Bridgerator RU

Security

What the assistant can and cannot do on your computer, how the connection works and what we store. Honestly, weak spots included.

The connection

Outbound connection only

The bridge connects to the server over a secure WebSocket. No inbound ports are opened on the PC; no public IP or port forwarding is needed.

TLS in transit

All traffic between ChatGPT, the server and the bridge uses TLS. The server decrypts requests to forward them to your PC — this is not end-to-end encryption, but the content is not stored.

Device key

Each PC connects with its own key, issued when you confirm the computer in the browser. The key is kept in your Windows profile; we keep only a one-way hash of it.

Sign-in and revocation

ChatGPT gets access only after an OAuth 2.1 sign-in with PKCE and sees only your devices. Changing your password revokes every access at once. After 8 failed sign-ins in 10 minutes, the IP is blocked for an hour.

What the assistant can touch

The rules live in %APPDATA%\Bridgerator\config.json on the PC itself. ChatGPT changes them only through Bridgerator's settings tool, and the change applies at once with no question on the PC; if you turn on “Ask before the AI changes settings” (Settings → This PC, off by default), lowering protection waits for your Apply. The file tools can't reach Bridgerator's own folders: %APPDATA%\Bridgerator, %LOCALAPPDATA%\Bridgerator and the program folder are always excluded. Nothing else is closed by default — as with similar tools.

allowedDirectories

Folders the file tools work in. With no folder list (the default on a fresh install), ChatGPT may work in every folder: nothing is restricted by default, as with similar tools. Only Bridgerator itself is always closed — its settings folders and program files — because otherwise the AI could quietly switch off any protection. With a list, ChatGPT works only in those folders. Changes ChatGPT makes to the folder list apply at once; with “Ask before the AI changes settings” (Settings → This PC, off by default) on, widening it (adding a folder to the list, or going back to all folders) waits for Apply on the PC. Network and UNC paths (\\server\…, \\?\…) are always refused.

deniedDirectories

Folders closed even inside allowed ones. Bridgerator's own folders are always on this list. With “Protect sensitive folders” on (off by default; "protectSensitive": true), it also gets ~\AppData, the Startup folder, PowerShell profiles, key and config folders (.ssh, .aws, .azure, .kube, .docker, .gnupg, .config, .claude, the files .npmrc, .git-credentials, .gitconfig). Add your own folders here too. The OneDrive root is open by default; searching it can download online-only files — add it here if you don't want that. Paths are checked through symlinks and junctions, and excluded paths are cut from search results and listings.

disabledTools

Tools the assistant never sees. For example, ["start_process", "interact_with_process", "kill_process"] turns the terminal off completely.

blockedCommands

A safety net, not a security boundary: a filter on the first word of a command, and it can be bypassed. Without this key a built-in list applies: format, diskpart, reg, net, sc, runas, netsh, takeown and others.

The terminal is not a folder sandbox. A PowerShell command runs with your Windows user's rights and can read anything you can. The bridge refuses commands that literally name an excluded folder, but that is a courtesy, not a boundary. If folder limits must be strict, pick the access preset Files or turn the terminal off with disabledTools.

  • The bridge runs as your user (a hidden scheduled task at sign-in), never as SYSTEM and without admin rights. The installer refuses to run in an Administrator window and always checks the package checksum, downloading only over https.
  • ChatGPT asks before actions that change things (unless you allow them for the whole chat); you can also turn on confirmations on the PC (a Windows notification) for risky actions such as deletions and system commands; read-only tools are marked as safe. Read what you confirm.
  • The bridge needs only outbound HTTPS/WSS to bridgerator.recondeck.com and mcp.bridgerator.recondeck.com — nothing else: ChatGPT can't read web addresses through Bridgerator (PDF reports are built locally on the PC, from your own text and tables).

Safety switches

Everything below is switched on or off in the Bridgerator window (Safety) or by asking ChatGPT. ChatGPT's changes apply at once; with “Ask before the AI changes settings” (Settings → This PC, off by default) on, turning protection off at its request waits for Apply on the PC. Only the protection of Bridgerator’s own folders can’t be switched off.

Recycle Bin instead of deleting

On by default. When ChatGPT deletes with a simple command (del, rd, Remove-Item, rm), the files go to the Recycle Bin. Where there is no Recycle Bin (network drives, many USB sticks), Bridgerator asks on the PC before deleting for good. A safety net, not a guarantee: scripts, pipelines and other programs that delete are not caught.

Snapshots and “Undo AI changes”

On by default. Before ChatGPT changes, moves or deletes a file, a copy is kept on this PC (by default 7 days, up to 500 MB; files over 50 MB get no copy). “Undo AI changes” in the window, or asking ChatGPT, puts files back — but never over a file someone changed after the AI did: that file is skipped and listed.

Protect sensitive folders

Off by default. Closes the Startup folder, PowerShell profiles, .ssh, .aws, .azure, .kube, .docker, .gnupg, .config, .claude, the files .npmrc, .git-credentials, .gitconfig and the whole ~\AppData to the file tools, and commands that name these folders directly are refused.

Pause on mass deletes or moves

Off by default. If ChatGPT deletes or moves more files within a minute than the limit (20 by default), Bridgerator pauses and asks on the PC whether to continue. No answer means it stays paused.

Access preset

Full by default: files and the terminal. Files: read and change files, the terminal is off. Read only: look and search, nothing can be changed, the terminal is off.

Confirmations and read-only folders

Off by default — details below. There is also “Keep this PC awake while ChatGPT works” (on, mains power only) — not a protection, it just keeps tasks from being cut off.

Agents (AI ↔ AI)

On once Claude Code, Codex or Gemini CLI is found on the PC; each agent can be switched off on the Agents page. ChatGPT hands the agent a task in one folder, on your own subscription, with a time limit (30 minutes) and a limit on tasks at once (2). Bridgerator only checks that the agent is signed in and never reads its credentials. The agent runs with your rights: only Codex’s sandbox keeps its changes inside the folder. A folder that contains Bridgerator’s own folders can’t be chosen, and the agent gets no Bridgerator tools, so it can’t hand the task on. Before a run the folder is copied (up to 200 MB), so “Undo” rolls the agent’s whole run back.

One question for a big job

With confirmations on, when a big job (say, moving 214 files) has steps that would ask, ChatGPT shows the whole plan: one question on the PC — Allow all, Review… (tick the items in the window) or Deny. The approval covers only the listed actions, for 30 minutes; after Deny a new plan can be proposed in 10 minutes.

Confirmations and read-only folders

Confirmation on the PC

Off by default; turn it on with bridgerator.cmd confirm on (off again: bridgerator.cmd confirm off). Then, before a risky action, a native Windows notification appears in the bottom-right corner: “Bridgerator — ChatGPT wants to…” with a short summary and the buttons Allow, Allow 10 min and Deny; “Allow always” is in the notification’s “…” menu (right-click). Closing it with X, or no answer within 2 minutes, means Deny. If notifications for Bridgerator are turned off in Windows, a small window appears in the bottom-right corner instead. “Allow always” turns off the check that triggered the request; bridgerator.cmd confirm on turns the checks back on. If Do Not Disturb (Focus) hides the notification, the request is denied automatically after 2 minutes. Nothing runs.

What it asks about

Each category can be switched on or off. On: delete (deleting files or folders) and dangerous_commands (commands that change the system: format, diskpart, bcdedit, reg add/delete HKLM, shutdown, icacls/takeown, net user, sc delete, schtasks /delete, Set-ExecutionPolicy, vssadmin delete). Off unless you switch them on: write_files, move, any_command (every terminal command), install (installing or updating programs) and scheduled_scripts (putting a script into Task Scheduler). Settings live in %APPDATA%\Bridgerator\confirm.ini: [confirm] (enabled, timeout_seconds), [ask] for the categories and [patterns] for extra patterns that always ask. The assistant can't edit this file: it is inside the always-excluded settings folder. Turning protection up applies at once, but the file can't lower protection by itself: if a change turns something off, or the file is deleted or broken, Bridgerator keeps the last settings and asks on the PC: “Bridgerator settings file changed: turn off …? Apply / Keep”. bridgerator.cmd confirm off asks the same way. Every turn-off shows a notification.

Honestly about the limits

The confirmation is a safety net against mistakes, not protection against code that already runs on the PC: such a program could click the buttons of a Windows notification. Our small fallback window only accepts real mouse and keyboard input, and its buttons work only after a short moment. Commands are matched against a list of patterns. A disguised or obfuscated command can slip through, so this is a safety net, like blockedCommands, not a security boundary. “Allow 10 min” skips the request for every checked action during those 10 minutes. The assistant can only ask for confirmations to be turned off (request_confirm_off) — only the person at the PC can approve that.

readOnlyDirectories

Folders where files can be read but not changed: write_file, edit_block, move_file (either side) and create_directory are refused. Set them in config.json, with bridgerator.cmd setup --read-only <folder> or bridgerator.cmd read-only add|remove <folder>. The terminal is not limited by this (a request for every command can be turned on with the any_command category).

The bridge's own commands

As a courtesy, the bridge refuses terminal commands that mention Bridgerator itself or its folders, even through variables like %APPDATA% or $env:APPDATA. ChatGPT's terminal starts in the first allowed folder and sees no Bridgerator variables. The bridge keeps no disk log of tool calls; the only record is the optional local history. This is not a boundary: once you allow a terminal command, it runs with your rights.

Settings through ChatGPT. ChatGPT can manage the same settings as the Bridgerator window: say Show my Bridgerator settings or ask it to change them. Changes apply at once, with no question on the PC. If you turn on “Ask before the AI changes settings” (Settings → This PC, off by default), changes that lower protection (turning it off, more folders, removing read-only folders, autostart, usage stats, local history) wait for Apply on the PC. Blocked commands and Bridgerator's own folders can't be changed this way.

Data

What we store

Your account (e-mail, password hash), the device list, the monthly call counter and the activity log: only tool names and times, kept 30 days, can be turned off on the account page. With Telegram connected, the chat id and language.

What we don't store

File contents and paths, search results, command text and output. They pass through the server in memory and are never written to disk or to logs: request logging is off on the server, and error logs carry only the error name.

Where results go

To ChatGPT, as tool results. From there OpenAI handles them under its own policies.

Telemetry

The bridge's built-in tools never send their own usage data; remote flags and pop-ups are turned off. The bridge itself sends minimal data — see Data collection.

Stored only on this PC, never sent to the server: the task queue (%APPDATA%\Bridgerator\queue.json) and the list of recent actions with their command or path. That list is kept in memory; it is written to recent.jsonl only if “Keep a local history” is on, and kept for 7 days. Both live in the settings folder, which the assistant's file tools can never reach. The activity log in your account still holds only tool names and times.

Data collection

The bridge sends to https://bridgerator.recondeck.com/t, over HTTPS (TLS), an event on install, update and uninstall, and a daily heartbeat. Only these fields: a random install id (stored in the local config), the bridge version, Windows version, OS language, Node.js version and, in the heartbeat, per-tool call and error counts for the last 24 hours. Never: paths, file names, command text, arguments, outputs, your account e-mail or IP-derived data. Network failures are silently ignored.

To turn it off: bridgerator.cmd telemetry off (on again: bridgerator.cmd telemetry on), or "telemetryEnabled": false in config.json, or install with the -NoTelemetry switch.

Telegram notifications

Optional. Connect it on your account page → Settings → Connect Telegram: our bot @BridgeratorBot opens, press Start. It tells you when the task queue is finished, when a task or a scheduled job failed, when a task handed to another AI on the PC ended, and when a computer has been offline for more than 30 minutes; each notification can be turned off. Messages carry only the computer name, counts and statuses — never task text, paths, files or command output. Bot commands: /status, /stop, /help. To disconnect, press Disconnect on the account page or send /stop to the bot.

In full in the privacy policy.

Check it yourself

The bridge is open source under the MIT license. Before installing you can read install.ps1, download the package and compare it with the source on npm. The folder-exclusion logic is in src/policy.mjs.

bridgerator.exe and our PowerShell scripts, install.ps1 included, are signed with the code-signing certificate of SoftInnovaticsPlus LLC, with a timestamp: right-click the file → Properties → Digital Signatures. The installer downloads the app only from bridgerator.recondeck.com over https and checks the SHA256 of the download and of every file before anything runs.

The relay server forwards calls over TLS and does not store tool arguments or results — only the account, the list of computers, the call counter and (if turned on) an activity log of time, computer, tool and result. The running server version is at /version.

Found a vulnerability? Email info@recondeck.com with the subject “Bridgerator security” — we handle these first.

Recommendations

  • Allow only the folders you need, not the whole disk.
  • If ChatGPT doesn't need AppData, .ssh and Startup, turn on “Protect sensitive folders”; add your own folders with passwords, keys and personal documents to the exclusions.
  • Keep the Recycle Bin and “Undo AI changes” on — they block nothing, but let you roll a mistake back.
  • If you don't need the terminal, turn it off.
  • Read confirmation prompts and ask the assistant to show its plan first.
  • Never share your device key or password — we will never ask for them.