For ChatGPT features such as company knowledge and deep research, OpenAI's documentation says an MCP server should expose two read-only tools named search and fetch with a defined schema, return results as structured content, and use OAuth. Write actions need explicit confirmation. Here is what each requirement means.
Where MCP shows up in OpenAI products
The docs describe three entry points. In ChatGPT Plugins you add a custom MCP server by entering its URL and authentication details, then create it as a plugin that users install. Company knowledge and deep research use the server's search and fetch tools. In the Responses API you add an MCP tool with a server URL, a label, optional allowed tools and an approval setting.
The search tool
Search takes a query string and returns results. Each result has an id, a title and a url. That is all the shape needs.
The fetch tool
Fetch takes an id and returns the id, a title, the text, a url and optional metadata.
Format details that cause failures
- Return the object as structured content and also as a JSON-encoded string in the content array.
- Declare an output schema for each tool so clients can validate results.
- Citations appear only when the url is a non-empty string. Without it, results stay plain tool output.
- OAuth is recommended. The docs say Client ID Metadata Documents are supported, and dynamic client registration is supported when configured.
The example server in the docs uses SSE transport with a path ending in a trailing sse segment. Check the current page for the transport your use case needs before you build.
Approval of tool calls
In ChatGPT, write actions require manual confirmation in the conversation before they run. In the API, the docs show approval set to never only because the example tools are read-only, and say to keep approval on for any tool that can change data.
The risks OpenAI lists
- Prompt injection through content the model reads, including data from your server.
- A server asking for broader parameters than it needs.
- Cross-server exfiltration, where one server's content is used to pull data from another and send it out through a write action.
- A write action mislabeled as read-only, so labels cannot be your only control.
Its advice: connect only to servers you trust, prefer official ones, limit who can reach servers holding sensitive data, review requested parameters, and report suspected malicious servers to security@openai.com.
For the Safeguard side, see getting started with Safeguard MCP in ChatGPT. Safeguard's download page lists ChatGPT support through a plugin or an OpenAPI schema.
Click through it at your own pace, or open it full screen.
Quick check
Why does ChatGPT show no citation for my results?
Citations are created only when the url field is a non-empty string.
Can the approval prompt be disabled?
In the API you can set approval to never, but the docs only do so for read-only tools. Keep it on for anything that modifies data.
Sources
Last reviewed: 19 October 2026.
