OpenAI's Responses API can call tools on a remote MCP server using the mcp tool type. By default it asks for approval before sending data to a server. You can allow specific tools, require approval always, or set it to never. OpenAI states that servers are not verified and a malicious one could exfiltrate data.
Configuration
Per OpenAI's documentation, you set a server URL (or a tunnel ID for a local or private server), a server label and optionally a description. If the server needs authentication you pass an OAuth access token, which the API does not store, so you send it on every request. An allowed tools setting limits which server tools are imported. A defer loading option delays loading tool definitions until the model needs them, which can reduce token use.
How calls work
First the API fetches the server's tools and returns a list item. Keep it in context to avoid refetching each turn. Then the model may call tools, producing call items with arguments, output and any error.
Approvals
Approval is requested by default. With approval set to always, the API returns an approval request item. You approve or reject by sending an approval response with the request ID. Each approval covers one tool call. You can set approval to never for all tools, or list specific tools to skip approval for them. Use never only for tools that cannot change anything or leak anything.
Connectors and the deprecation
Built-in connectors cover Dropbox, Gmail, Google Calendar, Google Drive, Microsoft Teams, Outlook Calendar, Outlook Email and SharePoint. The page says the connector ID approach is deprecated for models released after September 1, 2026. Existing models keep support, and new work should use a server URL or tunnel ID.
Risks stated by OpenAI
- A malicious server can exfiltrate sensitive data from anything that enters the model's context.
- Servers are not verified by OpenAI and can read, send or act on data in connected services.
- Recommended practices include requiring approval for sensitive actions, preferring official servers and logging data shared with servers.
- Servers may change tool behavior unexpectedly.
Costs and data
You pay for the tokens used to import tool definitions and make calls, with no per-call fee, per the page. Zero Data Retention and data residency are supported, but data sent to a third party server follows that server's policies. Rate limits listed are 1000 requests per minute on Build and 2000 on Launch and Grow.
Compare with Claude
Anthropic's connector guidance is similar in spirit. See Claude custom connectors with remote MCP.
Click through it at your own pace, or open it full screen.
Safeguard's MCP Guardrail targets agent tool access, and a free scan is at gold.safeguard.sh/scan.
Quick check
Is approval on by default?
Yes. The docs say approval is requested by default before data goes to a server.
Does one approval cover many calls?
No. Each approval covers one tool call.
Sources
Last reviewed: 19 October 2026.
