PLANE_API_KEY" \
  | sudo tee /etc/firekeep/chatgpt-tunnel/tunnel.env >/dev/null

cd /etc/firekeep/chatgpt-tunnel
tunnel-client init --sample sample_mcp_stdio_local --profile firekeep \
  --tunnel-id "$FIREKEEP_TUNNEL_ID" \
  --mcp-command "/etc/firekeep/chatgpt-tunnel/run-gateway.sh"
tunnel-client doctor --profile firekeep --explain
unset CONTROL_PLANE_API_KEY FIREKEEP_TUNNEL_ID
```

### 4. Pin the enrolled OS account and start the long-lived service

Run this from the same login. The generated unit names the current user, group,
and home directory instead of relying on systemd's root defaults:

```bash
FIREKEEP_OS_USER="$(id -un)"
FIREKEEP_OS_GROUP="$(id -gn)"
FIREKEEP_HOME="$HOME"
sudo tee /etc/systemd/system/firekeep-chatgpt-tunnel.service >/dev/null <<EOF
[Unit]
Description=Firekeep ChatGPT tunnel
After=network-online.target
Wants=network-online.target

[Service]
User=$FIREKEEP_OS_USER
Group=$FIREKEEP_OS_GROUP
Environment="HOME=$FIREKEEP_HOME"
WorkingDirectory=/etc/firekeep/chatgpt-tunnel
EnvironmentFile=/etc/firekeep/chatgpt-tunnel/tunnel.env
ExecStart=/usr/local/bin/tunnel-client run --profile firekeep
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
sudo systemd-analyze verify /etc/systemd/system/firekeep-chatgpt-tunnel.service
sudo systemctl daemon-reload
sudo systemctl enable --now firekeep-chatgpt-tunnel
sudo systemctl status firekeep-chatgpt-tunnel
```

### 5. Connect ChatGPT and prove the handoff

Associate the tunnel with the target ChatGPT workspace in Platform settings.
Enable developer mode, open ChatGPT Plugins, and choose **+** to create a
developer-mode app. Under Connection, choose **Tunnel**, select or paste the
`tunnel_id`, review the discovered tools, and start a new conversation with the
connection enabled.

First ask ChatGPT to call `firekeep_gateway_status`. Then ask it to use
`memory_recall` for a known, non-secret fact. For a cross-runtime proof,
explicitly save a harmless, clearly labeled test memory in ChatGPT and recall it
from Claude Code or Codex.

## The curated chat surface

With every backend healthy, the `chat` preset exposes up to twelve Firekeep work
tools, plus the always-present local `firekeep_gateway_status` diagnostic. A
degraded backend can reduce the work-tool count; status remains available:

- Memory: `memory_recall`, `memory_learn`, `memory_feedback`.
- Skills: `skill_recall`, `skill_list`.
- Sessions: `ctx_start_session`, `ctx_update`, `ctx_complete_session`,
  `ctx_abandon_session`, `ctx_list_sessions`, `ctx_resume_session`,
  `ctx_get_shadow`.

**Not on this route:** vault access, corpus ingest, Relay coordination, backups,
dex/code tools, policy actions, and decision boards. Those tools are absent from
the tunnel-facing gateway rather than hidden by prompt wording. Corpus ingestion
is excluded, but `memory_recall` can still return existing corpus content visible
to the enrolled member, including that member's private Docdex or Maildex
material. The toolset is a capability allowlist, not a per-memory or per-document
content filter.

## The operating boundary

- **The Keep stays on your side.** The self-hosted services, datastores, vault,
  and local gateway stay behind your existing boundary. The Keep itself does
  not accept a new public inbound connection.
- **The requested MCP exchange crosses OpenAI.** Tool names, arguments, and
  returned content carried by Secure MCP Tunnel transit OpenAI's control plane.
  Select what ChatGPT can reach accordingly.
- **Recall and capture are explicit.** ChatGPT has no Firekeep lifecycle hooks.
  It uses the Keep when the model calls a Firekeep tool; do not assume every
  message is recalled or saved.
- **The gateway acts as its enrolled member.** Calls inherit the member identity
  of the Client Kit running on the host. Use a dedicated enrolled member if you
  need a separate identity boundary for this connection. All chats through the
  gateway also share its configured Firekeep agent identity; starting a session
  in one chat can auto-pause the previous active session for that identity.

## Operations

- Check: `sudo systemctl status firekeep-chatgpt-tunnel` and
  `sudo journalctl -u firekeep-chatgpt-tunnel`.
- Diagnose: from `/etc/firekeep/chatgpt-tunnel`, run
  `set -a; . ./tunnel.env; set +a`, then
  `tunnel-client doctor --profile firekeep --explain`, and finish with
  `unset CONTROL_PLANE_API_KEY`.
- Stop: `sudo systemctl disable --now firekeep-chatgpt-tunnel`. No public Keep port
  needs closing.

## Start with the Keep

Firekeep is source-available under BUSL-1.1. Self-hosted internal production use
is free for individuals and teams during early access, with no Firekeep account
or license key required.

- [Install the self-hosted Keep](https://firekeep.ai/self-hosted-mcp-memory-server.html#install)
- [View the public source](https://github.com/kapella-hub/FirekeepHQ)
- [Read the license](https://firekeep.ai/LICENSE.txt)

## Frequently asked questions

### Can ChatGPT connect directly to a local Firekeep stdio server?

Not from the hosted ChatGPT product. OpenAI Secure MCP Tunnel provides the
supported private connection path: a client inside your network initiates
outbound HTTPS and forwards requests to Firekeep over local stdio.

### Does the tunnel make my Keep public?

No public inbound listener is required on the Keep. The connection is still a
third-party data path: MCP requests and responses handled through the tunnel
pass through OpenAI's control plane.

### Does Firekeep replace ChatGPT's native memory?

No. Use ChatGPT's native memory for continuity inside ChatGPT. Use Firekeep for
selected knowledge and working context that should remain available across
agents, sessions, machines, or people.

### Will ChatGPT automatically save every conversation?

No. ChatGPT has no Firekeep hooks. Recall, learning, feedback, and session
updates happen through explicit calls to the tools available on the curated
chat surface.

### Can ChatGPT access my vault or ingest documents?

Not through the default chat toolset. Vault, corpus-ingest, Relay, backup,
dex/code, policy, and decision-board tools are excluded at the gateway. Other
trusted clients or operators can manage those surfaces separately.

### Is Secure MCP Tunnel a public plugin distribution path?

No. OpenAI documents Secure MCP Tunnel for private connections and
developer-mode testing. Public plugin distribution has a separate review path
and requires a stable public HTTPS MCP endpoint.

## Related Firekeep guides

- [Install and operate a self-hosted MCP memory server](https://firekeep.ai/self-hosted-mcp-memory-server.html)
- [Share memory between Claude Code and Codex](https://firekeep.ai/claude-code-codex-shared-memory.html)
- [Compare current runtime behavior](https://firekeep.ai/docs.html#usage)
- [Download Firekeep Studio for Windows](https://firekeep.ai/latest/studio/windows)
- [Download Firekeep Studio for macOS](https://firekeep.ai/latest/studio/macos)