TheHalfMoon/Aladdin

Brand identity and downloadable design kit
**Computer Orchestration & Trusted Runtime Access**
Orcel is an open-source, local-first MCP gateway that lets ChatGPT work with an explicitly trusted folder on your Windows computer through a small set of bounded tools, with local approval for anything that changes your computer. It connects through the OpenAI Secure MCP Tunnel, so no inbound port is opened on your machine.
Orcel is not a remote shell, a remote desktop, or a "run anything" agent.
> **Identity migration:** Orcel is the current product and repository name. Older client installations, credentials, and state are not automatically migrated to the newly named CLI, packages, or environment variables. See the Orcel identity record before upgrading.
**Website:** https://thehalfmoon.github.io/Orcel/
**Canonical releases:** https://github.com/TheHalfMoon/Orcel/releases
What ChatGPT can do through Orcel
Exactly these 31 tools are exposed over local MCP:
| Area | Tools | Approval |
|---|---|---|
| Status | system_status, workspace_get | none (read-only) |
| Files in a trusted workspace | fs_stat, fs_list, fs_read, fs_read_range, fs_search, fs_find | none (read-only, bounded) |
| File writes | fs_write_preview, fs_write, fs_edit, fs_mkdir, fs_move | local approval for each write, bound to the exact content and current file hash |
| File removal | fs_remove | Windows Hello (STRONG), single files or empty directories only |
| Desktop observation | desktop_window_list, desktop_window_tree | none (read-only, bounded, local-only) |
| Clipboard | clipboard_read, clipboard_write | local approval for each use; secrets refused; local-only |
| Network | web_fetch | local approval per destination; public HTTPS only; local-only |
| Git (local) | git_status, git_diff, git_log | none (read-only) |
| Git (local changes) | git_branch_create, git_stage, git_unstage, git_commit | local approval, bound to the exact repository state |
| Git (network) | git_fetch_preview, git_fetch, git_push_preview, git_push | local approval; see limitations |
| Processes | process_spawn | local approval; see limitations |
Everything else is denied. Remote clients (ChatGPT through the tunnel or relay, and other providers) see only the 26-tool core profile: desktop observation, clipboard, and network fetch are local-only and cannot be reached remotely. Browser automation, screenshots, coordinate input, and UI actuation remain unreachable over MCP entirely.
Current limitations
- process_spawn on Windows launches only locally registered, hash-pinned native executables with constrained argv; adding or changing a registry entry requires Windows Hello on the machine.
- git_fetch and git_push require destination policies that the current compatibility runtime does not configure yet, so they fail closed in an installed Orcel runtime.
- Release binaries are not code-signed (there is no paid certificate under the project's zero-cost rule). Windows SmartScreen may warn; verify the archive with SHA256SUMS.txt and the GitHub build-provenance attestation.
- Orcel runs only while you are signed in, because approvals appear on your desktop.
How approvals work
- **SOFT approval** — a Orcel dialog appears on your desktop describing the exact action (for example, the file and content hash). Approve or deny it yourself. Each approval is used once, expires quickly, and is bound to that exact action, workspace, and policy.
- **STRONG approval** — Windows Hello (PIN, fingerprint, or face) for trust changes and emergency revoke.
- ChatGPT cannot approve its own actions: approvals come only from the local broker, and Orcel's own windows are excluded from automation.
- orcel approvals lists recent decisions; orcel emergency-revoke invalidates every pending approval.