Is ALL malicious, or does it steal data?

The short answer

This is not a line to calm you down: each point below has what backs it and its limit. One limit is worth knowing right away: what ChatGPT reads, OpenAI sees, like everything you type into ChatGPT, because it is the other end. With ALL 2.0, what ChatGPT does on your computer travels end-to-end encrypted and the key lives on your computer: ALL does not read your content (how it works and its limits).

ALL is powerful by design: it works on the whole disk, without asking for confirmation at every step. Here “safe” does not mean “no risk”: no tool that controls a computer can promise that. It means that ALL is not made to harm or spy on you, and that you have controls to stop it, limit it and remove it.

Is it recommended to install ALL 2.0.0?

Yes. ALL 2.0 is the recommended version for people who want ChatGPT to work on their own computer. We say so as the makers of ALL, so each reason is something you can check:

• Tested before publishing. In our own tests before publishing it, ALL 2.0.0 was installed from scratch, paused in the middle of a task, showed what it did and undid it, refused at least 30 distinct attempts to reach a private folder (every one refused or harmless) and uninstalled leaving nothing behind. We did it on a Mac and on virtual machines running Windows, Ubuntu and Debian. They are our own tests.
• The controls are yours. The ALL icon, a pause that ChatGPT cannot resume, “what ALL did today” with undo, optional private folders and masked secrets (best effort, not a guarantee), each with its limits in What you control.
• Signed updates, with two keys. ALL 2.0 installs an update only if its signature is valid for one of the two keys it carries. In the same tests a signed update was accepted and unsigned, foreign-signed and altered ones were refused. The exceptions are in When ALL acts.
• One command removes it. A single command (or the uninstaller on your license page) removes ALL and frees that computer’s seat: How to remove it completely.

Recommended does not mean “no risk”: ALL is powerful by design and has the limits further down. Make a copy of what matters before you start, and read When not to install it.

When not to install it

ALL is not for everyone. Better not to install it if:

• It is a work or school computer and your IT department has not given you permission. ALL works on the whole disk and connects to the internet: whoever administers that computer decides that.
• You are not comfortable with OpenAI seeing what ChatGPT reads. That is true of everything you type into ChatGPT, and with ALL it includes what ChatGPT reads from your computer.
• You want an assistant that cannot act on your computer at all. ALL exists precisely so that ChatGPT can.

If you are unsure, make a copy of what matters, mark as private the folders you do not want it to touch (how) and read Who sees what.

What ALL is, and why ChatGPT says “custom MCP server”

ALL is a program for Mac, Windows and Linux. It lets ChatGPT work with your files, the terminal and your apps from the chat you already use. It is made by Fynory LLC and it is independent: it is not affiliated with OpenAI.

ChatGPT connects to ALL with the “Create custom MCP server” option. That is ChatGPT’s name for every connector that does not come from its store. It is not a verdict on ALL. The risk warning it shows is the same for any custom connector.

Some AI assistants read that label and assume the program is malicious. The label only says where the connector comes from. What is true, and the reason for the controls below, is that ALL has a lot of power over your computer.

When ALL acts

ALL does not take the initiative with your files or your programs. It works when ChatGPT, in a conversation of yours, asks it to use one of its tools. What you asked it to leave running, for example a long job, goes on until it ends or until you pause it.

Besides keeping its connection open, ALL does only three things on its own:

• A health signal about every 6 hours: the ALL version, the system (macOS, Windows or Linux), whether it is healthy and a few numbers (operations finished today, jobs running, estimated tokens). Never file names, paths, commands or text: the control server refuses any other field.
• Looking for updates once a day. If your plan includes them, it downloads them, checks their SHA-256 fingerprint and their signature, and installs them when it is not busy. ALL 2.0 carries two public keys, and an update is valid if either one verifies its signature; an update without a valid signature is not installed. The signature covers what ALL installs by itself: on Linux with ALL as a system service, and when you run the installer by hand (a first install or a reinstall), only the SHA-256 fingerprint the site publishes is checked. If the new version fails, it goes back to the previous one by itself. You can turn this off: ask ChatGPT, which asks you to confirm first.
• The ALL icon (Mac and Windows, from ALL 2.0) asks about every two minutes whether ChatGPT can reach your computer. The request carries no credential and no content.

All of this, row by row: Who sees what.

What ALL does not do

• It does not copy your disk. No file goes up by itself. Only what ChatGPT asks for in a task, and ALL returns, leaves your computer.
• It does not keep the content of your work on its servers. ALL has no place where it could be stored and its request logging is off. Your action history and the undo copies stay on your computer. The exceptions are in Who sees what: for example, a file you move between your computers is kept encrypted for up to 24 hours, and the screenshots of visual tasks go to Cloudflare Workers AI.
• It does not sell your data.
• ALL’s team does not review what you do with ALL.
• It shows no ads.
• It does not watch your screen or your keyboard on its own. It looks at the screen only when a task you asked for needs it.
• It does not ask for your ChatGPT account password. The connection is approved with a code that your own computer shows.
• It installs nothing in secret. What it installs is in the list What runs on your computer, and the uninstaller removes it.

What you control (from ALL 2.0)

These controls are part of ALL 2.0. A Lifetime without updates does not include them.

• Pause. Press Pause ALL in the ALL icon (Mac and Windows) or, for that computer, on your license page; or tell ChatGPT “pause ALL”; or use a command on the computer. ALL stops what it launched: commands, terminals, jobs and the programs its commands left running. It does not stop programs you opened yourself or the development servers ALL started with process_start: it is a stop button, not a lock. To resume: ChatGPT has no tool that resumes ALL; you resume it, from the icon, from your license page or on the computer itself. How to do it.
• The ALL icon (Mac and Windows). It lives in the menu bar or the system tray: it is the ALL logo, with a small mark (a dot or two bars) that says how ALL is doing: running with ChatGPT authorized, starting or updating, paused, or not answering. It runs no ALL tools and its windows are served by your own computer. On Linux there is no icon: the same things are done with commands. How it works.
• What ALL did today. Ask ChatGPT “what did you do today?” or open the icon’s window: the files ALL changed (and which can be undone), the commands it ran, jobs and pauses, built on your computer from what it keeps. It covers ALL’s own file and terminal tools, not what other programs did afterwards and not clicks and typing on the screen.
• Undo. Tell ChatGPT “undo that”. ALL copies files before changing them (7 days, up to 2 GB) and can also undo commands inside a small working folder. It does not cover everything, for example a git push or what a program ALL opened does: keep your own backups.
• Private folders (optional). Mark the folders ALL must not touch: it does not read them, write in them, list them or run commands in them. A terminal command that names one is refused; on Mac and Linux the system also blocks it, and on Windows the check is on the command’s text. Screenshots show whatever is on screen and programs ALL opens are not limited. ALL’s file and terminal tools cannot change the list: you change it, on your computer, from the icon’s menu or with a command. What it covers and what it does not.
• Masked secrets. The passwords, keys and tokens ALL recognizes are replaced by ***MASKED*** before they go back to ChatGPT. It is best effort, not a guarantee; and if you ask ChatGPT to show them, ALL does not check that you were the one who asked.
• Cutting the access. On your license page, the “Remove” button of a computer; on your activity page, “Disconnect ChatGPT from this computer”.

What runs on your computer, and how to see it

This is everything ALL leaves running on your computer:

• The agent: ALL’s program, which does the work. It only listens inside your own computer (127.0.0.1) and opens no port toward your network.
• The tunnel: a connection that goes out from your computer to ALL’s servers so that ChatGPT can reach it. It is outbound only.
• Super Admin: a helper with administrator rights, for the tasks that need them. It only accepts orders from ALL’s agent in your own account. It is installed with your administrator approval, and the uninstaller removes it. It is the most powerful piece of ALL, which is why we say so here.
• On Mac, the ALL Access Computer app: the one that receives the macOS permissions (Accessibility, Screen Recording and Full Disk Access). It is signed with an Apple Developer ID certificate and notarized by Apple, and the installer checks that before installing it. That applies only to this app: the rest of ALL (its Python code, the installer files and the icon) is not notarized by Apple.
• The ALL icon (Mac and Windows, from ALL 2.0), explained above.

Where its files live: in an ordinary folder of your user (Mac: ~/Library/Application Support/all-mcp; Windows: %LOCALAPPDATA%\all-mcp; Linux: ~/.local/share/all-mcp), and its history in another private folder of your user. To see what is running, use your system’s own tools: Activity Monitor on Mac, Task Manager on Windows, ps on Linux. And before installing you can read the install script at all-mcp.fyi/install.sh.

How to remove it completely

One command removes it. On Mac or Linux:

curl -fsSL https://all-mcp.fyi/uninstall | sh

On Windows (PowerShell):

irm https://all-mcp.fyi/uninstall.ps1 | iex

There is also a downloadable uninstaller on your license page. It stops ALL and removes its services and files, the Super Admin helper, the icon’s automatic start and, on Mac, the ALL Access Computer app. On Mac it also asks macOS to forget the permissions you gave that app (Accessibility, Screen Recording and Full Disk Access), and if macOS does not let it, it tells you and shows how to remove them by hand in System Settings (on Mac it asks for your administrator password once). It also deletes ALL’s private folder: the history, the undo copies and the list of private folders. And it frees that computer’s seat on your license.

In our release tests on test machines with Mac, Windows and Linux, we compared the computer before installing ALL and after uninstalling it (files, services and processes) and nothing of ALL was left. Removing ALL does not delete what ChatGPT already received, and it is worth deleting ALL in ChatGPT too (chatgpt.com/plugins). On Windows, if another account on the same computer also uses ALL, the uninstaller leaves what that account needs. Details.

Who makes ALL and how

• The company: Fynory LLC is the commercial operator of ALL. It is an independent product: not affiliated with, endorsed by or sponsored by OpenAI.
• Contact: support@all-mcp.fyi. To report a security problem, write with the subject “ALL Security” and without credentials or documents.
• Payments: Stripe processes them. ALL does not receive or store your full card number.

How it is built. ALL is developed by Fynory LLC with the help of artificial intelligence tools from OpenAI and Anthropic. Those companies’ usage policies (OpenAI, Anthropic) forbid using their AI to create malicious software, and they enforce them: they can suspend or close accounts that try. This is not a certification of ALL, which is why this page shows, with evidence, what ALL does and does not do.

This is about how ALL is developed, not about what it uses when it works. When you use it, ChatGPT (OpenAI’s) is the other end of the conversation, and visual tasks and the automatic diagnosis and repair of errors (Todito) use Cloudflare Workers AI, as Privacy and Who sees what say.

What ChatGPT, OpenAI and ALL’s servers do see

These are the limits, said plainly:

• ChatGPT and OpenAI see what ALL returns to the conversation: paths, file excerpts, command results, screenshots. OpenAI handles it under its own policy, not ALL’s.
• ALL’s tunnel (the node that ChatGPT’s connection goes through to reach your computer) and its provider see the passing IP address, your computer’s name, sizes and times; they do not see the content, which is end-to-end encrypted. ALL’s code has no place where the content is stored and its request logging is off, but Cloudflare, where it runs, keeps its own operational records under its own policies, and ALL does not audit them.
• The pause stops what ALL launched, not what other programs do. Private folders have limits: on Windows the check is only on the command’s text, and screenshots and the programs ALL opens are not covered.
• Masked secrets are best effort, not a guarantee.
• The source code is not published.

Where to check it

• Who sees what: a table with each piece of data and who sees it.
• The verified results.
• Privacy and Security: the reference texts.
• In the guide: pause and what ALL did, private folders, the icon and uninstalling.
• Security: how end-to-end encryption works, how it was measured and its limits.

Checked against the ALL 2.0 code on October 27, 2026. If anything here differs from the Privacy Policy, the policy prevails.