Connect ChatGPT to a local MCP server

ChatGPT reaches your tunnel over Streamable HTTP at its public URL. You add it as a custom connector / remote MCP server and paste the tunnel URL:

https://notes--acme.mcppipe.dev/mcp

Where that field lives in the ChatGPT interface is OpenAI’s to document and moves with their UI, so follow their instructions for adding a connector. Everything below is the mcppipe side.

The request comes from OpenAI, not from you

This is the thing that trips people coming from a desktop client. Cursor and Claude Desktop call your tunnel from your own network; a ChatGPT connector calls it from OpenAI’s infrastructure.

So if you restrict the tunnel with an IP allowlist, the entry is OpenAI’s published egress range — the OpenAI one-click preset — and not your own IP. Using your own address produces a 403 ip_forbidden on every call, with nothing wrong on your end.

Running both ChatGPT and Claude against the same tunnel is the Multi-LLM preset, which expands to the union of the Anthropic and OpenAI ranges. That is the whole point of a vendor-neutral tunnel: one host, both agents, one click.

No interstitial to click through

A connector fetches your URL programmatically — there is no browser and nobody to dismiss a warning page. mcppipe relays your MCP server’s response verbatim on every plan, including Free: no anti-phishing interstitial is injected and there is no header to set to bypass one.

This matters specifically for connectors, because an HTML warning page served in place of a JSON-RPC response does not fail cleanly — the client sees a malformed MCP response rather than a clear error.

Authentication

A connector reaching your machine from a shared cloud range is the case that most deserves a real credential. Switch the tunnel’s auth mode to OAuth; for a connector that runs unattended, a Service Token avoids the browser consent flow entirely. See Authentication: OAuth & Service Tokens.

Governance is worth turning on here

You control the ChatGPT side least of any client. The per-tunnel controls that matter most in that position:

An allow/deny tool policy, so a connector can only call what you listed.
Tool pinning, which blocks a tool whose description drifts from the baseline you approved.
Redaction, so arguments you never want recorded are masked before they are stored.

See Tool governance and Privacy: redaction & zero-knowledge.