MCP for ChatGPT Plugins: The Architecture Behind Every Plugin

If your plugin does anything with live data, it does it through an MCP server. Skills can carry instructions and interface extensions can draw a panel, but the server is the only part that reaches your product.

This guide is for the engineer or technical founder who has an API and wants to know what has to be built in front of it. If MCP itself is new to you, start with our MCP guide.

The shape of it

Person in ChatGPT
      |
   ChatGPT picks a tool from its description
      |
   Your MCP server  (public HTTPS, Streamable HTTP)
      |   verifies the OAuth token, validates input
   Your existing API
      |
   Your database and systems

Three properties matter.

The server is thin. It does not hold business logic. It maps a user goal to one or more API calls and shapes the answer.

The server is the trust boundary. OpenAI's security guidance says to assume prompt injection and malicious input will reach your server, and to validate everything on the server side even when the model supplied it.

The server is public. A submitted plugin needs a stable HTTPS endpoint on your own domain. During development you can use OpenAI's Secure MCP Tunnel or a forwarding service, but neither replaces the public endpoint for submission.

Designing tools

A tool has a name, a description, an input schema and a result. ChatGPT reads the name and description to decide whether to call it, so those two fields are your interface to the model.

What works:

• One goal per tool. list_overdue_invoices beats a generic query tool. OpenAI's guidelines reject a generic executor that hides operations.
• Descriptions that say when not to use the tool. OpenAI's metadata guide recommends opening with when to use it and stating disallowed cases.
• Structured results. Declare an output schema. OpenAI's own submission helper warns on tools without one.
• Minimal data. Return what the request needs. Leave out internal IDs, logs, timestamps and personal data the user did not ask for. Reviewers check this.

What does not work is mirroring your REST API endpoint by endpoint. Twenty tools with overlapping descriptions are hard for a model to choose between and slow to test.

Annotations

Every tool declares three booleans: readOnlyHint, destructiveHint and openWorldHint. OpenAI scans them and compares them with what the tool does. Our submission guide has the table and the usual mistakes.

Annotations tell ChatGPT how carefully to treat a call, including when to ask the person to confirm. They are descriptions, not defences. Your server still has to check permissions on every call.

Authentication

A plugin that works for anyone needs none. Declare those tools as noauth.

A plugin that reads a customer's own data must link their account with OAuth 2.1. OpenAI's requirements, in short:

• Authorization code flow with PKCE using S256
• Protected resource metadata published at /.well-known/oauth-protected-resource
• Authorization server metadata that advertises PKCE support
• Client registration through Client ID Metadata Documents, which ChatGPT prefers, or Dynamic Client Registration, or a predefined client
• Your server verifies every token itself: signature, issuer, audience, expiry and scopes

ChatGPT does not support client credentials, service accounts or JWT bearer grants for this. If your product only has passwords and API keys, an authorization server has to be added. Auth0, Stytch and similar providers are listed in OpenAI's documentation as options.

You can mix the two. A tool can declare both noauth and oauth2, so people get something useful before they link an account and more after. That lowers the friction that loses people at the first step.

What the 2026-07-28 revision changed

OpenAI's documentation calls this revision MCP 2.0. The MCP project's changelog does not use that name, so cite the date when you need to be exact.

If you built a server against an earlier revision, these are the changes that touch you:

Stateless requests are good news for hosting. A server with no session state scales horizontally and runs well on serverless platforms.

MCP Events

MCP Events let ChatGPT subscribe to changes in your product and act when they happen: a new ticket, a changed document, a reply in a thread. Your server lists the events it supports, ChatGPT subscribes with a callback URL and a signing secret, and your server posts matching events to that URL.

Before you plan around it, note four things from OpenAI's documentation:

1. It follows a draft specification. OpenAI supports webhook delivery and callback verification from that draft, and does not support polling, streaming or two of the draft's control notifications.
2. It is available in Work chats on ChatGPT web, in Work chats on desktop with Cloud selected, and with dots.
3. Your server needs persistent subscription storage and outbound HTTPS.
4. Events can arrive out of order and more than once, so every write tool they trigger must be idempotent.

Add events when a real workflow starts with "when this happens". Do not add them to a first release because they are new.

Interface extensions

Extensions give a plugin its own views inside ChatGPT: a sidebar entry, a panel beside the conversation, file viewers, forms, settings. They are declared in a tool's metadata with an entry point type.

OpenAI's architecture guidance is to use interface elements only when people need to inspect, compare, edit, confirm or navigate structured information, and to keep tools useful without them so the model can finish a task headlessly. We follow the same order: tools first, a view when text is the wrong shape for the result.

Hosting and operations

• Pick the hostname once. Changing scheme, hostname or port means a new plugin.
• Expect daily scans. OpenAI rescans the server and holds changes that fail checks. Keep approved tool schemas working until an update is live.
• Log tool calls, not prompts. OpenAI's guidance is to redact personal data, store correlation IDs and avoid keeping raw prompt text unless you must.
• Return clean errors. OpenAI's authentication guide says to answer an expired or malformed token with a 401 and a WWW-Authenticate challenge, so the person can be asked to sign in again. A vague 500 just looks like a broken plugin.

Where to go next

• Decide whether you should build at all: the readiness checker
• Compare a plugin with embedding a model in your own product: ChatGPT plugin vs API integration
• Have it built: ChatGPT plugin development, from $4,999 fixed, submitted for OpenAI review in 14 days

HouseofMVPs is independent of OpenAI. We build to its published documentation, and OpenAI decides what is approved.