Connecting a Model Context Protocol (MCP) server is a two-part job: the server must be reachable, and the AI client must be configured to discover and authorize its tools. The exact screens and fields differ between an API integration, a ChatGPT custom app, Visual Studio Code, and Claude. Start by identifying the client, deciding whether the server is public or private, and defining the credentials and tool approvals it needs. Then use that client’s setup path, test one low-risk tool, and troubleshoot from the server status and logs outward.
The instructions below reflect official documentation available on October 13, 2026. Product plans, labels, rollout status, supported transports, and administrator controls can change, so open the linked documentation for the client and account you are configuring.
As an Amazon Associate I earn from qualifying purchases.
What an MCP connection actually does
MCP is a protocol that lets an AI application discover and call tools or retrieve data from an external server. A server might expose search, file access, database queries, ticket creation, calendar operations, or other actions. Installing or hosting that server does not automatically connect it to an assistant. The client still needs an endpoint, transport details, authentication, tool approvals, and sometimes workspace permission.
Recommended Free Tools
Think of the connection as four layers:
- Reachability: the client must be able to reach the MCP endpoint. A cloud client generally cannot call a process that exists only on your laptop or inside an unexposed corporate network.
- Protocol negotiation: the client and server establish an MCP session and exchange the server’s declared tools and capabilities.
- Identity: the server may require OAuth, an access token, an API key, or another credential to reach the connected service.
- Action control: the assistant platform and workspace can limit which tools are enabled and whether each call requires your approval.
A successful connection therefore does not mean every tool is safe or available. Read, create, modify, and delete operations are separate capabilities that should be reviewed individually.
Make three decisions before entering any settings
1. Which AI client are you configuring?
Choose the actual product path first. An OpenAI Responses API request, a ChatGPT custom MCP app, VS Code, and a Claude custom connector do not share a universal configuration file or permission model.
| Client | Where configuration happens | Important control |
|---|---|---|
| OpenAI Responses API | Your API request’s mcp tool configuration |
Remote URL or Secure MCP Tunnel identifier, optional OAuth, and tool approvals |
| ChatGPT custom MCP app | ChatGPT on the web, subject to account and workspace policy | App access, authentication, risk review, and action permissions |
| Visual Studio Code | MCP gallery or the applicable MCP JSON configuration | Workspace trust and the enabled tool list |
| Claude | Supported custom-connector flow in the Claude client or workspace | Remote cloud-origin networking, OAuth scopes, and tool approval prompts |
Use the documentation for the selected client rather than copying a configuration intended for another one. Field names, supported transports, account eligibility, and approval behavior can change independently.
2. Is the server public or private?
A public remote server has an HTTPS endpoint reachable from the client’s network. A private or local server stays on a workstation, inside a private subnet, on premises, or behind a firewall. You can expose the latter through a controlled tunnel instead of publishing it to the internet. OpenAI’s Secure MCP Tunnel documentation describes this model for private, on-premises, and firewalled servers: https://developers.openai.com/api/docs/guides/secure-mcp-tunnels.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWrite down which machine actually initiates the connection. With an API or cloud connector, the request may originate in the provider’s infrastructure, not from your browser. That affects firewall allowlists, DNS, IP restrictions, and where data travels.
3. What identity and actions are required?
Separate the server credential from the assistant’s tool permission. OAuth or another credential lets the MCP server access an external service. The AI platform’s approval and tool controls determine whether the model can invoke a discovered operation and whether you must confirm it first.
- Use the narrowest OAuth scopes that support the task.
- Enable only the tools the workflow needs; leave administrative, destructive, or unrelated tools disabled.
- Decide whether calls require per-use approval, especially for writes, external messages, purchases, file changes, or deletes.
- Know whether a credential is individual or shared. A shared key can give every connector user the same underlying access, rather than preserving each person’s separate identity.
Connect an MCP server with the OpenAI Responses API
The official API flow is documented at https://developers.openai.com/api/docs/guides/tools-connectors-mcp. It uses an MCP tool entry in the Responses API request.
For a public remote server
- Confirm that the server has a stable, reachable URL and that its MCP transport is supported by the API documentation.
- In the Responses API request, add an MCP tool configuration with a label and the server’s
server_url. - If the server protects access with OAuth, obtain an access token through the server’s documented authorization flow and pass it in the configuration’s
authorizationvalue. Do not put a client secret in a prompt or expose it to the model. - Choose the server tools you want the model to use and configure the API’s approval behavior. Approvals provide visibility into data sent to a remote server and let your application stop a call before it runs.
- Send a low-risk test request that exercises a read operation. Confirm in both the API response and the server logs which tool was discovered and invoked.
The public OpenAI Docs MCP example is read-only and does not require authentication. That example is not evidence that other servers are unauthenticated; follow each server’s own credential requirements.
For a private server through Secure MCP Tunnel
- Run or deploy the MCP server inside the private network where its protected data and dependencies are available.
- Set up Secure MCP Tunnel according to the current OpenAI instructions and obtain the tunnel identifier.
- In the API’s MCP tool configuration, use the tunnel’s
tunnel_idinstead of publishing a publicserver_url. - Configure the server’s authentication and the tunnel’s access policy. A tunnel hides the server from public internet exposure; it does not remove the need to authenticate users or restrict tools.
- Test reachability from the API environment, then inspect server and tunnel logs if the request does not discover tools.
Keep the distinction clear: a tunnel changes network reachability, while OAuth or another credential establishes the server-side identity. You may need both.
Add an MCP server as a ChatGPT custom app
ChatGPT’s custom MCP app flow is separate from the API. The current product guide is https://help.openai.com/en/articles/12584461-developer-mode-and-mcp-apps-in-chatgpt.
- Open ChatGPT on the web and enter the developer or custom-app area available to your account.
- Choose the option to add an MCP app, then provide the remote server URL or select a configured tunnel.
- Complete the server’s authentication flow. Review the requested OAuth scopes before granting consent.
- Read the displayed risk information and inspect the server’s declared actions. Treat write-capable tools as capable of changing connected data.
- Create the app, then verify which tools are enabled and whether each action requires approval.
- If you are in a managed workspace, ask an administrator to confirm that the app and its actions are permitted by workspace policy.
Availability is account- and role-dependent. OpenAI’s October 2026 help guidance describes full MCP write support as rolling out in beta for Business and Enterprise/Edu, while Pro users in developer mode have read/fetch permissions in the documented circumstances. Those controls can change; the account’s current interface and administrator settings take precedence.
Workspace administrators may restrict app installation, allowed domains, authentication methods, or action types. If the add-app control is missing, check plan eligibility and workspace policy before debugging the server.
Add and manage an MCP server in Visual Studio Code
VS Code’s current setup guide is https://code.visualstudio.com/docs/agent-customization/mcp-servers. The process is local to the editor and its workspace.
Install from the MCP gallery
- Open the Extensions view and search the MCP gallery for the server you need.
- Review the publisher, repository or documentation link, requested arguments, environment variables, and declared tools.
- Install the server and accept the configuration prompt only after you understand what process will run and what files or network services it can access.
- When VS Code asks whether to trust the server or its configuration, verify the source first. A local MCP server can execute code on your machine with the permissions of the process that starts it.
- Open chat and use Configure Tools to inspect the discovered tools. Disable anything unrelated to the current task.
Add a server manually
- Open the MCP JSON configuration file used by your VS Code installation or workspace.
- Add the server’s documented command, arguments, environment variables, and transport exactly as its publisher specifies. Do not paste a JSON example from another client.
- Save the file and approve the trust prompt if the source and command are acceptable.
- Use Configure Tools to confirm discovery, then run a harmless read operation in chat.
Workspace trust can affect servers declared in workspace configuration. For shared repositories, review configuration changes as code: a malicious command or environment reference can run when another developer opens the project.
Connect Claude to a remote MCP server
Claude’s remote custom-connector instructions are at https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp.
- Open the supported custom-connector route for your Claude account or workspace.
- Enter the remote MCP server endpoint and start its authentication flow.
- Review every requested OAuth scope. Reject scopes that exceed the task, and use a separate account or service identity when appropriate.
- Read each tool’s description and examine approval prompts before allowing calls without repeated confirmation.
- Run a read-only test and check the connected service’s audit log for the resulting request.
Claude connects to a remote MCP server from Anthropic’s cloud infrastructure. Your firewall therefore needs to permit that cloud-origin traffic, and the server may receive data from the conversation. If your organization requires traffic to originate from a controlled network, use an architecture that satisfies that requirement rather than assuming a browser session changes the source location.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Be especially careful with shared API keys. If every connector user authenticates through one key, the server may see the shared identity and grant its full access to each user. Individually delegated OAuth access provides a different accountability and revocation model.
Understand the two permission boundaries
Server-side access
The MCP server’s credential determines what the connected application permits. OAuth scopes, API-key roles, database grants, filesystem permissions, and network policy all apply here. A tool described as “search” might still read sensitive records if the underlying account can access them.
Assistant-side tool control
The client determines which discovered tools are exposed to the model and whether a person must approve each invocation. Approval prompts improve visibility, but they do not make an untrusted server safe. A prompt can be misunderstood, and a tool can perform more than its short name suggests. Connect only servers you trust, inspect updates to their tool list, and keep high-impact operations behind explicit approval.
Use a least-privilege review checklist
- List every enabled tool and classify it as read, create, modify, or delete.
- Map each tool to the minimum data source, account, and OAuth scope required.
- Disable tools that are not needed for the current project.
- Require approval for writes, external communications, credential changes, and destructive operations.
- Set expiration or rotation for tokens and shared credentials.
- Record who approved the server, which version was reviewed, and when the tool list changes.
Public remote server versus private server and tunnel
Neither deployment model is universally safer. The right choice depends on who must reach the server, where sensitive data is allowed to flow, and who operates the network boundary.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Decision factor | Public remote URL | Private server through a tunnel |
|---|---|---|
| Reachability | Client connects directly to an internet-reachable endpoint. | Client reaches a tunnel that forwards to a private, on-premises, or firewalled server. |
| Internet exposure | Endpoint is publicly reachable and must be hardened, monitored, and rate-limited. | Application server can remain unexposed; the tunnel becomes the controlled entry point. |
| Data path | Traffic moves between the client and the public service. | Traffic crosses the provider’s tunnel path and the private network; verify organizational data-flow requirements. |
| Authentication | OAuth, an API key, or another server credential is still required when the server demands it. | Tunnel access and server authentication are separate controls and may both be required. |
| Operations | Provider must patch, monitor, and scale the public endpoint. | Private operators must keep the server, tunnel agent, firewall rules, and certificates healthy. |
| Best fit | Services designed for multiple internet clients and public availability. | Internal systems, regulated data, development machines, or services that cannot be publicly exposed. |
Document the machine that starts each component, the identities used, and the firewall rules. This prevents a common failure in which a server works from a developer’s browser but cannot be reached by a cloud-origin assistant.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot an MCP server that will not connect
Start with observable facts: server process status, client status, and logs. Do not begin by repeatedly changing prompts or reinstalling the client.
VS Code’s documented sequence
For VS Code, Microsoft’s troubleshooting guide is https://code.visualstudio.com/docs/agents/agent-troubleshooting/troubleshooting.
- Run MCP: List Servers from the Command Palette.
- Select the affected server and inspect its status.
- Choose Show Output and read the startup, transport, authentication, and tool-discovery error.
- Correct the reported command, argument, environment variable, endpoint, or credential.
- Select Restart Server.
- Retry a simple tool call and compare the result with the server output.
If the process is running but chat does not invoke a tool, treat that as a discovery or invocation problem rather than only a process problem. Confirm that the tool appears in Configure Tools, is enabled, and matches the request. For Docker-based servers, verify the image and arguments and ensure the container is not running detached when VS Code expects an attached process.
General checklist for API, ChatGPT, and Claude
- Server health: confirm the process is running, listening on the expected port, and producing logs. Check startup exceptions before changing client settings.
- Endpoint and route: verify the complete URL, path, TLS certificate, reverse-proxy route, and supported transport. A web page loading successfully does not prove that the MCP route works.
- Network origin: test from the same network or cloud environment used by the assistant. Check DNS, firewall allowlists, private routing, and proxy requirements.
- Authentication: verify token expiry, OAuth scopes, audience, redirect configuration, API-key role, and whether the credential belongs to the intended user or shared service identity.
- Tool discovery: compare the client’s discovered tool list with the server’s advertised list. A missing tool can indicate a capability filter, workspace policy, or server initialization error.
- Approval state: check whether the call is waiting for user confirmation or blocked by an administrator’s action policy.
- Logs together: match the client’s timestamp and request identifier with server, tunnel, reverse-proxy, and connected-service logs. The first error in the chain is usually more useful than the final “connection failed” message.
Match symptoms to likely causes
| Symptom | Likely area | First check |
|---|---|---|
| Server never appears in the client | Configuration, trust, or process startup | Client configuration path, command, and startup output |
| Server appears but has no tools | MCP negotiation or initialization | Server logs and the client’s tool-discovery view |
| Tool appears but calls fail immediately | Credential, scope, route, or input schema | Token validity and the server’s request log |
| Cloud client cannot reach a local server | Network origin or private routing | Public endpoint versus tunnel requirement and firewall rules |
| Call pauses or is rejected in the UI | Approval or workspace policy | Pending approval prompt and administrator controls |
| Container exits or hangs | Docker command, attached mode, or environment | Arguments, environment variables, and container logs |
Operate the connection safely after setup
Test with a deliberately small action
Use a read-only request against non-sensitive data first. Confirm the exact tool name, arguments, returned data, and audit entry. Only then enable write-capable tools or connect production accounts.
Watch for tool-list changes
Servers can add or alter tools during updates. Re-review the declared operations, scopes, and approval policy after upgrades, endpoint changes, or ownership changes. A previously harmless name is not a guarantee of unchanged behavior.
Plan token and account lifecycle
Rotate credentials, revoke unused OAuth grants, remove departed users, and document shared identities. For private deployments, patch the host and tunnel agent, monitor certificate expiry, and keep firewall rules no broader than necessary.
Separate environments
Use different server instances or credentials for development and production when practical. A test prompt should not be able to modify production records merely because both environments expose a similarly named tool.
Free tools Windows power users keep installed
One-click scans. No signup required.
When to stop and redesign the connection
Pause the setup if you cannot identify who operates the server, what data leaves your network, which identity the server uses, or which tools can change data. Also stop if the client requires a plan or workspace capability your organization has not approved. Moving from a public URL to a private tunnel, replacing a shared key with delegated OAuth, or removing write tools is often a better fix than adding more prompts or retries.
Bottom line
Connect MCP by matching the client’s supported configuration to the server’s network location and identity model: use an MCP tool with server_url or a Secure MCP Tunnel tunnel_id in the OpenAI Responses API, the web app flow for a ChatGPT custom app, the gallery or trusted MCP JSON configuration in VS Code, and the remote custom-connector flow in Claude. Then limit tools and scopes, require approval for consequential actions, and troubleshoot from process status and logs through network, authentication, discovery, and policy. There is no universal MCP setup file, so the current official guide for the chosen client is part of the configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
