Disclosure: I make Bridgerator, the tool this post is about. I'll stick to what it actually does and say where its limits are.

If you let an AI app work with files on your own Windows PC, the useful question is not "is it safe?" but "what happens when the AI makes a mistake?". Models misread instructions, rename the wrong folder or run a command you did not expect. Here is a short checklist of the settings that matter, using Bridgerator (an MCP bridge for ChatGPT, Claude, Codex, Cursor and other MCP apps) as the example. Most of it applies to any local MCP server.

1. Know the default

Bridgerator's defaults restrict nothing, like similar tools: with no folder list, the AI may work in every folder, except Bridgerator's own settings folders, which are always closed. If that is more access than you want, change it before the first real task, not after.

2. Limit the folders

Set an allowed-folders list, so the AI can only touch, say, D:\Projects and Documents\Invoices. Add read-only folders for things it may read but never change. There is also a "Protect sensitive folders" switch that closes .ssh, .aws, .kube, .gnupg, PowerShell profiles, the Startup folder and AppData. It is off by default.

3. Pick an access preset

Three presets: Read only, Files, Full. Read only and Files turn the terminal off, which is the single biggest reduction in risk: a terminal runs with your Windows user's rights, and it is not a folder sandbox.

4. Make deletes recoverable

Two things are on by default. Deletes done with simple commands (del, rd, Remove-Item, rm) go to the Recycle Bin. And before the AI changes, moves or deletes a file, a copy is kept for 7 days (up to 500 MB; files over 50 MB are not copied), so "Undo AI changes" can put files back, never over a file someone changed afterwards. Honest limit: scripts and other programs that delete are not caught.

5. Turn on confirmations for the risky parts

Optional confirmations show a native Windows notification with Allow / Allow 10 min / Deny. No answer in two minutes means Deny. You choose categories: delete and dangerous commands are on when you enable it, write, move and any command are off. There is also a pause on mass deletes or moves (more than 20 in a minute). It is a safety net against mistakes, not a boundary against malware already running on the PC.

6. Check what leaves the machine

The bridge makes an outbound connection only, so there are no inbound ports to open. Traffic is encrypted in transit, but not end-to-end, because the server has to route calls. The server stores the account, the device list, a monthly call counter and an activity log of tool names and times (30 days). It does not store file contents, paths or command output.

7. Verify the installer

The installer refuses to run in an Administrator window, checks the SHA256 of the download and of every file, and uses https only. The Windows app and scripts are signed. How to verify: https://bridgerator.com/security

Summary

For a first week: allowed folders + Protect sensitive folders + confirmations for delete, then loosen what gets annoying. Full details and the install command are at https://bridgerator.com. The bridge on the PC is open source (npm bridgerator, mirror https://github.com/s-lexer/Bridgerator).