They can inspect a repository, trace bugs across multiple files, suggest architectural changes, write tests, and increasingly implement entire features.
understand the project structure; read source files; search for symbols or patterns; trace how components interact; identify bugs; review a proposed implementation.
executing shell commands; running Git; launching processes; reading arbitrary filesystem locations; modifying arbitrary files.
Review the authentication implementation and tell me if you see any security issues.
run arbitrary commands read my entire home directory inspect unrelated projects modify source files access credentials delete files
But developer tooling often treats repository access and machine access as almost the same thing.
If I am using one model as a reviewer, its permissions should reflect the role of a reviewer.
✗ execute shell commands ✗ run Git ✗ launch processes ✗ read outside the repository ✗ arbitrarily modify source code
"Do I trust this AI to inspect this repository through these specific operations?"
RepoRelay is an MCP server that sits between an AI client and a local repository.
AI / ChatGPT ↓ Secure MCP connection ↓ RepoRelay ↓ one explicitly approved repository
Instead of exposing a general-purpose shell or filesystem API, RepoRelay exposes a deliberately small set of repository operations.
.. traversal; absolute paths; path canonicalization; symbolic links; junctions and reparse points; hard links; sensitive files; hidden credential locations; bounded reads and searches.
RepoRelay therefore treats containment as an enforced security property rather than a prompt instruction.
The server is supposed to make leaving the folder impossible through the tools it exposes.
Even inside an approved repository, there are files I usually don't want an AI reviewer reading.
A repository may also contain credentials, private keys, or other sensitive material.
RepoRelay blocks classes of sensitive paths separately from the repository-root boundary.