Review permissions before connecting an AI tool
Check account identity, read and write authority, source scope, and revocation before approving a browser or MCP connection.
Choose what gets shared 3 min read
ChatGPT custom apps: what you agree to
Adding a custom app to ChatGPT means ticking a box that says you have read OpenAI’s risk warning. ChatGPT can then send the server parts of your chat and call its tools, including tools that change data. Add only a server you know and trust.
ON THIS PAGE
What the box agrees to
ChatGPT adds custom apps from its Plugins page. You choose to add a custom MCP server, give it a name and the server’s address, and pick how it signs in. Before ChatGPT creates it as a plugin, you read OpenAI’s risk warning and tick “I understand and want to continue”. That tick is the agreement. OpenAI’s current steps do not ask you to turn on Developer mode first.
The new app sits with your personal plugins, and you call it in a chat by typing @ and picking it. Adding a custom app needs a paid ChatGPT plan. On a work account, your workspace’s rules also decide whether you can add one at all.
What the warning is about
OpenAI’s developer docs name three risks. The first is prompt injection: instructions hidden in content the server can reach, such as an email or a support ticket, can steer the model toward actions you did not ask for. OpenAI’s advice is to trust everything the server can read, not only the people who built it.
The second is write actions. ChatGPT asks you to confirm a write before it happens, but OpenAI warns that a write can still happen when a server tags an action read-only. The tag is only as good as the server.
The third is what the server sees. Any MCP server may receive sensitive data while ChatGPT uses it, including details you gave ChatGPT earlier in the chat. OpenAI recommends connecting only to servers you know and trust, and prefers official servers run by the service itself.
Check it first, and cut it off when you are done
Before you tick the box, find out who runs the server and which of its tools change data. Then read each write request in full before you confirm it.
To stop an app, open its page under Plugins. You can disconnect your account from the menu beside it, or uninstall the app. ChatGPT keeps an uninstalled custom app with your personal plugins. Neither step takes back what the server already received, so ask the service if you want that deleted.
TAKE THIS WITH YOU
Checklist before you tick the box
An illustrative template. Replace the details with material you are allowed to share.
I know who runs this server and I trust them: yes / no I know which tools read and which change data: yes / no The app cannot read email or pages from strangers: yes / no This chat holds nothing I would not show the server’s owner: yes / no I will read each write request before I confirm it: yes / no I know where to disconnect or uninstall the app: yes / no
USING THIS WITH DRAY
Keep the context. Check the source.
Dray connects to ChatGPT as a custom app. Its setup fills in the form, but the box is yours to tick, and Dray never ticks it for you. Dray’s approval page then lists what ChatGPT may do. By default a connected assistant can read your memories and also add, change, or mark them out of date. ChatGPT’s own confirmations still decide when it asks before calling Dray.
Available sources and connections depend on your setup. Read the privacy policy before granting access.
Sources & next reads
Product details are grounded in the guides below. Example projects and prompts are illustrative, not customer results.