Best MCP Servers for ChatGPT in 2026

Every other post about this opens with a click path. We are not going to, and the reason is the useful part.

OpenAI's own help centre documents Apps and Plugins. It does not document connecting a custom MCP server. The route for doing that has changed more than once through 2026 — the Developer Mode toggle people were told to use has reportedly been removed — and the instructions written confidently in March were wrong by June.

So this page is built on the thing that has stayed stable: the permission model. That is also the thing you should be choosing a server on.

What ChatGPT's permissions actually offer

This is ChatGPT's real advantage over the other assistants, and it is underdiscussed.

Where most connectors give you an on switch, ChatGPT's app permissions have three settings:

• Always ask — the app cannot act without you confirming each time
• Allow read actions — reading is automatic, anything else asks
• Allow low-risk actions — a wider automatic band, still short of everything

That is a genuine attempt at tiering rather than a binary grant, and it is more than Grok offers. Worth knowing where the controls live, too: an app connects ChatGPT to an external service, a plugin packages capabilities into a workflow that may include apps and skills, and some apps require their own separate sign-in. Admins and owners can disable an app from workspace settings.

That last one is the control that matters once more than one person is involved. A permission tier is a personal choice. The ability to remove an app for the whole workspace is an organisational one.

Where the tiering still stops short

"Low-risk" is a category someone else defined. It is not a threshold you set.

There is no setting that says a refund under $500 proceeds and anything above it waits for a human. No rule that sending to ten recipients is fine and fifty is not. The tiers sort operations by kind, not by size, and most of the damage an assistant can do is a matter of size.

That is the gap every assistant shares, and we compared all three directly in Grok vs ChatGPT vs Claude connectors. The practical consequence is that if your use case touches money, deletion or outbound communication, the authorization layer is something you bring.

What makes an MCP server worth connecting here

Three things, in this order.

It must be remotely reachable. ChatGPT is a hosted product, so a server running on your laptop is not a candidate without a tunnel in front of it. This is the single biggest difference between connecting a server to ChatGPT and connecting the same server to an editor. Cursor and Claude Code start a local process and talk to it over stdio, exposing nothing. A hosted assistant needs an address it can reach from the internet, which means you are running an internet-facing service that can execute API calls on your behalf.

It must refuse things. A server that will run anything its catalog exposes is not something you can hand to a permission tier and call governed. What you want is a finite list of operations, where everything outside the list fails before a request goes anywhere.

It must leave a record you own. ChatGPT will show you what it tried to do. That is a chat transcript, not an audit trail, and it systematically omits the calls that were refused — which are the interesting ones.

Everything else, including the tool count in a server's README, is secondary.

The context cost nobody mentions

Each connected server puts its tool definitions in front of the model. Connect six servers with twenty tools each and you have spent a meaningful part of the context window describing tools before the conversation starts, and you have made the model's tool-selection problem harder at the same time.

The symptom is not an error. It is the model picking a plausible-looking wrong tool, or forgetting something you said earlier because the tool definitions pushed it out. We wrote about the same effect in editors in best MCP servers for Cursor.

The fix is fewer servers with broader reach, not more servers.

One server, seven tools, 363 APIs

This is the shape we build for, and it exists because of the context problem above.

The Swytchcode MCP server's default agent profile exposes seven tools — discover, info, exec, list, search, add, and a read-only policy — and those seven reach every integration in the catalog. The model searches for an operation rather than being handed a thousand definitions up front. The full argument is in connect any AI tool to any API with MCP, and if MCP itself is new to you, start with what is MCP.

Setup is a CLI, and there is no .env file anywhere in it:

npm install -g swytchcode
swy login
swy init --mode=sandbox

swy get stripe
swy discover "refund a charge"        # find the operation
swy info stripe.refund.create3        # check its real parameters
swy add method stripe.refund.create3  # allow exactly this one
swy auth connect stripe

Only methods added with swy add method can run. If the model asks for anything else, the call fails at the runtime before a request reaches Stripe. A server with four allowed methods can do four things, however it is reached and whatever the model has been told.

The credential sits in ~/.swytchcode/credentials.db, outside your project, injected when a call executes. Nothing secret reaches ChatGPT. That separation is credential brokering.

And because an allow list permits an operation without saying anything about scale, the threshold goes in a policy:

{
  "id": "big-refunds",
  "target": ["stripe.refund.create3"],
  "when": { "field": "amount", "operator": ">", "value": 50000 },
  "action": {
    "type": "REQUIRES_APPROVAL",
    "message": "Refunds over 500.00 need approval"
  },
  "approval_timeout": "2h"
}

A rule in version control, evaluated when the call runs. That is the thing ChatGPT's "low-risk" tier cannot express, and the reasoning is in policy-as-code for AI agents.

Exposing it to ChatGPT

The honest version: the server is stdio by default, and its HTTP transport binds to localhost deliberately.

swy mcp serve --transport http --port 5476

That serves at http://127.0.0.1:5476/sse on the loopback interface only, with a bearer token:

swy mcp token            # print the current token
swy mcp token --rotate   # invalidate it and issue a new one

Reaching it from a hosted assistant means putting a tunnel or reverse proxy in front of it. Three things to get right first:

Terminate TLS at the tunnel. Plain HTTP is fine on loopback and not fine across the internet.

Treat the token as a production credential. Anyone holding it can invoke whatever your allow list permits. Rotate it if it has ever appeared in a chat window, a screenshot or a support ticket.

Assume the endpoint will be found. The protection is the allow list and the policies, not obscurity.

We went through the same decision for Grok, which documents the public-internet requirement explicitly, in Grok Bring Your Own MCP. The reasoning transfers directly.

For the current click path inside ChatGPT, check OpenAI's developer documentation rather than this page or any other blog. It has moved, and it will move again.

Keeping a record

swy audit network   # what ran, with status and timing
swy audit policy    # what was denied or held, and by which rule

The field that matters most is the policy decision with its rule version, because that is the part you are accountable for rather than the vendor. Full list in logging every API call an agent makes.

Before you connect anything

Two questions, and they take about a minute.

Given everything this assistant can read, and everything it can do, what is the worst sentence someone could put in front of it? Content an assistant reads can carry instructions, so a read connector plus any action-capable connector is a path to action regardless of the permission tier.

And: who can revoke this, how fast? In a workspace, that answer should name an admin, not the person who set it up.

The longer version of both is in a security checklist before connecting any AI assistant to company data.

FAQ

Does ChatGPT support MCP servers?

Yes, though OpenAI's help centre documents Apps and Plugins rather than the custom MCP path, and the route for adding a custom server has changed more than once during 2026. Check OpenAI's developer documentation for the current steps. The stable requirement is that a custom server must be remotely reachable, not running locally.

How do I add an MCP server to ChatGPT?

Through a custom connector pointing at your server's URL, with whatever authentication it requires. We deliberately do not give a click path here: the setup has changed repeatedly, including the removal of the developer-mode toggle people were previously told to use, so any specific sequence in a blog post is likely to be out of date.

What are the best MCP servers for ChatGPT?

The ones that refuse things. Practically, judge a server on three questions: can it be reached remotely, can you enumerate exactly which operations it will run, and does it write a log you keep. Tool count is the least useful number in the comparison, and more servers actively costs you context and tool-selection accuracy.

Can ChatGPT connect to a local MCP server?

Not directly. It is a hosted product, so the server needs an address reachable from the internet, typically via a tunnel with TLS. Editors like Cursor and Claude Code are different: they launch a local process and talk to it over stdio, exposing nothing, which is a materially safer posture for the same server.

What permissions should I give a ChatGPT connector?

Start at always ask, move to allow read actions once you know what it does, and only widen beyond that if nothing destructive is reachable. Remember the tiers sort operations by kind rather than size, so a threshold-based rule has to live in whatever executes the calls.

Does ChatGPT see my API keys?

Not with a brokered setup. Credentials stay in the local store on the machine running the server and are injected at execution time, so nothing secret crosses the connection. If your setup instead puts keys in a prompt or an environment variable the model can read, then yes, and that is worth fixing first.

How many MCP servers should I connect?

Fewer than you want to. Every connected server's tool definitions are placed in front of the model, so sprawl spends context and makes tool selection less accurate. One server with broad reach beats six narrow ones.

Setup commands on this page come from the Swytchcode CLI docs. ChatGPT's permission model is described from OpenAI's own help documentation rather than linked.