Connect ChatGPT to Multi-Agent Memory

The public runtime has a real Streamable HTTP MCP endpoint and a separate OAuth 2.1 login flow. ChatGPT opens the normal Multi-Agent Memory sign-in page, the human approves one active workspace and exact read/write scopes, and short-lived OAuth tokens remain bound to that choice.

Human connection flow

Keep the Multi-Agent Memory host running over HTTPS.
Give ChatGPT a public HTTPS MCP route or select an OpenAI Secure MCP Tunnel.
On the Windows host, an existing active account matching the Windows username is signed in automatically. Every other computer uses the normal Multi-Agent Memory username and password.
Choose one active workspace and review the requested permissions. A sole available workspace is selected automatically.
Approve the connection. Connected is proven only after initialize, tools/list, and the read-only workspace_status tool succeed.

The approval page never displays a company master credential, governed agent credential, password, raw private payload, access token, or refresh token.

Automatic Windows-host sign-in

The convenience path is deliberately limited to a direct request from the same Windows computer, using a numeric loopback or local-interface OAuth issuer whose address matches the socket peer, with no forwarded identity headers. The Windows username must match an existing active Multi-Agent Memory human account. It does not create an account, link a company, grant a workspace, or count as password reauthentication; the normal consent and active-authority checks still run.

Another LAN computer, a reverse proxy, a spoofed forwarding header, or a different Windows username receives the normal password form. Operators can disable the feature with MEMORYENDPOINTS_MCP_HOST_LOCAL_AUTO_SIGN_IN=0.

Windows host check

powershell -ExecutionPolicy Bypass -File scripts/setup_chatgpt_mcp.ps1 -Status -LocalMcpUrl https://your-intranet-host.example/mcp

The redacted report verifies exact resource/issuer metadata, PKCE S256, and the resource-bound OAuth 401 challenge from /mcp. It does not claim that ChatGPT can reach the host. A public-looking DNS name is configuration, not proof of external reachability.

Private host through OpenAI Secure MCP Tunnel

Create or select a tunnel in OpenAI Platform, create a separate runtime API key with Tunnels Read + Use, associate the tunnel with the target ChatGPT workspace, and install the currently supported tunnel-client. Then run:

powershell -ExecutionPolicy Bypass -File scripts/setup_chatgpt_mcp.ps1 `
  -Status -Configure -Run `
  -TunnelId tunnel_0123456789abcdef0123456789abcdef `
  -LocalMcpUrl https://your-intranet-host.example/mcp

The helper prompts with hidden input when CONTROL_PLANE_API_KEY is not already present. It does not save or print the key. It first verifies that the installed binary exposes OpenAI's built-in sample_mcp_with_dcr profile, initializes that DCR-capable profile under the ignored .local-secrets/tunnel-client/profiles directory, runs doctor --explain, and keeps the foreground tunnel attached to the terminal. When the client is not on PATH, the helper finds it automatically if exactly one tunnel-client.exe exists below the ignored .local-secrets/tools/tunnel-client directory; ambiguous installs require -TunnelClientPath.

After doctor --explain succeeds, the helper records the non-secret tunnel ID in the ignored .local-secrets/mcp-host.json file. The server accepts ChatGPT's Secure MCP Tunnel gateway URL as an OAuth resource only when it contains that exact tunnel ID on a recognized OpenAI gateway host. Wildcard tunnel IDs, arbitrary hosts, ports, query strings, and fragments are rejected, and tokens remain bound to the exact requested resource.

After the first successful configuration, restart it without entering the tunnel ID again:

powershell -ExecutionPolicy Bypass -File scripts/setup_chatgpt_mcp.ps1 `
  -Status -Run `
  -LocalMcpUrl https://your-intranet-host.example/mcp

The restricted runtime key is still requested for each run unless the operator supplies CONTROL_PLANE_API_KEY to that process. The helper does not silently persist credentials or create an automatic-start task.

In ChatGPT, enable developer mode, create a developer-mode app, choose Tunnel under Connection, and select the associated tunnel.

OAuth still needs a reachable issuer

Secure MCP Tunnel carries MCP discovery and JSON-RPC, but does not automatically tunnel the authorization server. The configured OAuth issuer needs an approved public HTTPS reverse proxy for this exact route set:

/.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource/mcp
/oauth/register, /oauth/authorize, /oauth/session, /oauth/token, and /oauth/revoke
/static/js/mcp-authorize.js and /static/css/site.css

The browser needs the authorization, session, JavaScript, and CSS routes; OpenAI needs discovery, registration, token, and revocation. Do not expose the entire internal host merely to expose OAuth. The proxy must preserve the configured public origin because login accepts only an exact same-origin browser request.

Available tools

Tool	Scope	Behavior
`workspace_status`	`memory:read`	Shows the human-approved company and workspace binding.
`memory_search`	`memory:read`	Searches public-safe memory only in the approved workspace.
`memory_remember`	`memory:write`	Submits a public-safe note through the normal firewall and review queue.

Security properties

Dynamic registration accepts only exact ChatGPT connector callbacks.
Authorization code flow requires PKCE S256 and exact resource propagation. A tunnel resource must use the exact locally configured tunnel ID on a recognized OpenAI gateway host.
Authorization codes are one-use; opaque access tokens expire after one hour; refresh tokens rotate and can be disconnected through token-family revocation.
Every MCP call revalidates the human account, company authority, company, and workspace.
Windows-host automatic sign-in trusts only a direct same-host socket peer and an existing username match. Forwarded identity headers never enable it.
Embedded-browser consent accepts an opaque Origin only with the exact OAuth issuer referrer emitted under a same-origin referrer policy. Missing or mismatched proof is rejected.
Read and write scopes are enforced independently, and memory writes keep the existing firewall, quota, idempotency, confirmed-readback, audit, and review controls.

Protocol details and source-verifiable routes are in the API and data reference. Current platform behavior is defined by OpenAI's MCP authentication guide, Secure MCP Tunnel guide, and ChatGPT connection guide.