Connect your own MCP server to ChatGPT

Use ChatGPT on the web for this setup. Eligible users need the relevant account, plan, role, surface and rollout access. In a managed workspace, check the effective plugin permissions, including Create plugins with MCPs. A missing control can be an access restriction rather than a server fault. Lockdown and other security restrictions still apply. Plugin controls.

The direct guide starts in Plugins. It does not tell you to enable Developer Mode first. By contrast, the Developer mode and MCP apps Help article describes workspace/private app development and full-MCP access for Business, Enterprise and Edu. Preserve that distinction: it is not evidence that every ChatGPT user can create every kind of MCP connection.

This page assumes you already operate or trust a server. If you want a Site to provide the backend instead, use ChatGPT Sites hosted plugins. Optional UI belongs in Plugin Extensions.

The current custom-MCP guide lists SSE and streaming HTTP. For a public service, check its actual HTTPS MCP endpoint, commonly ending in /mcp. An ordinary website URL is not enough. Supported transports; connection checks.

Do not paste a stdio launch command into Server URL. For a private or local service, Secure MCP Tunnel forwards requests from a host that can already reach the server over stdio or HTTP. The server can remain inside its network. This is a supported private connection route, not an instruction to expose your machine publicly.

Tunnel setup has separate prerequisites: a Platform tunnel ID, a runtime API key for the tunnel client, and the correct organization/workspace association. Tunnel creation needs Tunnels Read + Manage; using it needs Tunnels Read + Use. These Platform roles do not grant ChatGPT workspace permission. Check both with the appropriate administrators. Official tunnel documentation.

Before connecting, inspect transport initialization, schemas and authentication with your server's existing test setup. A reachable URL or healthy tunnel does not prove a tool succeeded. This review did not start a tunnel or connect a server.

Follow the current connection instructions:

1. Open ChatGPT web → Plugins.
2. Choose the plus button, then Add custom MCP server.
3. Enter a recognizable name and an optional description.
4. Under Connection, supply Server URL, or select Tunnel and choose an available Secure MCP Tunnel or its tunnel_id.
5. Configure authentication for the server.
6. Read the elevated-risk warning and acknowledge it only if you trust the server.
7. Select Create as a plugin.
8. Find the resulting plugin in your personal plugins or the workspace where you created it. Inspect its tools, then Install.
9. Open a conversation, type @, select the plugin, and request one narrow operation.
10. Inspect the actual tool result before relying on the answer.

Editorial first test — not executed: ask your plugin to read one known sample record and return its identifier and status. Compare both with the source system. If no tool ran, the plugin card and the assistant's prose are not a completed integration test.

Select OAuth for tools that need access to a user's protected provider data. Use No authentication only where the server deliberately exposes a suitable unauthenticated capability. OAuth or no authentication is the mixed option: initialization and tool discovery are unauthenticated, while individual tools follow their declared security schemes. Custom-MCP options; authentication design.

The documented OAuth registration choices include supplied static credentials, CIMD when advertised by the authorization server and selected by the creator, or configured DCR. CIMD supports a public client using none and signed client assertions using private_key_jwt. Choose the method your authorization server actually implements; a label in the form cannot supply missing server support. OAuth details.

Install is not provider authorization. Complete the requested provider sign-in when connecting or when a protected tool needs it. Verify the intended account/workspace and requested scopes before consenting. Shared plugin access does not let recipients borrow your provider identity. Review and disconnect unwanted connections through the account controls. Connection management.

Open the app's details/settings to inspect its advertised tools and toggle tools on or off. After the server adds or changes tools, descriptions or instructions, refresh the connection rather than assuming real-time discovery. Tool management.

For a direct custom connection: deploy or restart the server, open it under Plugins, select Refresh, verify the metadata changed, then start a new conversation for affected tests. Include changed schemas, annotations, authentication and UI resources in that check. Refresh procedure.

This is different from the owner publishing an updated Site-hosted plugin. Do not substitute Refresh for a Site publication or assume a local code edit updated a remote server.

Custom MCP supports read and write tools. search/fetch are not required. For write actions, confirmation is the default. Inspect the expanded JSON input and output, including the target record and account. ChatGPT uses readOnlyHint for read-only detection; a tool without that hint is treated as a write action. An annotation describes behavior—it is not an authorization grant. Custom-MCP action rules.

A remembered approve/deny choice applies to a particular tool in the current conversation. New conversations prompt again. Refreshing the same conversation also restores confirmation on subsequent turns. This is not permanent global approval. Do not remember approval for writes you do not trust. Confirmation scope.

App action permissions and organization rules are additional controls. A provider may limit the account or scopes available; a workspace can restrict access. A successful sign-in does not override those restrictions. App permissions.

Editorial verification example — not run: first read a sample inventory item. For an authorized write, review its exact ID and proposed inspection date, approve only that intended change, then check the item in the inventory system. A successful HTTP response, a plugin install and a real changed record are different observations.

Only connect trusted MCP servers. External results and tool descriptions can contain prompt injection; a malicious server can steer tool use or try to exfiltrate information. Writes can alter, delete or unexpectedly share data. Wrong-account authorization can expose the wrong workspace even when the endpoint is legitimate. Keep credentials out of prompts and use the narrowest useful data access. OpenAI security guidance.

AgentSkillsHub editorial checklist:

1. Verify the server operator and its current ownership.
2. Inspect the exact endpoint or tunnel target.
3. Read the discovered tool names, descriptions and inputs.
4. Mark which tools read data and which change it.
5. Test a read before considering a write.
6. Use sample data that you are allowed to expose.
7. Inspect JSON input/output, including account and record identifiers.
8. Verify an authorized write in the external system.
9. Avoid remembered approval for untrusted writes.
10. Revoke authorization if ownership or behavior changes unexpectedly.

These are editorial checks, not a security certification. For a broader review, see the MCP server security checklist.

Choose by where the tools run and who should use them. These routes can overlap: a workspace-created app can point to an externally hosted server. They are not four interchangeable permission tiers.

The comparison combines Plugins, Sites hosting, workspace MCP development and the direct connection guide. A Site owner publishing creates or updates the associated plugin; directly connecting your own endpoint does not move it into a Site.

No Add custom MCP server control: verify the web surface, account eligibility, workspace role and security restrictions. Do not work around a managed restriction with another account.

Connection fails: distinguish an incorrect endpoint, incompatible transport, unreachable tunnel target and failed authentication. For a tunnel, check workspace association and client readiness. For a public endpoint, check MCP initialization and discovery. Connection diagnostics.

Plugin exists but cannot read protected data: check installation and the intended provider connection separately. Tool missing after an update: check the deployed server, Refresh and the advertised tool list. Unexpected approval: inspect the read-only annotation, operation and applicable app policy.

Tool ran but the answer is wrong: compare JSON inputs and outputs with a known record. Fix the underlying tool or metadata and rerun a small evaluation set. Do not treat a polished answer as evidence of a successful external operation.