ChatGPT connectors: adding a remote MCP server, and what it can do

A ChatGPT connector is a remote MCP server that ChatGPT calls mid-conversation. You add one in a browser at chatgpt.com/plugins, with the plus button and Add custom MCP server. It needs a paid ChatGPT plan, an HTTPS endpoint ending in /mcp, and OAuth. Here is the whole flow, checked on November 11, 2026.

What a ChatGPT connector actually is

A connector is not an app you install inside ChatGPT. It is a server you run somewhere else, reachable over HTTPS, that answers the Model Context Protocol. ChatGPT asks it for a tool list, then calls those tools when your prompt needs them. The server holds the credentials for whatever it talks to, so ChatGPT never sees your Instagram token or your database password.

Three things follow from that, and they explain most of the confusion around connectors:

• The server has to be online and public. A local process on your laptop is not reachable from OpenAI's infrastructure.
• Authentication belongs to the server, not to ChatGPT. The chat window only carries the token the server handed it.
• Tool quality is your problem. OpenAI's own documentation is blunt about it: "custom MCP servers are not developed or verified by OpenAI."

chatgpt mcp: what the protocol changed

The old plugin era asked you to publish an OpenAPI description and get it listed. MCP replaced that with one endpoint and a handshake. The server declares its tools, their input schemas, and safety hints at connection time, and it can add a tool next week without you touching anything in ChatGPT.

That matters for agents more than for chat. A tool list that arrives at runtime is a tool list an agent can discover, which is the whole argument in MCP or REST API for your agent. The cost is that the model now reads text your server returns, and that text can try to steer it. OpenAI names prompt injection as the main risk and warns against putting sensitive information in tool JSON.

How to add a custom MCP server to ChatGPT

The steps below are OpenAI's own, from the connect to ChatGPT guide I read on November 11, 2026:

1. Go to chatgpt.com/plugins. In a browser. The mobile and desktop apps have no screen for this.
2. Select the plus button, then Add custom MCP server.
3. Enter a user-facing name and description. Both show up in the connector list, so write the description for whoever else uses the workspace.
4. Under Connection, paste the server URL including the /mcp path. A Secure MCP Tunnel is the other option while you develop, by tunnel or tunnel_id.
5. Configure authentication, read the risk warning, and select I understand and want to continue.
6. Select Create as a plugin.
7. Review the tools and metadata discovered from the server.

Step 7 is the one worth slowing down on. If the tool list comes back empty or short, the handshake worked but discovery did not, and the usual causes are a server that answers / instead of /mcp, a redirect in front of it, or an auth scheme the client did not complete.

Developer mode used to be part of this. It is not required any more, and a paid ChatGPT plan is: Plus, Pro, Business, Enterprise or Edu, per the PlugKit client docs checked the same day.

The two tools ChatGPT demands: search and fetch

This is the requirement that surprises people building their first server. For company knowledge and deep research, ChatGPT expects two read-only tools with fixed names:

Citations hang off that url. OpenAI states it plainly: "ChatGPT creates citation metadata only when url is a non-empty string." A result with an empty URL still works as tool output, it just never becomes a footnote in the answer.

A server that only exposes action tools will connect and run fine for commands. It will be weak at research, because the model has no cheap way to look around first. PlugKit ships both as read-only tools alongside its 103 action tools, which is why it answers "which of my posts did best last month" as well as "post this".

OAuth, and the fields you leave empty

Three token exchange paths work today, in descending order of how little setup they need:

With either of the first two, you pick OAuth in the dialog and leave client id and client secret blank. That is not a shortcut, it is the design: the server registers ChatGPT as a client on the fly and hands back a token scoped to the user who just approved the consent screen. If you are building the server side of this, the failure modes are in MCP server OAuth.

An API key in a header is simpler and worse. Keys usually carry full access with no scopes, and nothing about the connection tells you which human is on the other end.

What a connector can do, and what ChatGPT still blocks

Reads are free-flowing. Once connected, ChatGPT will call your read tools without asking, which is the point. Writes are not, and no setting changes that in the chat product: "ChatGPT currently requires manual confirmation in any conversation before write actions can be taken."

So a connector that publishes, sends a message or deletes something will stop and wait for a click every time. For a human at a keyboard that is correct behaviour. For a scheduled job it is a wall, and the answer is the API rather than the chat window: in the Responses API you set require_approval per tool, never for search and fetch, on for anything consequential.

Set your annotations honestly while you are there. readOnlyHint belongs on tools that cannot change state, destructiveHint on anything hard to undo. ChatGPT uses them to decide how loudly to ask, and OpenAI is clear that they "do not replace authorization, validation, or confirmation in your server."

A worked example: social accounts in ChatGPT

PlugKit is a hosted MCP server at https://api.plugkit.co/mcp over Streamable HTTP, so it is a connector with nothing to deploy. Name it PlugKit, paste the URL, pick OAuth, leave the client fields empty, approve the consent screen, and choose read-only or full access there.

What arrives is 103 tools and 3 workflows (publish, inbox, report) across Instagram, Facebook, LinkedIn, TikTok, YouTube, X, WhatsApp and Telegram. Scopes are coarse but useful: mcp:read covers profiles, accounts, posts, conversations and analytics, mcp:write adds publishing, replies and account connection. Start on read for a week.

ChatGPT will then answer "what did my last five Instagram posts get" without a click, and ask before it posts. The rest of the social side, what the model can and cannot decide on its own, is in ChatGPT social media automation; the same mechanics on Anthropic's side are in Claude as your social media manager. PlugKit is $49 a month for 5 connected accounts, cancel anytime, or $97 for 30, with 7 days free and a card asked at sign-up.

FAQ

How do I add a custom MCP server to ChatGPT?

In a browser, go to chatgpt.com/plugins, click the plus button, choose Add custom MCP server, give it a name and description, paste the server URL ending in /mcp, configure authentication, accept the risk warning, then Create as a plugin. The last screen shows the tools discovered from the server.

Do ChatGPT connectors still need developer mode?

No. Developer mode was the route during the earlier rollout and is no longer needed. What you do need is a paid plan: Plus, Pro, Business, Enterprise or Edu. Workspace policies still apply, so on a Business or Enterprise account an admin can block custom servers entirely.

Why does my connector have no tools after it connects?

Discovery ran and came back empty. Check that the URL includes /mcp and answers there directly rather than through a redirect, that the OAuth flow finished, and that your server lists tools on the initialize handshake. A tunnel URL that expired when you closed the editor looks the same from inside ChatGPT.

Can a ChatGPT connector post for me automatically?

Not in the chat window. ChatGPT requires manual confirmation before any write action, in every conversation, so a human clicks each time. For unattended publishing, call the same MCP server from the Responses API with require_approval set per tool, or call the underlying REST API directly.

What is the difference between a connector and an MCP server?

None, in practice. The server is the thing you run; the connector is what ChatGPT calls the entry it keeps for that server, with its name, description, authentication and discovered tool list. One server can be a connector in ChatGPT, Claude, Cursor and VS Code at the same time.

AB

Antoine BlancoFounder of PlugKit. Runs his own Instagram, YouTube and X accounts through the API and MCP server described here.