# ChatGPT plugin and MCP server security checklist > Check these before installing a ChatGPT plugin or MCP server: publisher, OAuth scopes, write actions, prompt injection, data retention and admin controls. Published: 2026-10-03 · Updated: 2026-10-04 · By: Divy Chaurasia · Tags: security, mcp Before you install a ChatGPT plugin or connect an MCP server, check five things: who publishes it, what account access it asks for, which of its tools can change things, where your data goes and how long it is kept, and whether it will read untrusted content that could steer the model. Public plugins in the Plugin Directory go through OpenAI review; MCP servers you add yourself in developer mode or Codex do not, so they deserve more care. None of this is a reason to avoid plugins. It is the same diligence you would apply to any app you grant access to your email or code. Use the checklist below, then read the sections for the reasoning. ## The checklist | # | Check | Where to look | | --- | --- | --- | | 1 | The publisher is who it claims to be | Listing details, publisher domain, source repo | | 2 | You know what the plugin bundles (skills, MCP servers, hooks) | Listing details, plugin repo | | 3 | Requested OAuth scopes match what you need | The consent screen; the service's scope options | | 4 | Write and delete tools need your confirmation | ChatGPT app permissions; Codex approval settings | | 5 | Untrusted content and write tools aren't mixed without review | Your own workflow | | 6 | The privacy policy covers retention and deletion | Listing's privacy policy link | | 7 | Custom MCP servers come from a source you trust | Server URL, repo, package name | | 8 | Secrets live in env vars or OAuth, not in prompts or config files | `config.toml`, API calls | | 9 | Admins have scoped roles and actions | Workspace plugin controls | | 10 | You disconnect what you no longer use | Plugin page and app connections | ## 1. Verify the publisher In our directory, listings marked official come from the company behind the product or from OpenAI. In ChatGPT, the Plugin Directory separates plugins built by OpenAI, plugins provided by your workspace, and personal plugins ([OpenAI docs](https://learn.chatgpt.com/docs/plugins)). OpenAI's [plugin guidelines](https://developers.openai.com/plugins/plugin-guidelines) require every public submission to come from a verified individual or organization, and forbid tool descriptions that manipulate which plugin the model picks. That review covers the public directory. It does not cover: - **Community plugins from marketplaces.** Codex can add third-party marketplaces from GitHub. Read the repository first. Trail of Bits, for example, publishes security skills this way. - **MCP servers you add by URL or command.** Check that the URL belongs to the vendor (for example `mcp.sentry.dev` for Sentry) and that a local package name matches the official repo. Our [MCP directory](/mcp) flags archived and deprecated servers. > **plugin:** [Supply Chain Risk Auditor (Trail of Bits)](https://chatgptplugins.directory/plugins/trailofbits-supply-chain-risk-auditor): Audit npm, PyPI and Go dependencies for supply-chain risk ## 2. Know what you are installing A plugin can contain skills, MCP servers and hooks. Each carries a different kind of risk: - **Skills** are instructions, sometimes with helper scripts. Scripts run with whatever permissions the host gives them. - **MCP servers** call external services with your account. - **Hooks** run commands at set points in the Codex runtime. OpenAI's docs tell you to review hooks and decide whether you trust them before they run. Plugins marked **Desktop only** run in the ChatGPT desktop app, where some can reach local files or apps. Apple Messages, for instance, can read and send messages on your Mac once you grant macOS permissions. ## 3. Check permissions and OAuth scopes When a plugin asks you to connect an account, the consent screen shows what it can access. Ask whether each scope is needed for what you will use it for. Many services let you narrow access: - GitHub's [MCP server](/mcp/github) lets you enable toolsets selectively. - Supabase's [MCP server](/mcp/supabase) supports read-only mode and limiting access to one project. - Linear offers a read-only MCP endpoint; Neon supports read-only mode and project scoping. - In Codex, `codex mcp login --scopes read` requests only the scopes you list ([Codex MCP docs](https://learn.chatgpt.com/docs/extend/mcp)). > **MCP server:** [Supabase](https://chatgptplugins.directory/mcp/supabase): Manage Supabase databases, migrations, edge functions and logs Two details that often confuse people: - **Sign in with ChatGPT** shares only your name, email address and profile picture with the partner. It does not grant access to your data or approve actions; that is a separate step. - **Which identity is used.** A personal connection uses your account. In workspaces, a shared connection uses the connected account's permissions, which may be broader than yours. Check before you run actions. ## 4. Control write actions The biggest practical risk is a tool that changes something: sends an email, merges a PR, issues a refund, deletes a record. **In ChatGPT:** - Since June 2026 you can choose when connected apps ask for permission: always, before making changes, or only before important changes. Business and Enterprise admins set workspace defaults ([OpenAI changelog](https://developers.openai.com/plugins/changelog)). - In developer mode, write tools ask for confirmation by default, and any tool without a `readOnlyHint` annotation is treated as a write ([developer mode guide](https://developers.openai.com/api/docs/guides/developer-mode)). Expand a tool call to see the exact JSON it will send. - Be careful with persistent approvals. OpenAI's docs warn that choosing **Always allow sending to this chat** for Apple Messages means you no longer get a last look at each message before it goes out. **In Codex:** set approvals per server or per tool in `~/.codex/config.toml` with `default_tools_approval_mode` or `tools..approval_mode`, and limit tools with `enabled_tools` and `disabled_tools`. ```toml [mcp_servers.github] url = "https://api.githubcopilot.com/mcp/" bearer_token_env_var = "GITHUB_PAT" # token stays in your environment default_tools_approval_mode = "writes" # ask before write tools disabled_tools = ["merge_pull_request"] ``` **In the OpenAI API:** the Responses API `mcp` tool takes `require_approval` and `allowed_tools`, so only the tools you list are imported ([MCP guide](https://developers.openai.com/api/docs/guides/tools-connectors-mcp)). See [Use MCP in the OpenAI API](/tutorials/mcp-in-the-openai-api). Approvals matter more as work becomes unattended. ChatGPT Work tasks, dots and MCP Events can run tools without you watching each step ([DevDay notes](/blog/devday-2026-what-it-means-for-plugin-builders)). ## 5. Plan for prompt injection Prompt injection happens when content the model reads (an email, a web page, a GitHub issue, a document comment) contains instructions that the model follows. OpenAI's developer mode docs call out prompt injection, destructive writes and malicious servers as the main risks, and its [security guidance for builders](https://developers.openai.com/plugins/guides/security-privacy) tells them to "assume prompt injection and malicious inputs will reach your server." You can't remove the risk, but you can contain it: - **Separate reading from acting.** A session that reads your inbox and can also send email or push code is the riskiest combination. Keep confirmations on for those writes. - **Read before you approve.** A confirmation is only useful if you check the recipient, repository or amount. - **Be wary of public inputs.** Issues and pull requests on public repos, inbound support tickets and scraped web pages are all written by people you don't know. ## 6. Know where data goes and how long it stays When ChatGPT sends data through an MCP server, that service's terms and privacy policy apply ([OpenAI docs](https://learn.chatgpt.com/docs/plugins)). OpenAI requires public plugins to publish a privacy policy covering the data collected, its purposes, recipients and retention timelines, and you can review it before installing ([plugin guidelines](https://developers.openai.com/plugins/plugin-guidelines)). On the ChatGPT side, OpenAI's [admin guidance](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors) distinguishes non-synced connections (data processed transiently and not indexed) from synced connections (content indexed in advance), and says information accessed through these connections is not used for model training for Business, Enterprise and Edu customers. Normal chat retention still applies, and those conversations remain available through the Compliance API. One easy-to-miss point: **uninstalling a plugin doesn't disconnect its MCP integrations.** Separately connected integrations stay connected until you disconnect them. ## 7. Treat custom MCP servers like dependencies Adding your own MCP server, through developer mode in ChatGPT or `codex mcp add`, gives you full control and full responsibility. OpenAI labels developer mode as elevated risk. - **Prefer the vendor's hosted server** with OAuth over a third-party wrapper that asks for an API key. - **Pin local servers.** `npx -y package` fetches whatever version is current each time. Pin a version for anything with access to real accounts. - **Keep secrets out of config files and prompts.** Use `bearer_token_env_var` in Codex, or OAuth with `codex mcp login`. In the Responses API, the `authorization` field is sent per request and not stored by OpenAI. - **Keep private servers private.** Secure MCP Tunnel connects an on-premises server to ChatGPT, Codex or the API without exposing it publicly ([guide](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels)). - **Test before you trust.** Use [MCP Inspector](/tutorials/test-mcp-server-with-inspector) to see which tools a server exposes and what they return. Step-by-step setup: [Add an MCP server to ChatGPT](/tutorials/add-mcp-server-to-chatgpt). ## 8. For workspace admins OpenAI's admin docs describe a chain of controls: whether a plugin is available to a role, whether its MCP server is enabled, which actions are allowed, and what the connected service itself permits ([plugin controls](https://learn.chatgpt.com/docs/enterprise/apps-and-connectors)). Practical steps from that guidance: - **Start with read actions.** Where a connection supports **Action control**, allow read-only actions or an approved custom set, and decide how newly added actions are handled. - **Document each connection:** business owner, permitted data, approved actions, authentication method, and a removal contact. - **Test with a least-privilege account** before enabling writes for everyone. - **Review marketplace syncs.** A GitHub marketplace imported into the workspace syncs daily and imports new plugins automatically, so review repository changes before they merge ([plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management)). - **Set agent policies.** Agent Security, announced at DevDay 2026, controls which tools agents can use and how they access files and the network ([Agent Security](https://learn.chatgpt.com/docs/enterprise/agent-security)). For code itself, OpenAI's Codex Security plugin scans repositories and proposes fixes. > **plugin:** [Codex Security](https://chatgptplugins.directory/plugins/codex-security): Security scanning for your codebase ## Red flags Skip or investigate a plugin or server if: - The publisher name doesn't match the domain or repository. - It asks for full account access when you only need lookups. - It wants an API key pasted into chat. - Tool descriptions are vague about what they change. - There is no privacy policy, or it says nothing about retention. - A local server's package was published recently by an unknown account with a name close to a well-known one. Most of the plugins in [/plugins](/plugins) and [/apps](/apps) come from the companies whose products they connect to. With scoped access and confirmations on, they are safe to use for everyday work. To get started, see [How to install plugins in ChatGPT](/tutorials/install-plugins-in-chatgpt), or for terminology, [Plugins vs apps vs MCP servers vs skills](/blog/plugins-vs-apps-vs-mcp-servers-vs-skills). ## Listings in this post - [GitHub](https://chatgptplugins.directory/mcp/github.md): Manage repos, issues, pull requests and Actions from your AI agent - [Supabase](https://chatgptplugins.directory/mcp/supabase.md): Manage Supabase databases, migrations, edge functions and logs - [Codex Security](https://chatgptplugins.directory/plugins/codex-security.md): Security scanning for your codebase - [Supply Chain Risk Auditor (Trail of Bits)](https://chatgptplugins.directory/plugins/trailofbits-supply-chain-risk-auditor.md): Audit npm, PyPI and Go dependencies for supply-chain risk --- Source: https://chatgptplugins.directory/blog/chatgpt-plugin-security-checklist · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.