MCP server development for ChatGPT plugins and Claude connectors

MCP OAuth is where remote servers fail

In a measurement study published on arXiv on 21 May 2026, 40.55% of 7,973 live remote MCP servers exposed tools with no authentication, and every one of the 119 OAuth-protected servers tested in depth had at least one flaw. So we build authorisation first and tools second. The current revision also deprecates Dynamic Client Registration in favour of Client ID Metadata Documents and replaces protocol sessions with server-minted state handles (changelog), so a server built to last year’s revision needs changes. Our guides to MCP OAuth with CIMD and the stateless migration cover both.

If you already have a server, an MCP security audit checks it against the current revision in ten working days.

ChatGPT plugin submission (formerly ChatGPT apps)

OpenAI now calls what you build and publish for ChatGPT a plugin. That’s a package holding an MCP server, skills or both, listed in one directory shared by ChatGPT and Codex. On 9 July 2026, the ChatGPT release notes announced that the Plugin Directory was replacing the App Directory. Your MCP server still reaches users as an app. OpenAI’s Help Center says a plugin can include one or more apps, and some accounts still show Apps where others show Plugins.

You upload the plugin as a ZIP in OpenAI’s plugin submission portal, connect your server’s public HTTPS URL, pass a domain-verification check and an automated scan of every tool, then submit for review. Once OpenAI approves it, you choose when to publish. After that, OpenAI scans the server daily, and new or changed tools go live once they pass automated checks. OpenAI chooses which plugins appear on the directory’s main pages.

OpenAI’s review requires:

• Individual or business verification of the name you publish under. An unverified name is rejected.
• For a server that signs users in, OAuth 2.1 to the MCP authorization specification, with PKCE S256. ChatGPT prioritises Client ID Metadata Documents (CIMD), where the client identifies itself with a URL instead of registering, and also accepts Dynamic Client Registration (DCR) or a predefined OAuth client. The portal has no API-key option.
• readOnlyHint, destructiveHint and openWorldHint set to true or false on every tool, and each operation exposed as its own tool, with no generic executor.
• Website, support, privacy policy and terms of service URLs. The privacy policy must say what personal data you collect, why, who receives it, how long you keep it and what controls users have.
• A test account with sample data that signs in without MFA, five positive and three negative test cases, and a video walkthrough.
• A project with global data residency, because OpenAI projects with EU data residency can’t yet submit plugins with MCP servers.
• No sales of digital goods, no advertising and no money transfers.

What ChatGPT and Claude both require

Both platforms require these, so we build them before any tool:

• OAuth with PKCE S256 and protected resource metadata. Neither ChatGPT nor Claude supports a machine-to-machine client credentials grant.
• CIMD, advertised with the none token endpoint method so both platforms can use it, and DCR kept as the fallback. The current MCP revision deprecates DCR but keeps it for compatibility.
• ChatGPT’s and Claude’s redirect URIs on your authorization server’s allowlist.
• No generic executors or catch-all tools. Each operation gets its own tool, with readOnlyHint and destructiveHint set, plus openWorldHint for ChatGPT and title for Claude. These say whether a tool writes and whether the write is destructive, and Claude asks before every destructive call. The specification makes annotations optional, but both reviews check them.
• A reviewer account with sample data, and a published privacy policy (OpenAI, Anthropic).

What we don’t control

Some controls belong to the host, not to your server, such as SSRF checks during OAuth discovery, validating authorization URLs and asking the user before risky actions. ChatGPT and Claude decide those. We can prepare your submission to their directories, but we can’t promise that OpenAI or Anthropic will approve it. And we don’t run your identity provider. We configure the one you have.