MCP server review requirements

Prepare an MCP server and its optional UI for public review as part of a plugin.

Prepare MCP capabilities for plugin submission

Use this page for requirements that apply when a plugin includes an MCP server: organization verification, management permissions, server requirements, review snapshots, and version maintenance.

When the plugin works in developer mode, submit it for review in the plugin submission portal. This page covers the MCP server and optional UI requirements for that submission.

Only submit the plugin if you intend for it to be publicly available in the countries you define during submission. For private or workspace-only use, use developer mode instead.

Before submitting the plugin, review the plugin guidelines for MCP server and optional UI expectations, and see Submit plugins for the full plugin submission, approval, and publishing flow.

For the complete flow, including skills-only and MCP-backed plugins, review, approval, and publishing, see Submit plugins.

Before you submit the plugin

Organization verification

Before submitting a plugin with MCP, complete identity verification in the OpenAI Platform Dashboard for the name you plan to publish under in the directory.

• If you want to publish under your own name, complete individual verification.
• If you want to publish under a business name, complete business verification.

This is enforced during review. Publishing under an unverified individual or business name will result in rejection.

Plugin submission permissions

To create plugin drafts with MCP and submit them for review, you need the api.apps.write permission. To view drafts and review status in the Dashboard, you need the api.apps.read permission. Organization owners automatically have both permissions, and can grant them to non-owners through roles in the OpenAI Platform Dashboard.

MCP server requirements

• Your MCP server is hosted on a publicly accessible domain
• You are not using a local or testing endpoint
• If the server returns UI, you defined a content security policy (CSP) that allows the exact domains the component fetches from.

Template MCP server URLs

Most plugins should submit a universal MCP server URL: a single hosted MCP endpoint that works for all users and organizations. Choose Template only if the plugin uses workspace-specific MCP server URLs, such as when each customer has a separate tenant, workspace, or managed MCP endpoint. We only support template-based URLs for trusted developers with whom we have an established relationship.

Template submissions require two URL values:

• MCP Server URL: A concrete, working MCP endpoint for review and automated checks.
• Template MCP Server URL: The URL pattern that describes which part of the MCP endpoint changes across customer workspaces.

The review MCP server URL must be a real endpoint that OpenAI can connect to during submission review. Don’t enter a placeholder URL in the MCP Server URL field.

Use placeholders in the Template MCP Server URL for the parts that a workspace admin will configure later. Placeholders must use {name} syntax, start with a letter, and contain only letters, numbers, or underscores. Each placeholder name must be unique.

Make sure the concrete MCP Server URL matches the template pattern after replacing each placeholder with a real value.

For example:

https://{workspace}.example.com/mcp
https://mcp.example.com/{tenant}/mcp

Submit for review

If the prerequisites are met, you can submit the plugin for review from the plugin submission portal.

Start the review process

In the plugin submission portal:

1. Add your MCP server details (as well as OAuth credentials if OAuth is selected), and then select Scan Tools.
2. Complete the required fields in the submission form and check all confirmation boxes. You will need to provide the plugin name, logo, description, company and privacy policy URLs, MCP and tool information, test prompts and responses, and localization information. If the plugin has UI, you may also provide optional screenshots. Don’t provide screenshots when the plugin has no UI.
3. Select Submit for review.

Metadata stored during tool scanning

When you select Scan Tools, the dashboard imports metadata advertised by your MCP endpoint into the draft. This includes tool names, titles, and descriptions; input and output schemas; security schemes; _meta fields; tool annotations; linked UI resource metadata, including CSP settings; and MCP server instructions. The dashboard displays the annotation values provided by your server.

Your submission justifications should explain why those server-provided annotation values match each tool’s behavior. They don’t override the annotations. For example, if your server advertises readOnlyHint: false, describing the tool as “functionally read-only” in the justification doesn’t make the tool read-only. If the tool is truly read-only, update its server annotation to readOnlyHint: true, deploy the change, select Scan Tools again, verify the updated value, and then submit.

Each organization can publish multiple unique plugins with MCP. For each MCP server integration, only one version may be published at a time and only one version may be in review at a time. If you need to make changes after submitting, withdraw that submission by selecting Cancel Review and resubmit the same version draft.

For now, projects with EU data residency cannot submit plugins with MCP servers for review. Use a project with global data residency. If you don’t have one, create a new project in your current organization from the OpenAI Dashboard.

Review and approval

Once submitted, the plugin will enter the review queue. You can review the status within the Dashboard and will receive an email notification informing you of any status changes.

Reviews and checks

We may perform automated scans or manual reviews to understand how your plugin works and whether it may conflict with our policies.

Approval, rejection, and appeals

If your plugin is approved, we will notify you by email. Once approved, you can publish it from the plugin submission portal.

If your plugin is rejected or removed because of its MCP server, tools, or UI, you will receive feedback on which checks were unsuccessful. After making the necessary changes, you may resubmit the plugin for review. To appeal the decision, respond to the email you received with a clear rationale and any new information that can assist the review.

Getting help

If you have questions before, during, or after submission and the documentation does not answer them, contact OpenAI support. Include the ID shown in the plugin submission portal so the support team can identify your plugin.

Review and approval FAQs

How long does review take?

Review timelines may vary as we continue to build and scale our processes. Please do not contact support to request expedited review, as these requests cannot be accommodated.

What are common rejection reasons and how can I resolve them?

• We’re unable to connect to your MCP server using the MCP URL and/or test credentials we were given.
  • For servers requiring authentication, our review team must be able to log into a demo account with no further configuration required.
  • Ensure that the provided URL and credentials are correct, do not feature MFA (including requiring SMS codes, login through systems that require SMS, email or other verification schemes).
  • Ensure that the provided credentials can be used to log in successfully (test them outside any company networks, local area networks, or other internal networks).
  • Confirm that the credentials have not expired.
• One or more of your test cases did not produce correct results.
  • Review all test cases carefully and rerun each one. Ensure that outputs match the expected results. Verify that there are no errors in the UI (if applicable) - for example, issues with loading content, images, or other UI issues.
  • Ensure that the returned textual output closely adheres to the user’s request, and does not offer extraneous information that is irrelevant to the request, including personal identifiers.
  • Ensure that all test cases pass on the supported ChatGPT and Codex surfaces where the plugin will be available.
  • Compare actual outputs to precise expected behavior for each tool and fix any mismatch so results are relevant to the user’s input and the plugin reliably does what it promises.
  • If required, in your resubmission, modify your test cases and expected responses to be clear and unambiguous.
• Your plugin returns user-related data types that are not disclosed in your privacy policy.
  • Audit your MCP tool responses in developer mode by running a few realistic example requests and listing every user-related field the server returns (including nested fields and “debug” payloads). Ensure tools return only what’s strictly necessary for the user’s request and remove any unnecessary PII, telemetry/internal identifiers (for example, session, trace, or request IDs; timestamps; internal account IDs; or logs) and any auth secrets (tokens, keys, or passwords).
  • You may also consider updating your published privacy policy so it explicitly discloses all categories of personal data you collect, process, or return and why—if a field isn’t truly needed, remove it rather than disclose it.
  • If a user identifier is truly necessary, make it explicitly requested and directly tied to the user’s intent (not “looked up and echoed” by default).
• Tool hint annotations do not appear to match the tool’s behavior:
  • readOnlyHint: Set to true if it strictly fetches/looks up/lists/retrieves data and does not modify anything. Set to false if the tool can create/update/delete anything, trigger actions (send emails/messages, run jobs, enqueue tasks, write logs, start workflows), or otherwise change state.
  • Destructive hint: Set the destructive annotation to true if the tool can cause irreversible outcomes (deleting, overwriting, sending messages or transactions you can’t undo, revoking access, or destructive admin actions), even in only select modes, through default parameters, or through indirect side effects. Ensure the justification explains what is irreversible and under what conditions, including safeguards such as confirmation steps, dry-run options, or scoping constraints. Otherwise, set it to false.
  • openWorldHint: Set to true if it can write to or change publicly visible internet state (for example, posting to social media, blogs, or forums; sending emails, SMS, or messages to external recipients; creating public tickets or issues; publishing pages; pushing code or content to public endpoints; submitting forms to third parties; or otherwise affecting systems outside a private or first-party context). Set to false only if it operates entirely within closed or private systems (including internal writes) and cannot change the state of the publicly visible internet.

Publication and distribution

Publish the plugin

Once the plugin is approved, you can publish it from the plugin submission portal by selecting Publish.

Discovery

Once published, users can find your plugin in the universal directory shared by ChatGPT and Codex by:

• Clicking a direct link to the plugin listing in the directory.
• Searching for the plugin by name.

Plugins that demonstrate strong real-world utility and high user satisfaction may be eligible for enhanced distribution opportunities—such as directory placement or proactive suggestions—but few plugins will receive enhanced distribution at publication. Developers cannot request enhanced distribution.

Publication and Distribution FAQs

What happens after the plugin is approved? Will it be listed in the plugin directory automatically?

After the plugin is approved, you can choose to publish it from the plugin submission portal. You must publish before it can appear in the universal plugin directory.

Why can’t I see my plugin in the directory?

Plugins appear on the directory’s main pages only if OpenAI selects them for enhanced distribution. To confirm that your plugin is published, search for it using the exact publication name or open its directory URL from the plugin submission portal.

What should I do if I want to issue a press release or public announcement about my plugin?

Before issuing any press releases or public announcements regarding the launch of your plugin, please first reach out to press@openai.com to coordinate with our communications team.

Ongoing Maintenance

How published MCP metadata versions work

Treat the metadata exposed by your MCP server as a versioned API contract for the plugin. When you scan the MCP endpoint in the plugin submission portal, OpenAI stores the discovered metadata with that draft version. Submitting the version sends that stored snapshot for review. The published plugin uses this metadata snapshot while tool calls and UI resources continue to use your live MCP server.

Use this table to determine how to ship each change:

Breaking changes to the MCP server contract inside a published plugin aren’t currently supported. Removing or renaming a tool, making a schema incompatible, or serving incompatible content at or removing content from a published UI resource URI can break the current version as soon as the server change deploys. Make backward-compatible updates instead:

1. Add new tools, fields, or UI resources while continuing to honor the published contracts.
2. Submit the updated metadata as a new version.
3. Publish the approved version and keep the old contracts available.

You can deploy server-only fixes without submitting a new version if they preserve the published contract. If a deployment breaks the published version, roll back the server change rather than waiting for a new version to complete review.

Submitting new versions for review

Once your plugin is published, its submitted information and reviewed metadata snapshot are locked for safety. To update either, create a new draft version of the existing plugin and resubmit that version for review. Each resubmission starts a new review. In the release notes, describe what changed.

The MCP server origin (scheme, hostname, or port) can’t change between versions. To use a different origin, submit a new plugin with the new MCP server origin. You can change the endpoint path in a new version of the existing plugin.

We will review the updated plugin metadata again and inform you by email and in the plugin submission portal whether the update was approved or rejected. If rejected, you may update and resubmit or appeal the decision.

Once your resubmission is approved, you can publish the update, which will replace the previous plugin version.

If you’ve made additional changes to the plugin between submission and approval and want to submit a new version for review, cancel the review from the plugin submission portal and resubmit.

Changing published metadata versions and removing the plugin

Once a plugin is published, you can change its published version from the plugin submission portal by removing the current version from publication and publishing an approved replacement. You can remove the plugin from public visibility by removing the current version from publication and not publishing an alternative version.

To remove the plugin from your organization and from ChatGPT and Codex, delete it from the plugin submission portal.

Maintenance requirements

Plugins may be removed if they are inactive, unstable, or non-compliant. We may reject or remove any plugin from our services at any time and for any reason without notice, such as for legal or security concerns or policy violations.

Ongoing Maintenance FAQs

What happens if users report my plugin as harmful or misleading?

OpenAI reviews user reports and may review or investigate your plugin, including its MCP server, tools, and UI. Plugins that violate our policies may be restricted or removed. You may appeal a removal or other enforcement action by following the appeals process described here. Regularly review and respond to feedback, and update your plugin if issues are found.

How long will updates take?

Similar to new reviews, we are unable to offer estimated times for update reviews.