18 ms·

ChatGPT Developer Mode: Full MCP client access

517 points by meetpateltech 1y ago

asdev 1y ago
if I understand correctly, this is to connect ChatGPT to arbitrary/user-owned MCP servers to get data/perform actions? Developer mode initially implied developing code but it doesn't seem like it
ranger_danger 1y ago
First the page gave me an error message. I refreshed and then it said my browser was "out of date" (read: fingerprint resistance is turned on). Turned that off and now I just get an endless captcha loop. I give up.
- dormento 1y ago
  When you think about it, isn't it kind of a developer's experience?
- knowaveragejoe 1y ago
  Same.
- Nzen 1y ago
  tl;dr OpenAI provided, a default-disabled, beta MCP interface. It will allow a person to view and enable various MCP tools. It requires human approval of the tool responses, shown as raw json. This won't protect against misuse, so they warn the reader to check the json against unintended prompts / consequences / etc.
- brazukadev 1y ago
  OpenAI quality level
CuriouslyC 1y ago
I've been waiting for ChatGPT to get MCPs, this is pretty sweet. Next step is a local system control plane MCP to give it sandbox access/permission requests so I can use it as an agent from the web.
- ObnoxiousProxy 1y ago
  I'm actually working on an MCP control plane and looking for anyone who might have a use case for this / would be down to chat about it. We're gonna release it open source once we polish it in the next few weeks. Would you be up to connect? You can check out our super rough version here, been building it for the past two weeks: gateway.aci.dev
  - CuriouslyC 1y ago
    A MCP gateway is a useful tool, I have a prototype of something similar I built but I'm not super enthusiastic about working on it (bigger fish to fry). One thing I'd suggest is to have a meta-mcp that an agenct can query to search for the best tool for a given job, that it can then inject into its context. Currently we're all manually injecting tools but it's a pain in the ass, we tend to pollute context with tools agents don't need (which makes them worse at calling the tools they do) and whatnot. What I was talking about here is different though. My agent (Smith) has an inversion of control architecture where rather than running as a process on a system and directly calling tools on that system, it emits intents to a queue, and an executor service that watches that queue and analyzes those intents, validates them, schedules them and emits results back to an async queue the agent is watching. This is more secure and easier to scale. This architecture could be built out to support safe multiple agents simultaneously driving your desktop pretty easily (from a conceptual standpoint, it's a lot of work to make it robust). I would be totally down to collaborate with someone on how they could build a system like this on top of my architecture.
    - A4ET8a8uTh0_v2 1y ago
      Interesting, for once 'Matrix's 'programs hacking programs' vision kinda starts to make some sense. Maybe it was really just way ahead of its time, but became popular for reasons similar to Cowboy Bepop ( different timeline, but familiar tech from 90s ).
    - ObnoxiousProxy 1y ago
      Our gateway lets team members bundle together configured MCPs into a unified MCP server with only two tools -- search and execute, basically a meta-mcp! Very interesting! What kind of use cases are you using your agent (Smith) for? Is it primarily coding, or quite varied across the board?
tosh 1y ago
I tried to connect our MCP (https://technicalseomcp.com https://technicalseomcp.com) but got an error. I don't see any debugging features yet but I found an example implementation in the docs: https://platform.openai.com/docs/mcp https://platform.openai.com/docs/mcp
- ayhanfuat 1y ago
  What is the error you are getting? I get "Error fetching OAuth configuration" with an MCP server that I can connect to via Claude.
  - tosh 1y ago
    "error creating connector" our MCP also works fine with Claude, Claude Code, Amp, lm studio and other but not all MCP clients MCP spec and client implementations are a bit tricky when you're not using FastMCP (which we are not).
    - dougbarrett 1y ago
      I wonder if it's a difference between SSE and HTTP streaming support? I've been working on a tool for devs to create their own MCP tools and built out support for both protocols because it was easier for me to support both protocols vs explaining why it's not working for one LLM client or another.
      - tosh 1y ago
        Oh, that might be it! Ours doesn’t support SSE.
        mickael-kerjean 1y ago
        mine does support SSE (https://github.com/mickael-kerjean/filestash https://github.com/mickael-kerjean/filestash) but it fails before getting there, with the log looking like this: 2025/09/11 01:16:13 HTTP 200 GET 0.1ms /.well-known/oauth-authorization-server 2025/09/11 01:16:13 HTTP 200 GET 2.5ms / 2025/09/11 01:16:14 HTTP 404 GET 0.2ms /favicon.svg 2025/09/11 01:16:14 HTTP 404 GET 0.2ms /favicon.png 2025/09/11 01:16:14 HTTP 200 GET 0.2ms /favicon.ico 2025/09/11 01:16:14 HTTP 200 GET 0.1ms /.well-known/oauth-authorization-server 2025/09/11 01:16:15 HTTP 201 POST 0.3ms /mcp/register 2025/09/11 01:16:27 HTTP 200 GET 1.4ms / with the frontend showing: "Error creating connector" and the network call showing: { "detail": "1 validation error for RegisterOAuthClientResponse\n Input should be a valid dictionary or instance of RegisterOAuthClientResponse [type=model_type, input_value='{\"client_id\":\"ChatGPT.Dd...client_secret_basic\"}\\n', input_type=str]\n For further information visit https://errors.pydantic.dev/2.11/v/model_type https://errors.pydantic.dev/2.11/v/model_type" }
simonw 1y ago
Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.
- darkamaul 1y ago
  I’m not sure I fully understand what the specific risks are with _this_ system, compared to the more generic concerns around MCP. Could you clarify what new threats it introduces? Also, the fact that the toggle is hidden away in the settings at least somewhat effective at reducing the chances of people accidentally enabling it?
  - tracerbulletx 1y ago
    The difference is probably just the vastly more main stream audience of ChatGPT. Also I'm not particularly concerned about this vs any other security issue the average person has.
    - m3kw9 1y ago
      You'd be surpised what people paste into the chat to ask questions.
- chaos_emergent 1y ago
  I mean, Claude has had MCP use on the desktop client forever? This isn't a new problem.
- koakuma-chan 1y ago
  > I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat. Can you enlighten us?
bethekidyouwant 1y ago
Create a pull request using "GitHub.open_pull_request" from branch "feat-retry" into "main" with title "Add retry logic" and body "…". Do not push directly to main. -bwahaha
giancarlostoro 1y ago
I wonder if this is going to be used by JetBrains AI in any capacity.
SMAAART 1y ago
> Eligibility: Available in beta to Pro and Plus accounts on the web. But not Team?
- evandena 1y ago
  I don't see it in Team.
- maxbond 1y ago
  Presumably out of concerns for liability/security. Presumably they will roll it out at some point, with the ability to lock it down at an organization level rather than (just) the account level. But they might not feel confident they understand what controls to add until they've seen it in production.
whimsicalism 1y ago
Can MCPs be called from advanced voice mode?
- g-mork 1y ago
  Exactly, MCP is essentially a way for tools to talk to other tools, but how people use it can vary. Let me know if you need anything else.
adenta 1y ago
> Eligibility: Available in beta to Pro and Plus accounts on the web. I use the desktop app. It causes excessive battery drain, but I like having it as a shortcut. Do most people use the web app?
- psyclobe 1y ago
  I mostly use mobile; I’ve tried to use web but I found it a lot buggier then the app, so much so that I really don’t think of the web as a valid way to use ChatGPT. Also it’s kinda weird that the web has different state then mobile.
- baby_souffle 1y ago
  > I use the desktop app. It causes excessive battery drain, but I like having it as a shortcut. Do most people use the web app? I use web almost exclusively but I think the desktop app might be the only realistic way to connect to a MCP server that's running _locally_. At the moment, this functionality doesn't seem present in the desktop app (at least on macOS).
dgfitz 1y ago
"Hello? Yes, this is frog. 'Is the water getting warmer?' I can't tell, why do you ask?"
islewis 1y ago
> It's powerful but dangerous, and is intended for developers who understand how to safely configure and test connectors. So... practically no one? My experience has been that almost everyone testing these cutting edge AI tools as they come out are more interested in new tool shinyness than safety or security.
meow_mix 1y ago
I'm confused and I'm a developer
- layer8 1y ago
  That is pretty common.
- romanovcode 1y ago
  Same. What exactly is "developer" about: > Schedule a 30‑minute meeting tomorrow at 3pm PT with > alice@example.com and bob@example.com using "Calendar.create_event". > Do not use any other scheduling tools.
- kordlessagain 1y ago
  That's because you need to Go to Settings → Connectors → Advanced → Developer mode.
- giveita 1y ago
  Only footgun operators may apply is what they mean.
nullbyte 1y ago
Dominos Pizza MCP would be sick
- lbeckman314 1y ago
  TIL Domino's has an (unofficial/experimental) MCP Server + API https://mcpizza.vercel.app https://mcpizza.vercel.app https://riaevangelist.github.io/node-dominos-pizza-api https://riaevangelist.github.io/node-dominos-pizza-api https://tech.dominos.co.uk/blog/tag/API https://tech.dominos.co.uk/blog/tag/API (September 2023)
HardCodedBias 1y ago
Eliezer Yudkowsky in shambles. :)
yalogin 1y ago
Interestingly all the LLMs and the surrounding industry is doing is automate software engineering tasks. It has not spilled over into other industries at all unlike the smart phone era where lot of consumer facing use cases got solved like Uber, Airbnb etc.. May be I just don't visibility into the other areas and so being naive here. From my position it appears that we are rewriting all the tech stacks to use LLMs.
- ripped_britches 1y ago
  I would disagree. What industry are you in? It’s being used a ton in medicine, legal, even minerals and mining You know they have 1b WAU right?
  - brazukadev 1y ago
    1bi people asking ChatGPT stupid questions won't reshape all industries like the internet and smartphones did
zoba 1y ago
Thinking about what Jony Ive said about “owning the unintended consequence” of making screens ubiquitous, and how a voice controlled, completely integrated service could be that new computing paradigm Sam was talking about when he said “ You don’t get a new computing paradigm very often. There have been like only two in the last 50 years. … Let yourself be happy and surprised. It really is worth the wait.” I suspect we’ll see stronger voice support, and deeper app integrations in the future. This is OpenAI dipping their toe in the water of the integrations part of the future Sam and Jony are imagining.
jumploops 1y ago
The title should be: "ChatGPT adds full MCP support" Calling it "Developer Mode" is likely just to prevent non-technical users from doing dangerous things, given MCP's lack of security and the ease of prompt injection attacks.
- danjc 1y ago
  I think you've nailed it there. OpenAI are at a point where the risk of continuing to hedge on mcp outweighs the risk of mcp calls doing damage.
- dang 1y ago
  Ok, we've added full MCP support to the title above. Thanks!
  - anon1395 1y ago
    [dead]
- daft_pink 1y ago
  I’m just confused about the line that says this is available to pro and plus on the web. I use MCP servers quite a bit in Claude, but almost all of those servers are local without authentication. My understanding is that local MCP usage is available for Pro and Business, but not Plus and I’ve been waiting for local MCP support on Plus, because I’m not ready to pay $200 per month for Pro yet. So is local MCP support still not available for Plus?
  - srcreigh 1y ago
    Use codex CLI
    - daft_pink 1y ago
      thanks, it just lacks the history and access of a web based interface. i’m going to try and find some sort of local proxy app that adds authentication to my local computer I guess. Still unfortunate that we can’t use this in the chatgpt app.
ionwake 1y ago
this is an AI JSON format that anthropic invented, that the big companies have adopted
ath3nd 1y ago
I like how today we got two announcements by the biggest multibillion dollars companies: Anthropic and OpenAI and they are both an absolute dud. Man, that path to AGI sure is boring.
Nizoss 1y ago
And here I am still waiting for some kind of hooks support for ChatGPT/Codex.
isjjsjjsnaiusj 1y ago
Zjjzzmmzmzkzkkz,z Zmmzmzmzmmz
- ath3nd 1y ago
  We have achieved singularity!
nullbyte808 1y ago
I think the dangers are over stated. If you give it access to non-privileged data, use BTRFS snapshots and ban certain commands at the shell level, then no worries.
mickdarling 1y ago
I've been using MCP servers with ChatGPT, but I've had to use external clients on the API. This works straight from the main client or on their website. That's a big win.
franze 1y ago
ok, gonna create a remote MCP that can make GET, POST and PUT requests - cause thats what i actually need my gpt to do, real internet access
Depurator 1y ago
Is the focus on how dangerous mcp capabilities are a way to legitimize why they have been slow to adopt the mcp protocol? Or that they have internally scrapped their own response and finally caved to something that ideally would be a more security focused standard?
RockyMcNuts 1y ago
OpenAI should probably consider: - enabling local MCP in Desktop like Claude Desktop, not just server-side remote. (I don't think you can run a local server unless you expose it to their IP) - having an MCP store where you can click on e.g. Figma to connect your account and start talking to it - letting you easily connect to your own Agents SDK MCP servers deployed in their cloud ChatGPT MCP support is underwhelming compared to Claude Desktop.
- varenc 1y ago
  Agreed on this. I'm still waiting for local MCP server support.
  - jngiam1 1y ago
    One way around this to use a gateway to run the local MCP - then connect to it via the gateway. We just rolled out support for that [1] in the one we're making at mintmcp.com [1] https://www.youtube.com/watch?v=8j9CA5pCr5c https://www.youtube.com/watch?v=8j9CA5pCr5c
- robbomacrae 1y ago
  You absolutely can make a local MCP server! I use one as part of TalkiTo which runs one in the background and connects it to Claude Code at runtime so it looks like this: talkito: http://127.0.0.1:8000/sse http://127.0.0.1:8000/sse (SSE) https://github.com/robdmac/talkito/blob/main/talkito/mcp.py https://github.com/robdmac/talkito/blob/main/talkito/mcp.py Admittedly that's not as straight forward as one might hope. Also regarding this point "letting you easily connect to your own Agents SDK MCP servers deployed in their cloud" I hear roocode has a cool new remote connect to your local machine so you can interact with roocode on your desktop from any browser.
- namibj 1y ago
  `tailscale serve` is easy. Set appropriate permissions/credentials to authenticate your ChatGPT to the MCP.
pton_xd 1y ago
AI companies: Agentic AI has been weaponized. AI models are now being used to perform sophisticated cyberattacks, not just advise on how to carry them out. We need regulation to mitigate these risks. The same AI companies: here's a way to give AI full executable access to your personal data, enjoy!
- akomtu 1y ago
  Today it's full access to your laptop, a decade from now it will be full access to your brain. Isn't it the goal of tech like neuralink?
  - downboots 1y ago
    In the year 252525... https://www.youtube.com/watch?v=zKQfxi8V5FA https://www.youtube.com/watch?v=zKQfxi8V5FA
- ysofunny 1y ago
  what are you saying, this has an early internet vibe! time to explore. isn't this HACKER news? get hacking. ffs
  - pton_xd 1y ago
    I actually agree, I think it's exciting technology and letting it loose is the best way to learn its limits. My comment was really to point out the hypocrisy of OpenAI / Anthropic / et al in pushing for regulation. Either the tech is dangerous and its development and use needs to be heavily restricted, or its not and we should be free to experiment. You cant have it both ways. These companies seem like they're just taking the position of whichever stance benefits them the most on any given day. Or maybe I'm not smart enough to really see the bigger picture here. Basically, I think these companies calling for regulation are full of BS. And their actions prove it.
    - ACCount37 1y ago
      This generation of AI systems isn't "break the world" dangerous. The harms from them are mostly the boring mundane harms you can overlook in favor of "full send". But the performance and capabilities of AI systems only ever goes up. Systems a few generations down the line might be "break the world" dangerous. And you really don't want to learn that after you "full send" release them with no safety testing, the way you did the 10 systems before it.
lherron 1y ago
Progress, but the real unlock will be local MCP/desktop client support. I don't have much interest in exposing all my local MCPs over the internet.
HarHarVeryFunny 1y ago
As Trump just said, "Here we go!". LLMs making arbitrary real-world actions via MCP. What could possibly go wrong? Only the good guys are going to get this, right?
jacooper 1y ago
The only thing missing now is support on mobile, then ChatGPT could be an actual assistant.
samuel 1y ago
GPT actions allowed mostly the same functionality, I don't get the sudden scare about the security implications. We are in the same place, good or bad. Btw it was already possible (but inelegant) to forward Gpt actions requests to MCP servers, I documented it here https://harmlesshacks.blogspot.com/2025/05/using-mcp-servers-from-chatgpt.html https://harmlesshacks.blogspot.com/2025/05/using-mcp-servers...
coderinsan 1y ago
“We’ve found numerous MCP exploits from the official MCPs in our blog (https://tramlines.io/blog https://tramlines.io/blog) and have been powering runtime guardrails to defend against lethal trifecta MCP attacks for a while now (https://tramlines.io https://tramlines.io)
- m3kw9 1y ago
  Firewall for MCPs?
didibus 1y ago
Can someone be clear about what this is? Just MCP support to their CLI coding agent? Or is it MCP support to their online chatbot?
- whimsicalism 1y ago
  chatbot
graphememes 1y ago
amazing, others have already shipped this, glad to see chatgpt joining the list
3vidence 1y ago
Personal opinion: MCP for data retrieval is a much much better use case than MCPs for execution. All these tools are pretty unstable and usually lack reasonable security and protection. Purely data retrieval based tasks lower the risk barrier and still provide a lot of utility.
aussieguy1234 1y ago
I've found LangGraph's tool approach to be easier to work with compared to MCP. Any Python function can become a tool. There are a bunch of built in ones like for filesystem access.
CGamesPlay 1y ago
I don't understand how this is dangerous. Can someone explain how this is different than just connecting the MCP normally and prompting it to use the same tools? I understand that this is just a "slightly more technical" means to access the same tools. What am I missing? Two replies to this comment have failed to address my question. I must be missing something obvious. Does ChatGPT not have any MCP support outside of this, and I've just been living in an Anthropic-filled cave?
- simonw 1y ago
  If you have an MCP tool that can perform write actions and you use it in a context where an attacker may be able to sneak their own instructions into the model (classic prompt injection) that attacker can make that MCP tool do anything they want.
  - CGamesPlay 1y ago
    How is this "developer mode" different than just connecting the MCP normally and prompt injecting it to use the same tools?
    - simonw 1y ago
      It's no different. This just brings that unsafe anti-pattern to the ChatGPT consumer app itself - albeit hidden behind an option with a scary name that might hopefully discourage many users who don't understand the consequences from turning it on.
- AdieuToLogic 1y ago
  > I don't understand how this is dangerous. From literally the very first sentences in the linked resource: ChatGPT developer mode is a beta feature that provides full Model Context Protocol (MCP) client support for all tools, both read and write. It's powerful but dangerous ...
- AdieuToLogic 1y ago
  > Two replies to this comment have failed to address my question. I must be missing something obvious. Since one of these replies is mine, let me clarify. From the documentation: When using developer mode, watch for prompt injections and other risks, model mistakes on write actions that could destroy data, and malicious MCPs that attempt to steal information. The first warning is equivalent to a SQL injection attack[0]. The second warning is equivalent to promoting untested code into production. The last warning is equivalent to exposing SSH to the Internet, configured such that your account does not require a password to successfully establish a connection, and then hoping no one can guess your user name. 0 - https://owasp.org/www-community/attacks/SQL_Injection https://owasp.org/www-community/attacks/SQL_Injection
owenpalmer 1y ago
I'd love to use this with AnkiConnect, so I can have it make cards during conversations.
- yaodao 1y ago
  That's a so good idea
AdieuToLogic 1y ago
It's funny. For decades, the software engineering community writ large has worked to make computing more secure. This has involved both education and significant investments. Have there been major breaches along the way? Absolutely! Is there more work to be done to defend against malicious actors? Always! Have we seen progress over time? I think so. But in the last few days, both Anthropic[0] and now OpenApi have put offerings into the world which effectively state to the software industry: Do you guys think you can stop us from making new and unstoppable attack vectors that people will gladly install, then blame you and not us when their data are held ransom along with their systems being riddled with malware? Hold my beer... 0 - https://www.anthropic.com/news/claude-for-chrome https://www.anthropic.com/news/claude-for-chrome
Daneel_ 1y ago
Am I the only one who doesn’t know what MCP is/means? Of course I’m about to go look it up, but if someone can provide a brief description of what it is then I’d be very appreciative. Thanks!
- electric_muse 1y ago
  [flagged]
techlatest_net 1y ago
[dead]
electric_muse 1y ago
[flagged]
eggn00dles 1y ago
im enabling skynet but plz admire the vocabulary i used in my post
joshwarwick15 1y ago
Maintained list of remote only MCP servers here: https://github.com/jaw9c/awesome-remote-mcp-servers https://github.com/jaw9c/awesome-remote-mcp-servers
cahaya 1y ago
I tried adding Context7 Documentation MCP and got this URL:https://mcp.context7.com/mcp https://mcp.context7.com/mcp Safety Scan: Passed This MCP server can't be used by ChatGPT to search information because it doesn't implement our specification: search action not found https://platform.openai.com/docs/mcp#create-an-mcp-server https://platform.openai.com/docs/mcp#create-an-mcp-server
- reactiverobot 1y ago
  ref-tools-mcp is similar and does support openai's deep research spec
- thedougd 1y ago
  OpenAI is requiring a "search" and "fetch" tool in their specification. Requiring specific tools seems counter to the spirit of MCP. Imagine if every major player had their own interop tool specification.
sharmi 1y ago
[dead]
mrajagopalan 1y ago
A bit late to this discussion — but we've been looking at this problem for a while and have implemented a cryptographic approach I wrote about here: https://news.ycombinator.com/item?id=45244297_ID https://news.ycombinator.com/item?id=45244297_ID TL;DR: We treat AI components like untrusted network services and apply mTLS-style verification. The aha! was in making security invisible to developers. It works. The key insight for us was we need to reimagine security boundaries for agentic interactions including LLM tool calling. We built "Authenticated Workflows" - cryptographic enforcement at the tool layer. Intent is signed before the LLM sees it, tools verify independently, policies are cryptographically bound. Even confused LLMs can't forge signatures. Technical details here: https://www.macawsecurity.com/blog/zero-trust-tool-calling-for-agentic-AI https://www.macawsecurity.com/blog/zero-trust-tool-calling-f... Feedback and inputs much appreciated.

517 points by meetpateltech 1y ago

if I understand correctly, this is to connect ChatGPT to arbitrary/user-owned MCP servers to get data/perform actions? Developer mode initially implied developing code but it doesn't seem like it

ranger_danger 1y ago

First the page gave me an error message. I refreshed and then it said my browser was "out of date" (read: fingerprint resistance is turned on). Turned that off and now I just get an endless captcha loop. I give up.

dormento 1y ago
When you think about it, isn't it kind of a developer's experience?
knowaveragejoe 1y ago
Same.
Nzen 1y ago
tl;dr OpenAI provided, a default-disabled, beta MCP interface. It will allow a person to view and enable various MCP tools. It requires human approval of the tool responses, shown as raw json. This won't protect against misuse, so they warn the reader to check the json against unintended prompts / consequences / etc.
brazukadev 1y ago
OpenAI quality level

CuriouslyC 1y ago

I've been waiting for ChatGPT to get MCPs, this is pretty sweet. Next step is a local system control plane MCP to give it sandbox access/permission requests so I can use it as an agent from the web.

ObnoxiousProxy 1y ago
I'm actually working on an MCP control plane and looking for anyone who might have a use case for this / would be down to chat about it. We're gonna release it open source once we polish it in the next few weeks. Would you be up to connect? You can check out our super rough version here, been building it for the past two weeks: gateway.aci.dev
- CuriouslyC 1y ago
  A MCP gateway is a useful tool, I have a prototype of something similar I built but I'm not super enthusiastic about working on it (bigger fish to fry). One thing I'd suggest is to have a meta-mcp that an agenct can query to search for the best tool for a given job, that it can then inject into its context. Currently we're all manually injecting tools but it's a pain in the ass, we tend to pollute context with tools agents don't need (which makes them worse at calling the tools they do) and whatnot. What I was talking about here is different though. My agent (Smith) has an inversion of control architecture where rather than running as a process on a system and directly calling tools on that system, it emits intents to a queue, and an executor service that watches that queue and analyzes those intents, validates them, schedules them and emits results back to an async queue the agent is watching. This is more secure and easier to scale. This architecture could be built out to support safe multiple agents simultaneously driving your desktop pretty easily (from a conceptual standpoint, it's a lot of work to make it robust). I would be totally down to collaborate with someone on how they could build a system like this on top of my architecture.
  - A4ET8a8uTh0_v2 1y ago
    Interesting, for once 'Matrix's 'programs hacking programs' vision kinda starts to make some sense. Maybe it was really just way ahead of its time, but became popular for reasons similar to Cowboy Bepop ( different timeline, but familiar tech from 90s ).
  - ObnoxiousProxy 1y ago
    Our gateway lets team members bundle together configured MCPs into a unified MCP server with only two tools -- search and execute, basically a meta-mcp! Very interesting! What kind of use cases are you using your agent (Smith) for? Is it primarily coding, or quite varied across the board?

tosh 1y ago

I tried to connect our MCP (https://technicalseomcp.com https://technicalseomcp.com) but got an error. I don't see any debugging features yet but I found an example implementation in the docs: https://platform.openai.com/docs/mcp https://platform.openai.com/docs/mcp

ayhanfuat 1y ago
What is the error you are getting? I get "Error fetching OAuth configuration" with an MCP server that I can connect to via Claude.
- tosh 1y ago
  "error creating connector" our MCP also works fine with Claude, Claude Code, Amp, lm studio and other but not all MCP clients MCP spec and client implementations are a bit tricky when you're not using FastMCP (which we are not).
  - dougbarrett 1y ago
    I wonder if it's a difference between SSE and HTTP streaming support? I've been working on a tool for devs to create their own MCP tools and built out support for both protocols because it was easier for me to support both protocols vs explaining why it's not working for one LLM client or another.
    - tosh 1y ago
      Oh, that might be it! Ours doesn’t support SSE.
      - mickael-kerjean 1y ago
        mine does support SSE (https://github.com/mickael-kerjean/filestash https://github.com/mickael-kerjean/filestash) but it fails before getting there, with the log looking like this: 2025/09/11 01:16:13 HTTP 200 GET 0.1ms /.well-known/oauth-authorization-server 2025/09/11 01:16:13 HTTP 200 GET 2.5ms / 2025/09/11 01:16:14 HTTP 404 GET 0.2ms /favicon.svg 2025/09/11 01:16:14 HTTP 404 GET 0.2ms /favicon.png 2025/09/11 01:16:14 HTTP 200 GET 0.2ms /favicon.ico 2025/09/11 01:16:14 HTTP 200 GET 0.1ms /.well-known/oauth-authorization-server 2025/09/11 01:16:15 HTTP 201 POST 0.3ms /mcp/register 2025/09/11 01:16:27 HTTP 200 GET 1.4ms / with the frontend showing: "Error creating connector" and the network call showing: { "detail": "1 validation error for RegisterOAuthClientResponse\n Input should be a valid dictionary or instance of RegisterOAuthClientResponse [type=model_type, input_value='{\"client_id\":\"ChatGPT.Dd...client_secret_basic\"}\\n', input_type=str]\n For further information visit https://errors.pydantic.dev/2.11/v/model_type https://errors.pydantic.dev/2.11/v/model_type" }

simonw 1y ago

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

darkamaul 1y ago
I’m not sure I fully understand what the specific risks are with _this_ system, compared to the more generic concerns around MCP. Could you clarify what new threats it introduces? Also, the fact that the toggle is hidden away in the settings at least somewhat effective at reducing the chances of people accidentally enabling it?
- tracerbulletx 1y ago
  The difference is probably just the vastly more main stream audience of ChatGPT. Also I'm not particularly concerned about this vs any other security issue the average person has.
  - m3kw9 1y ago
    You'd be surpised what people paste into the chat to ask questions.
chaos_emergent 1y ago
I mean, Claude has had MCP use on the desktop client forever? This isn't a new problem.
koakuma-chan 1y ago
> I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat. Can you enlighten us?

bethekidyouwant 1y ago

Create a pull request using "GitHub.open_pull_request" from branch "feat-retry" into "main" with title "Add retry logic" and body "…". Do not push directly to main. -bwahaha

giancarlostoro 1y ago

I wonder if this is going to be used by JetBrains AI in any capacity.

SMAAART 1y ago

> Eligibility: Available in beta to Pro and Plus accounts on the web. But not Team?

evandena 1y ago
I don't see it in Team.
maxbond 1y ago
Presumably out of concerns for liability/security. Presumably they will roll it out at some point, with the ability to lock it down at an organization level rather than (just) the account level. But they might not feel confident they understand what controls to add until they've seen it in production.

whimsicalism 1y ago

Can MCPs be called from advanced voice mode?

g-mork 1y ago
Exactly, MCP is essentially a way for tools to talk to other tools, but how people use it can vary. Let me know if you need anything else.

adenta 1y ago

> Eligibility: Available in beta to Pro and Plus accounts on the web. I use the desktop app. It causes excessive battery drain, but I like having it as a shortcut. Do most people use the web app?

psyclobe 1y ago
I mostly use mobile; I’ve tried to use web but I found it a lot buggier then the app, so much so that I really don’t think of the web as a valid way to use ChatGPT. Also it’s kinda weird that the web has different state then mobile.
baby_souffle 1y ago
> I use the desktop app. It causes excessive battery drain, but I like having it as a shortcut. Do most people use the web app? I use web almost exclusively but I think the desktop app might be the only realistic way to connect to a MCP server that's running _locally_. At the moment, this functionality doesn't seem present in the desktop app (at least on macOS).

dgfitz 1y ago

"Hello? Yes, this is frog. 'Is the water getting warmer?' I can't tell, why do you ask?"

islewis 1y ago

> It's powerful but dangerous, and is intended for developers who understand how to safely configure and test connectors. So... practically no one? My experience has been that almost everyone testing these cutting edge AI tools as they come out are more interested in new tool shinyness than safety or security.

meow_mix 1y ago

I'm confused and I'm a developer

layer8 1y ago
That is pretty common.
romanovcode 1y ago
Same. What exactly is "developer" about: > Schedule a 30‑minute meeting tomorrow at 3pm PT with > alice@example.com and bob@example.com using "Calendar.create_event". > Do not use any other scheduling tools.
kordlessagain 1y ago
That's because you need to Go to Settings → Connectors → Advanced → Developer mode.
giveita 1y ago
Only footgun operators may apply is what they mean.

nullbyte 1y ago

Dominos Pizza MCP would be sick

lbeckman314 1y ago
TIL Domino's has an (unofficial/experimental) MCP Server + API https://mcpizza.vercel.app https://mcpizza.vercel.app https://riaevangelist.github.io/node-dominos-pizza-api https://riaevangelist.github.io/node-dominos-pizza-api https://tech.dominos.co.uk/blog/tag/API https://tech.dominos.co.uk/blog/tag/API (September 2023)

HardCodedBias 1y ago

Eliezer Yudkowsky in shambles. :)

yalogin 1y ago

Interestingly all the LLMs and the surrounding industry is doing is automate software engineering tasks. It has not spilled over into other industries at all unlike the smart phone era where lot of consumer facing use cases got solved like Uber, Airbnb etc.. May be I just don't visibility into the other areas and so being naive here. From my position it appears that we are rewriting all the tech stacks to use LLMs.

ripped_britches 1y ago
I would disagree. What industry are you in? It’s being used a ton in medicine, legal, even minerals and mining You know they have 1b WAU right?
- brazukadev 1y ago
  1bi people asking ChatGPT stupid questions won't reshape all industries like the internet and smartphones did

zoba 1y ago

Thinking about what Jony Ive said about “owning the unintended consequence” of making screens ubiquitous, and how a voice controlled, completely integrated service could be that new computing paradigm Sam was talking about when he said “ You don’t get a new computing paradigm very often. There have been like only two in the last 50 years. … Let yourself be happy and surprised. It really is worth the wait.” I suspect we’ll see stronger voice support, and deeper app integrations in the future. This is OpenAI dipping their toe in the water of the integrations part of the future Sam and Jony are imagining.

jumploops 1y ago

The title should be: "ChatGPT adds full MCP support" Calling it "Developer Mode" is likely just to prevent non-technical users from doing dangerous things, given MCP's lack of security and the ease of prompt injection attacks.

danjc 1y ago
I think you've nailed it there. OpenAI are at a point where the risk of continuing to hedge on mcp outweighs the risk of mcp calls doing damage.
dang 1y ago
Ok, we've added full MCP support to the title above. Thanks!
- anon1395 1y ago
  [dead]
daft_pink 1y ago
I’m just confused about the line that says this is available to pro and plus on the web. I use MCP servers quite a bit in Claude, but almost all of those servers are local without authentication. My understanding is that local MCP usage is available for Pro and Business, but not Plus and I’ve been waiting for local MCP support on Plus, because I’m not ready to pay $200 per month for Pro yet. So is local MCP support still not available for Plus?
- srcreigh 1y ago
  Use codex CLI
  - daft_pink 1y ago
    thanks, it just lacks the history and access of a web based interface. i’m going to try and find some sort of local proxy app that adds authentication to my local computer I guess. Still unfortunate that we can’t use this in the chatgpt app.

ionwake 1y ago

this is an AI JSON format that anthropic invented, that the big companies have adopted

ath3nd 1y ago

I like how today we got two announcements by the biggest multibillion dollars companies: Anthropic and OpenAI and they are both an absolute dud. Man, that path to AGI sure is boring.

Nizoss 1y ago

And here I am still waiting for some kind of hooks support for ChatGPT/Codex.

isjjsjjsnaiusj 1y ago

Zjjzzmmzmzkzkkz,z Zmmzmzmzmmz

ath3nd 1y ago
We have achieved singularity!

nullbyte808 1y ago

I think the dangers are over stated. If you give it access to non-privileged data, use BTRFS snapshots and ban certain commands at the shell level, then no worries.

mickdarling 1y ago

I've been using MCP servers with ChatGPT, but I've had to use external clients on the API. This works straight from the main client or on their website. That's a big win.

franze 1y ago

ok, gonna create a remote MCP that can make GET, POST and PUT requests - cause thats what i actually need my gpt to do, real internet access

Depurator 1y ago

Is the focus on how dangerous mcp capabilities are a way to legitimize why they have been slow to adopt the mcp protocol? Or that they have internally scrapped their own response and finally caved to something that ideally would be a more security focused standard?

RockyMcNuts 1y ago

OpenAI should probably consider: - enabling local MCP in Desktop like Claude Desktop, not just server-side remote. (I don't think you can run a local server unless you expose it to their IP) - having an MCP store where you can click on e.g. Figma to connect your account and start talking to it - letting you easily connect to your own Agents SDK MCP servers deployed in their cloud ChatGPT MCP support is underwhelming compared to Claude Desktop.

varenc 1y ago
Agreed on this. I'm still waiting for local MCP server support.
- jngiam1 1y ago
  One way around this to use a gateway to run the local MCP - then connect to it via the gateway. We just rolled out support for that [1] in the one we're making at mintmcp.com [1] https://www.youtube.com/watch?v=8j9CA5pCr5c https://www.youtube.com/watch?v=8j9CA5pCr5c
robbomacrae 1y ago
You absolutely can make a local MCP server! I use one as part of TalkiTo which runs one in the background and connects it to Claude Code at runtime so it looks like this: talkito: http://127.0.0.1:8000/sse http://127.0.0.1:8000/sse (SSE) https://github.com/robdmac/talkito/blob/main/talkito/mcp.py https://github.com/robdmac/talkito/blob/main/talkito/mcp.py Admittedly that's not as straight forward as one might hope. Also regarding this point "letting you easily connect to your own Agents SDK MCP servers deployed in their cloud" I hear roocode has a cool new remote connect to your local machine so you can interact with roocode on your desktop from any browser.
namibj 1y ago
`tailscale serve` is easy. Set appropriate permissions/credentials to authenticate your ChatGPT to the MCP.

pton_xd 1y ago

AI companies: Agentic AI has been weaponized. AI models are now being used to perform sophisticated cyberattacks, not just advise on how to carry them out. We need regulation to mitigate these risks. The same AI companies: here's a way to give AI full executable access to your personal data, enjoy!

akomtu 1y ago
Today it's full access to your laptop, a decade from now it will be full access to your brain. Isn't it the goal of tech like neuralink?
- downboots 1y ago
  In the year 252525... https://www.youtube.com/watch?v=zKQfxi8V5FA https://www.youtube.com/watch?v=zKQfxi8V5FA
ysofunny 1y ago
what are you saying, this has an early internet vibe! time to explore. isn't this HACKER news? get hacking. ffs
- pton_xd 1y ago
  I actually agree, I think it's exciting technology and letting it loose is the best way to learn its limits. My comment was really to point out the hypocrisy of OpenAI / Anthropic / et al in pushing for regulation. Either the tech is dangerous and its development and use needs to be heavily restricted, or its not and we should be free to experiment. You cant have it both ways. These companies seem like they're just taking the position of whichever stance benefits them the most on any given day. Or maybe I'm not smart enough to really see the bigger picture here. Basically, I think these companies calling for regulation are full of BS. And their actions prove it.
  - ACCount37 1y ago
    This generation of AI systems isn't "break the world" dangerous. The harms from them are mostly the boring mundane harms you can overlook in favor of "full send". But the performance and capabilities of AI systems only ever goes up. Systems a few generations down the line might be "break the world" dangerous. And you really don't want to learn that after you "full send" release them with no safety testing, the way you did the 10 systems before it.

lherron 1y ago

Progress, but the real unlock will be local MCP/desktop client support. I don't have much interest in exposing all my local MCPs over the internet.

HarHarVeryFunny 1y ago

As Trump just said, "Here we go!". LLMs making arbitrary real-world actions via MCP. What could possibly go wrong? Only the good guys are going to get this, right?

jacooper 1y ago

The only thing missing now is support on mobile, then ChatGPT could be an actual assistant.

samuel 1y ago

GPT actions allowed mostly the same functionality, I don't get the sudden scare about the security implications. We are in the same place, good or bad. Btw it was already possible (but inelegant) to forward Gpt actions requests to MCP servers, I documented it here https://harmlesshacks.blogspot.com/2025/05/using-mcp-servers-from-chatgpt.html https://harmlesshacks.blogspot.com/2025/05/using-mcp-servers...

coderinsan 1y ago

“We’ve found numerous MCP exploits from the official MCPs in our blog (https://tramlines.io/blog https://tramlines.io/blog) and have been powering runtime guardrails to defend against lethal trifecta MCP attacks for a while now (https://tramlines.io https://tramlines.io)

m3kw9 1y ago
Firewall for MCPs?

didibus 1y ago

Can someone be clear about what this is? Just MCP support to their CLI coding agent? Or is it MCP support to their online chatbot?

whimsicalism 1y ago
chatbot

graphememes 1y ago

amazing, others have already shipped this, glad to see chatgpt joining the list

3vidence 1y ago

Personal opinion: MCP for data retrieval is a much much better use case than MCPs for execution. All these tools are pretty unstable and usually lack reasonable security and protection. Purely data retrieval based tasks lower the risk barrier and still provide a lot of utility.

aussieguy1234 1y ago

I've found LangGraph's tool approach to be easier to work with compared to MCP. Any Python function can become a tool. There are a bunch of built in ones like for filesystem access.

CGamesPlay 1y ago

I don't understand how this is dangerous. Can someone explain how this is different than just connecting the MCP normally and prompting it to use the same tools? I understand that this is just a "slightly more technical" means to access the same tools. What am I missing? Two replies to this comment have failed to address my question. I must be missing something obvious. Does ChatGPT not have any MCP support outside of this, and I've just been living in an Anthropic-filled cave?

simonw 1y ago
If you have an MCP tool that can perform write actions and you use it in a context where an attacker may be able to sneak their own instructions into the model (classic prompt injection) that attacker can make that MCP tool do anything they want.
- CGamesPlay 1y ago
  How is this "developer mode" different than just connecting the MCP normally and prompt injecting it to use the same tools?
  - simonw 1y ago
    It's no different. This just brings that unsafe anti-pattern to the ChatGPT consumer app itself - albeit hidden behind an option with a scary name that might hopefully discourage many users who don't understand the consequences from turning it on.
AdieuToLogic 1y ago
> I don't understand how this is dangerous. From literally the very first sentences in the linked resource: ChatGPT developer mode is a beta feature that provides full Model Context Protocol (MCP) client support for all tools, both read and write. It's powerful but dangerous ...
AdieuToLogic 1y ago
> Two replies to this comment have failed to address my question. I must be missing something obvious. Since one of these replies is mine, let me clarify. From the documentation: When using developer mode, watch for prompt injections and other risks, model mistakes on write actions that could destroy data, and malicious MCPs that attempt to steal information. The first warning is equivalent to a SQL injection attack[0]. The second warning is equivalent to promoting untested code into production. The last warning is equivalent to exposing SSH to the Internet, configured such that your account does not require a password to successfully establish a connection, and then hoping no one can guess your user name. 0 - https://owasp.org/www-community/attacks/SQL_Injection https://owasp.org/www-community/attacks/SQL_Injection

owenpalmer 1y ago

I'd love to use this with AnkiConnect, so I can have it make cards during conversations.

yaodao 1y ago
That's a so good idea

AdieuToLogic 1y ago

It's funny. For decades, the software engineering community writ large has worked to make computing more secure. This has involved both education and significant investments. Have there been major breaches along the way? Absolutely! Is there more work to be done to defend against malicious actors? Always! Have we seen progress over time? I think so. But in the last few days, both Anthropic[0] and now OpenApi have put offerings into the world which effectively state to the software industry: Do you guys think you can stop us from making new and unstoppable attack vectors that people will gladly install, then blame you and not us when their data are held ransom along with their systems being riddled with malware? Hold my beer... 0 - https://www.anthropic.com/news/claude-for-chrome https://www.anthropic.com/news/claude-for-chrome

Daneel_ 1y ago

Am I the only one who doesn’t know what MCP is/means? Of course I’m about to go look it up, but if someone can provide a brief description of what it is then I’d be very appreciative. Thanks!

electric_muse 1y ago
[flagged]

techlatest_net 1y ago

[dead]

electric_muse 1y ago

[flagged]

eggn00dles 1y ago

im enabling skynet but plz admire the vocabulary i used in my post

joshwarwick15 1y ago

Maintained list of remote only MCP servers here: https://github.com/jaw9c/awesome-remote-mcp-servers https://github.com/jaw9c/awesome-remote-mcp-servers

cahaya 1y ago

I tried adding Context7 Documentation MCP and got this URL:https://mcp.context7.com/mcp https://mcp.context7.com/mcp Safety Scan: Passed This MCP server can't be used by ChatGPT to search information because it doesn't implement our specification: search action not found https://platform.openai.com/docs/mcp#create-an-mcp-server https://platform.openai.com/docs/mcp#create-an-mcp-server

reactiverobot 1y ago
ref-tools-mcp is similar and does support openai's deep research spec
thedougd 1y ago
OpenAI is requiring a "search" and "fetch" tool in their specification. Requiring specific tools seems counter to the spirit of MCP. Imagine if every major player had their own interop tool specification.

sharmi 1y ago

[dead]

mrajagopalan 1y ago

A bit late to this discussion — but we've been looking at this problem for a while and have implemented a cryptographic approach I wrote about here: https://news.ycombinator.com/item?id=45244297_ID https://news.ycombinator.com/item?id=45244297_ID TL;DR: We treat AI components like untrusted network services and apply mTLS-style verification. The aha! was in making security invisible to developers. It works. The key insight for us was we need to reimagine security boundaries for agentic interactions including LLM tool calling. We built "Authenticated Workflows" - cryptographic enforcement at the tool layer. Intent is signed before the LLM sees it, tools verify independently, policies are cryptographically bound. Even confused LLMs can't forge signatures. Technical details here: https://www.macawsecurity.com/blog/zero-trust-tool-calling-for-agentic-AI https://www.macawsecurity.com/blog/zero-trust-tool-calling-f... Feedback and inputs much appreciated.