ChatGPT MCP: How to Add a Custom MCP Server

To add an MCP server to ChatGPT, open chatgpt.com/plugins on the web, select the plus button, choose Add custom MCP server, enter the server URL and authentication, accept the risk warning, select Create as a plugin, and install it. Full MCP support, including write actions, is limited to Business and Enterprise/Edu workspaces; Pro accounts can connect servers with read and fetch permissions only.

ChatGPT has renamed this feature twice since December 2025, and most guides still describe an older menu. Every click path below comes from OpenAI's custom MCP server guide and the help center article Connecting custom MCP servers in ChatGPT, as of October 2026. If your screen differs, check those two pages first.

What changed in 2026

If a guide tells you to open Settings, find Connectors and switch on Developer mode, it predates these changes:

• December 2025: connectors were renamed apps, and the directory started listing them that way.
• July 9, 2026: the ChatGPT release notes record that the App Directory was replaced by the Plugin Directory. Existing app connections kept working.
• Now: the help center says you add a custom MCP server directly from Plugins, with no need to switch on Developer Mode first. You acknowledge a risk warning for each server instead.

The old Settings > Apps > Create path still exists in the help center under "Legacy custom app configuration". If your Settings shows Apps rather than Plugins, your account may still be on that experience.

A plugin, in OpenAI's terms, is a package that can hold apps, skills or both (Plugins in ChatGPT). When you add a custom MCP server, ChatGPT wraps it in a plugin you then install. If MCP itself is new to you, start with what MCP is and how it works.

Who can add a custom MCP server

Plan rules are the most common reason the option is missing. This is what the help center states as of October 2026:

Two more limits apply to every plan. Custom MCP servers are web only; the help center says you cannot connect them from the mobile apps. And ChatGPT does not connect to local servers directly; more on that below.

What your server needs

ChatGPT connects from OpenAI's side, so the server has to meet a few conditions before the form will accept it:

• A public HTTPS endpoint. If the server runs on a private network or your laptop, use a Secure MCP Tunnel: a tunnel-client process inside your network makes outbound connections to OpenAI, so you open no inbound ports.
• A supported transport. The guide lists SSE and streaming HTTP. A stdio-only server needs to be hosted or tunneled first.
• A supported auth mode. The options are OAuth, No authentication, and OAuth or no authentication. For OAuth, ChatGPT can use static client credentials, a Client ID Metadata Document or Dynamic Client Registration.
• Refresh tokens, if you use OAuth. The help center warns that without offline_access (or your provider's equivalent), ChatGPT may lose access when the first token expires and users will have to sign in again.

What is missing from that list matters as much: there is no field for a static Authorization: Bearer header. A server that only accepts a fixed API key cannot be added as-is. That is the main difference from coding agents, which almost all accept headers; the per-client syntax is in our remote MCP server setup guide.

Search and fetch tools are no longer required, and ChatGPT implements the MCP Apps standard if your server returns interactive UI.

Step by step: add the server

On ChatGPT for the web:

1. Go to chatgpt.com/plugins.
2. Select the plus button, then Add custom MCP server.
3. Enter a name and, optionally, a description.
4. Under Connection, enter the server's public HTTPS MCP endpoint, or select Tunnel and choose a Secure MCP Tunnel.
5. Configure authentication: OAuth, No authentication, or OAuth or no authentication.
6. Review the risk warning and select the I understand and want to continue checkbox.
7. Select Create as a plugin, then review the tools and metadata ChatGPT discovered.
8. Install the plugin. It appears under your personal plugins, or in the workspace where you created it.

To use it, start a new conversation, type @ in the prompt box and select the plugin. After that, ChatGPT can also pick an installed plugin on its own when a request matches.

In a Business or Enterprise workspace, the plugin starts private to you. Getting it to the rest of the workspace is a separate step, covered below.

Example: connecting AlertMCP

AlertMCP is an MCP server that lets an agent send a notification to your phone and desktop or ask you a question with answer buttons. It is a useful example because it shows both the OAuth flow and the confirmation behavior.

In coding agents, AlertMCP authenticates with a bearer header. ChatGPT can't send one, so ChatGPT connects over OAuth with the same URL:

1. In the Add custom MCP server form, name it AlertMCP and enter https://api.alertmcp.com/mcp as the URL.
2. Choose OAuth for authentication.
3. When the sign-in window opens, approve the connection on AlertMCP's consent screen with your API key from the AlertMCP dashboard.
4. Accept the risk warning, create the plugin and install it.

Then try a prompt such as: "@AlertMCP send a summary of this conversation to my phone with high priority."

Be realistic about what this gives you. notify and ask change state, so they are write tools. ChatGPT shows a confirmation card before each call, and because Pro connections are limited to read and fetch, expect them to work only in Business and Enterprise/Edu workspaces. The good fits in ChatGPT are deliberate, one-off actions: send this summary to my phone, or put a question to your team through a shared AlertMCP team workspace. For agents that run unattended, connect AlertMCP to Claude Code, Cursor or Codex instead.

Why ChatGPT asks you to confirm

OpenAI's guide says write actions require confirmation by default, and its MCP docs say ChatGPT requires manual confirmation in a conversation before write actions run. ChatGPT decides what counts as a write from the MCP tool annotations: a tool without readOnlyHint is treated as a write.

For server authors, that means: annotate genuinely read-only tools with readOnlyHint: true, and leave everything that sends, creates, edits or deletes unannotated or explicitly marked as a write. Mislabeling a write as read-only to skip the prompt defeats the point of the prompt.

For users, Managing app permissions in ChatGPT describes the controls. Depending on your account and the app, you may see:

• Always ask: ChatGPT asks before reading or changing anything.
• Allow read actions: reads run freely; changes still need approval.
• Allow low-risk actions: low-risk actions are approved automatically; higher-risk ones may still prompt or be denied.
• Allow all actions: no approval prompts, flagged as elevated risk, and not offered in the account-wide or workspace-wide defaults.

On a personal account, set the default under Settings > Plugins > Permissions. When a prompt appears, the options can include Deny, Allow once, Allow low-risk actions and, for an eligible personal connected account, Always allow. Members of managed workspaces are not offered a persistent Always allow, and some especially risky actions are blocked outright rather than prompted.

That design is the same human-in-the-loop idea you would build into your own agent. Human-in-the-loop AI agents covers when an agent should stop and ask, and how to design the question.

Business and Enterprise workspaces

Workspace use adds a review step between "it works for me" and "everyone can use it":

• Publishing. Only admins and owners publish custom MCP servers to the workspace. Until then, the connection is private to whoever created it.
• A frozen snapshot. After an admin approves a server, ChatGPT uses a snapshot of its tools. Later changes on the server side don't apply until an admin refreshes and republishes. A breaking change to a tool definition can make calls fail in the meantime.
• Action control (Enterprise/Edu). Admins can choose which actions a published app may take, before or after publishing, and limit access by group. New actions found on refresh are disabled by default.
• Feature limits. Company knowledge only uses apps with search or fetch tools, and deep research can use custom apps for read and fetch actions only.

The legacy publishing path in the help center runs through Admin console > Plugins > Manage Legacy Apps > Drafts > Publish.

Other OpenAI surfaces

The Plugins flow is not the only way to use MCP with OpenAI products, and the others are less restrictive about auth.

Codex and the ChatGPT desktop app. The Codex CLI, the IDE extension and the ChatGPT desktop app read MCP servers from ~/.codex/config.toml (Codex MCP docs). That file supports stdio servers and bearer tokens through bearer_token_env_var, so bearer-only servers work there. The exact config is in the Codex section of our setup guide.

The Responses API. If you are building your own app, the Responses API mcp tool calls remote servers directly. This tool entry, for OpenAI's own docs server, needs no auth:

{
  "type": "mcp",
  "server_label": "openai_docs",
  "server_url": "https://developers.openai.com/mcp",
  "require_approval": "always"
}

By default, OpenAI asks for approval before sending data to a remote MCP server. The response contains an mcp_approval_request, and you answer with an mcp_approval_response. require_approval can be "always", "never" or an object listing specific tools. For servers that need OAuth, pass the access token in the authorization field on every request; the API does not store it.

Troubleshooting

There is no plus button or no "Add custom MCP server" option

• Check your plan against the table above. Plus and Free are not listed.
• In a Business workspace, only admins and owners can create these plugins.
• In Enterprise or Edu, ask an admin for the Create plugins with MCPs permission.
• You are on mobile. Switch to ChatGPT on the web.
• Your Settings shows Apps instead of Plugins, so you may be on the older experience. Follow the legacy steps in the help center.

The server only accepts an API key

• ChatGPT has no static header option. Add OAuth to the server, use a no-auth endpoint for public data, or connect it through Codex's config.toml, which takes bearer tokens.

It worked yesterday and now asks you to sign in again

• The OAuth provider is probably not issuing refresh tokens. Enable offline_access or its equivalent, then recreate the plugin so ChatGPT reads the updated metadata.

Tools appear but writes never run

• On Pro, connections are read/fetch only.
• In deep research and company knowledge, only read, search and fetch tools are used.
• A workspace admin may have disabled that action.

Tool calls error after the server was updated

• A workspace is still using the frozen snapshot. An admin needs to refresh the tool list and publish the update.

The server runs on your machine

• ChatGPT can't reach localhost. Use a Secure MCP Tunnel, deploy the server, or use the ChatGPT desktop app's config.toml route for local stdio servers.