Yes, through a tunnel. OpenAI's Responses API documentation says a public remote MCP server is set with a server URL, while a private or on-premises server uses a tunnel identifier with Secure MCP Tunnel. For security tools, that gives a path that avoids opening your network, but it does not remove the need for authentication and approvals.
The two ways to point at a server
The documentation for remote MCP servers and connectors describes the mcp tool type with a server label, and two ways to reach a server.
| Server type | Field | Notes |
|---|---|---|
| Public remote server | server_url | Reached over the internet |
| Private or on premises | tunnel_id | Uses Secure MCP Tunnel |
| Legacy connector | connector_id | Deprecated for models released after September 1, 2026 |
The page says existing models keep connector support. If you rely on connectors, check the current page for the date and model details.
Why this matters for security teams
Security tools often live on private networks. A remote connector model, where the provider's cloud calls your server, usually forces a choice between exposing the endpoint and allowlisting provider addresses. A tunnel changes that choice. This post does not describe the tunnel's internal design, since the page fetched for this article only names it, so ask OpenAI and your vendor for the technical details, security properties and logging before you rely on it.
What does not change
Even with a tunnel, the other controls apply.
- Authorization. Servers that need authentication usually take an OAuth access token in an authorization field. The page says connectors always require one and that your application must handle OAuth registration and authorization.
- Approvals. The require approval setting defaults to requiring approval before data goes to a server. You can set it to never for all tools or name specific tools to skip approval for.
- Tool filtering. An allowed tools list limits which tools are imported.
- Logging. The page recommends logging data sent to servers.
What the API does with your token
The documentation says the API does not store the authorization value and does not show it in the response object, so you send it with every request. That is good for storage risk, but it means your own code carries the token each time, so protect it in your backend.
A worked example
This is an illustrative scenario. A bank like company runs an internal vulnerability platform that cannot be exposed to the internet. The platform team wants an internal assistant.
- They register the private server using the tunnel field.
- They request an OAuth token for each user at the platform, not a shared one.
- They set allowed tools to the five read tools the first question set needs.
- They keep require approval on, and write a rule that tools that change data are not part of the pilot.
- They log each approval request and response with the user and tool name.
- Before go live, they test refusals: no token, wrong token, token for a different project.
Step by step: evaluating the tunnel option
- Ask OpenAI for the current documentation on the tunnel and what it protects.
- Ask the vendor whether the connector has been tested through it.
- Confirm who operates each end and who can see the traffic.
- Check how logging works at both ends.
- Confirm failure behavior: if the tunnel drops, does the assistant say so, or guess?
- Write a short risk note and a review date.
Approvals in more detail
When approval is needed, the response contains an approval request item, and your application sends an approval response in a follow up request. The page says each approval covers one tool call. That is useful, because a person approves a specific action, but it also means automated applications must decide who or what approves. Never wire an automatic approval for tools that change data.
Data retention note
The page states that with store set to true, data is retained for 30 days unless zero data retention is enabled, and that MCP servers are third party services governed by their own retention and residency policies. For security data, decide before connecting which of those applies.
Questions for your own network team
Your network and identity teams will ask different questions from the AI team. Which systems can the tunnel reach once it exists? Can it be limited to one server and one path? Who is paged if it fails, and who can close it in an emergency? A clear answer to the second question matters most, because the value of a private network is that it is narrow, and a tunnel that quietly reaches everything gives that up.
Document the answers in the same record as the connector register and set a review date, so the arrangement is checked again after the first quarter of use.
Where Safeguard fits
Safeguard offers an MCP Guardrail for policy on tools agents can call. The free scan needs no assistant. The Safeguard CLI, installed with a curl or PowerShell installer, can also write code, and the download page lists a Local agent and a Cloud agent as available.
What to put in your internal standard
Write three sentences that every team using the API must follow. Private servers are reached through an approved route that security has reviewed. Tokens are issued per user and never shared between applications. Tools that change data are excluded unless a named owner has approved them with approvals on. Put the sentences next to your connector register, so a developer who finds one finds the other.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow the conversation and mark each tool call that would reach a private system.
Quick check
Does a tunnel remove the need for OAuth?
No. The documentation still describes an authorization field, and connectors always require one.
Does each approval cover many calls?
The documentation says each approval covers one tool call.
Is the legacy connector option going away?
The page says connector_id is deprecated for models released after September 1, 2026, while existing models keep support. Check the current page.
Sources
- OpenAI documentation, remote MCP servers and connectors in the Responses API
- Safeguard download page
Last reviewed: 19 October 2026.
