MCP in ChatGPT: Connectors and Setup in 2026

Q: Do I need Developer Mode just to read data?

No. For reading, a Deep Research connector with the search and fetch tools is enough. Developer Mode is for writes — actions inside third-party services.

In short

MCP (Model Context Protocol) is an open protocol that lets an AI app connect to external tools and data through a single interface. In 2026 ChatGPT gained full client-side MCP support.
ChatGPT runs the protocol in two modes: Deep Research connectors (read-only — the search and fetch tools) and Developer Mode (full access including writes: create a task, update a CRM record, kick off a process).
The key difference from Claude and Cursor: ChatGPT accepts remote servers over HTTPS only. A local stdio server (launched via npx/node) can't be connected directly — you need a bridge such as mcp-remote.
How to connect: Settings → Connectors → turn on Developer Mode → create a connector with the server URL and an auth type → enable it inside a specific chat.
The main risk is prompt injection: a malicious email or calendar invite can exfiltrate data through trusted connectors. Only connect servers you trust.
As of July 2026 OpenAI does not officially serve Russia and Russian bank cards are declined, so for local agent work MCP in Claude Code or Cursor is the more practical route.

What are connectors and MCP in ChatGPT?

A connector in ChatGPT is an integration that gives the model access to an external app or dataset: Gmail, Google Drive, GitHub, HubSpot, or your own internal service. Under the hood, modern connectors speak MCP — the same protocol Claude and Cursor already use. If the protocol itself is new to you, start with the overview of what MCP servers are; the difference between MCP, Skills, and a plain API is covered separately in MCP, Skills, and API: what's the difference.

There are two connector types worth telling apart, because both capabilities and availability depend on it:

Deep Research connectors implement just two functions — search and fetch. That's read-only access: the model searches your data and pulls documents into its answer. Even in Developer Mode, Deep Research mode uses only these two tools.
Developer Mode lifts the limit and hands the MCP client the full tool set — both read and write. This is where ChatGPT can act, not just read.

What does MCP give you in ChatGPT?

In read-only mode a connector turns ChatGPT into a search engine over your own sources: files, repositories, a document store. That's handy for analysis and Deep Research, but the model changes nothing.

Developer Mode adds write tools — and that's when ChatGPT becomes an agent. It can trigger workflows, create tickets in a tracker, update CRM records, and chain several connectors together. OpenAI's own docs call this "powerful but dangerous" and aim it at developers who understand how to configure and test such apps safely.

Availability depends on your plan and region and rolls out in waves. As of July 2026, per OpenAI's help center, Developer Mode is listed for paid web plans (Pro, Plus, Business, Enterprise, Education), while custom Deep Research connectors are unavailable on Free and in several regions — the EEA, the UK, and Switzerland. The list shifts, so check the exact matrix against OpenAI's help center rather than a guide written two months ago.

How do you connect your own MCP server to ChatGPT?

The steps (as of July 2026):

Turn on Developer Mode. On personal plans that's Settings → Connectors → Advanced and the Developer Mode toggle. On Business/Enterprise the workspace admin does it: Workspace Settings → Permissions & Roles → Connectors.
Create the connector. Settings → Connectors → Create (or New connector). Give it a name, a short description, and the MCP server URL.
Pick an auth type. ChatGPT supports three: no auth, API key, and OAuth 2.1. Getting this step wrong is the number one cause of repeated login prompts — find out in advance which mode your server expects.
Enable the connector in the chat. Developer Mode requires you to explicitly add the server as a source in every new session, via the add-sources button.

The critical technical limit: ChatGPT accepts remote HTTPS endpoints only. If your server's instructions start with npx or node, that's a local stdio server and it won't connect directly. You'll need a wrapper like mcp-remote that exposes a local server as a remote one. Claude Code and Cursor have no such limit — more on that in the guide how to connect MCP to Claude Code.

How does MCP in ChatGPT differ from Claude and Cursor?

The protocol is the same; the client implementations are not. Claude treats MCP as base infrastructure, while ChatGPT embeds it in a broader "work agents" platform. Hence the practical differences:

Parameter	ChatGPT	Claude (Desktop/Code)	Cursor
Where the server runs	Remote only, HTTPS	Local (stdio) and remote	Local (stdio) and remote
Local npx/node directly	No, needs a bridge (mcp-remote)	Yes	Yes
Auth	no-auth / API key / OAuth 2.1	Local config, OAuth	Local config
Write-action confirmation	Yes, prompts based on context	Per-tool permissions	Per-tool permissions
Rich UI in the response (Apps SDK)	Yes, renders in chat	No	No
Where it's configured	Settings → Connectors	Config file / CLI	Config file

Apps SDK is its own story: it renders a rich interface right inside the ChatGPT conversation. That's a ChatGPT-only feature — Cursor, VS Code, and Claude Code read the open MCP spec but don't display Apps SDK UI. If you maintain one server for several clients, this fragmentation is the main headache.

How safe are MCP connectors?

Prompt injection is an attack in which a malicious instruction hides inside external data (an email, an invite, a document) and the model treats it as a user command. For MCP it's risk number one. One researcher demonstrated in practice how a calendar invite, combined with the Google Calendar and Gmail connectors, leaked email content.

Other common risks: stolen or overly broad tokens, over-permissioned connectors (more rights than the task needs), and weak logging. Write actions are more dangerous than reads: a server can do something irreversible instead of just returning data. ChatGPT asks for confirmation on writes — but at its own discretion and based on context, which makes that judgment call a single point of failure.

Minimum hygiene: connect only trusted servers, grant minimal rights, review every write action, and keep Lockdown Mode on at the organization level. Vetted, ready-to-use servers are easiest to pick from a curated list — the MCP section of the qvib arsenal.

Access and pricing from Russia: what matters

As of July 2026 OpenAI's international pricing looks like this: Plus — $20/month, Business — roughly $25 per seat per month (cheaper billed annually), Pro — $100 and $200/month, Enterprise — by contract. For Russia, though, the blocker isn't the price: OpenAI does not officially serve the country and Russian cards are declined outright. As of July 2026 there is no direct, legal way to buy a subscription from Russia — every payment scheme goes through intermediaries and foreign payment instruments, which puts it outside OpenAI's guarantees.

The practical takeaway for a developer: since MCP in ChatGPT is also remote-only, local agentic development from Russia is easier and more reliable with MCP in Claude Code or Cursor — they run servers locally and don't depend on cloud connectors. To assemble a working setup — an engine, ready-made MCP servers, prompts, and roles — see the Quest engine by qvib and the knowledge base in the /learn/ hub. Prompts written specifically for ChatGPT, if you do have access, are collected here: ready-made ChatGPT prompts in Russian.

FAQ

Do I need Developer Mode just to read data?

No. For reading, a Deep Research connector with the search and fetch tools is enough. Developer Mode is for writes — actions inside third-party services.

Can I connect a local MCP server to ChatGPT?

Not directly. ChatGPT accepts remote HTTPS endpoints only. A local stdio server has to be tunneled through a bridge (mcp-remote, for example) or deployed to a host as a remote server.

Is MCP in ChatGPT the same protocol as in Claude?

Yes, it's the same protocol. The clients differ: transport (ChatGPT is remote-only; Claude and Cursor also do local), auth, and where the connector is configured. A spec-compliant MCP server should in theory work with both.

Is it safe to give ChatGPT write access?

Only with care. Connect trusted servers, scope token permissions tightly, and review write confirmations. The main attack vector is prompt injection through external data.

How do ChatGPT connectors differ from the Apps SDK?

A connector gives the model tools (search/fetch or the full MCP set). The Apps SDK sits on top of that and renders a visual app interface right in the ChatGPT conversation — Claude and Cursor have no such rendering.