When OpenAI quietly announced full Model Context Protocol (MCP) support for ChatGPT in September 2025, many AI developers nearly fell off their chairs. This “developer mode” beta gives paying users the ability to connect ChatGPT to any MCP‑compatible tool or data source – and then write back to those systems. No more read‑only, search‑and‑fetch interactions: your AI assistant can now send invoices, manage calendars or update CRM records directly. That’s huge… and a little scary.

Below is a quick primer on what MCP is, how this new mode works, and some real‑world examples of what you can build with it.

What is the Model Context Protocol (MCP)?

MCP is an open‑source standard introduced by Anthropic in late 2024. It defines a universal way for AI applications like ChatGPT or Claude to connect to external data and tools. Think of MCP like a USB‑C port for AI – rather than writing a custom integration for every data source or service, you plug into MCP once and gain access to many systems. MCP uses a client‑server architecture built on JSON‑RPC and HTTP, with standard tool definitions that let models run functions on remote systems. The protocol dramatically reduces integration complexity – instead of writing M×N custom connectors, you implement MCP once and connect multiple models to multiple services. It’s been adopted by OpenAI, Google DeepMind and other major players.

At its core, MCP exposes tools, resources and prompts:

• Tools represent functions that the AI can call (create a calendar event, update a record, etc.)
• Resources are data sources managed by the application (files, databases, APIs) that the AI can read
• Prompts are user‑defined templates guiding how the model uses these tools and resources

Because tools are standardized, a model can call them without knowing the underlying implementation. For example, a calendar.create_event tool works the same whether it’s connected to Google Calendar or your company’s internal calendar. Communication happens over HTTP or Server‑Sent Events for hosted servers, and MCP includes features like connection isolation and granular permissions to improve security.

The announcement: ChatGPT developer mode

Until now, ChatGPT’s MCP connectors were read‑only – you could search internal systems and fetch data for deep research, but not change anything. On 10 September 2025, OpenAI rolled out a developer mode beta that flips that on its head. Paying Plus and Pro users can enable this mode to gain full read/write MCP client support. It’s available on the web for Plus/Pro accounts and can be turned on under Settings → Connectors → Advanced → Developer mode.

Once enabled, you can import remote MCP servers (SSE or streaming HTTP) and manage their tools directly from ChatGPT, from Settings → Connectors → Create:

OpenAI’s forums and developers’ tweets highlight the change. A staff post notes that developer mode provides full Model Context Protocol client support for all tools, both read and write. The official X account explained that you can now create connectors and use them to perform write actions, not just search/fetch, and gave examples like updating Jira tickets or triggering Zapier workflows, this mode dramatically expands ChatGPT’s ability to perform real‑world actions and even demoed sending an invoice via a payment provider.

However, OpenAI openly warns that this power comes with serious risks. Because ChatGPT can now alter external systems, misconfigured connectors or prompt‑injection attacks could destroy data, send unintended commands or leak sensitive information.

The developer mode docs remind users to watch out for prompt injections and to confirm write actions before allowing them to proceed. Security researchers have already found vulnerabilities in some MCP servers, so choose and test your integrations carefully.

How developer mode works

1. Eligibility and enabling – Developer mode is currently in beta for Plus and Pro web users. To enable it, go to Settings → Connectors → Advanced → Developer mode. Once toggled on, a new “Developer mode” option appears in the tool picker.
2. Importing MCP servers – In ChatGPT settings, navigate to the Connectors tab and add your remote MCP server by providing its URL. The server must support Server‑Sent Events (SSE) or streaming HTTP, and authentication can be OAuth or none. After adding, its tools are listed in the developer toolbar.
3. Selecting tools – Each MCP server defines tools (functions) that you can call. You can toggle tools on or off and refresh connectors to pull updated tool definitions. Tools can be anything from calendar.create_event to crm.update_record or custom functions you expose in your server.
4. Prompting to call tools – In a conversation, choose Developer mode from the Plus menu, select your connector, and write a prompt. To make sure ChatGPT calls the right tool, you may need to be explicit: specify the connector and tool name, provide inputs in the expected JSON shape, and forbid use of other tools. For example: “Schedule a 30‑minute meeting tomorrow at 3 PM PT with [email protected] and [email protected] using calendar.create_event. Do not use any other scheduling tools.” ChatGPT will output a proposed tool call; you then confirm before it executes.
5. Confirming write actions – By default, ChatGPT asks for confirmation before sending a write action. You can inspect the JSON payload, approve or deny it, and choose to remember your decision for that conversation. Tools annotated as read‑only (e.g., search or fetch) may execute without confirmation, but most write actions require your explicit approval.

MCP in ChatGPT outside developer mode

Even if you don’t enable developer mode, MCP is already used under the hood for ChatGPT’s deep research connectors. Earlier in 2025, OpenAI added the ability to build custom connectors that follow MCP so ChatGPT can search internal systems. These connectors are available to Pro users and to Business, Enterprise and Education workspaces. Admins can add a custom MCP server in settings; once enabled, users can search or run deep research across proprietary data sources without leaving ChatGPT.

What you can build: real‑world examples

The combination of MCP and developer mode turns ChatGPT into a programmable agent. Here are some ideas:

• CRM automation – Expose your company’s CRM via MCP. ChatGPT could update customer records, assign leads, or create tasks with prompts like “Use the Acme CRM connector’s update_record tool to change the status of lead #123 to Qualified.”
• Calendar management – Link ChatGPT to Google Calendar or an internal calendar service. Ask it to schedule a meeting for specific attendees at a particular time, ensuring it uses the correct tool (calendar.create_event) rather than reminders
• Code review and DevOps – Connect to GitHub or GitLab. ChatGPT could create a pull request, assign reviewers, or merge branches. You might prompt: “Create a pull request from branch feat‑retry into main with title Add retry logic and body …, and don’t push directly to main”
• Finance tasks – With access to accounting tools, ChatGPT can generate and send invoices or review expense reports. OpenAI’s demo showed an agent sending an invoice via a payment provider
• Custom workflows – Because MCP supports arbitrary tools, you can build connectors for your proprietary systems: reading from a vector database, updating a ticketing system, or triggering a manufacturing process. As long as the server implements the standard search and fetch endpoints (for deep research) and your custom actions, ChatGPT can orchestrate them

Safety tips

With great power comes… well, you know. Here are a few best practices for using developer mode safely:

• Vet your MCP servers – Only connect to servers you control or trust. Malicious servers can steal data or trick the model into bad actions. Security researchers have found vulnerabilities like remote code execution and prompt‑injection flows in public MCP servers
• Use least‑privilege tokens – When exposing a tool, limit its permissions (e.g., restrict to a specific account or dataset). In developer mode, you can toggle tools off if you don’t need them
• Write clear prompts – Be explicit about which connector and tool to use, and disallow alternatives. Use sequence instructions when chaining tools (e.g., read a file first, then write)
• Review before executing – Inspect the generated JSON and confirm or deny write calls. Don’t blindly approve actions; this prevents unintended side effects

Final thoughts

OpenAI’s full MCP support marks a big leap toward agentic AI. With developer mode, ChatGPT becomes more than a conversational search interface – it’s a programmable assistant that can take real action in the world. By standardizing how models connect to tools and data, MCP reduces friction for developers and encourages an ecosystem of interoperable connectors. At the same time, this power introduces new security considerations, so tread carefully and respect the warnings. If you’re comfortable exploring bleeding‑edge features and can implement sensible safeguards, now’s the time to plug ChatGPT into your workflow and see what you can build.