ChatGPT app submission: how to get your SaaS into ChatGPT's Plugins Directory

OpenAI now lists MCP-backed ChatGPT apps as plugins, in one Plugins Directory shared by ChatGPT and Codex. Its old app submission guidelines page redirects to the plugin guidelines. So submitting a ChatGPT app today means submitting a plugin that contains your MCP server. Below are who can submit, each step in OpenAI's portal, what the reviewers check and what happens after you submit, from OpenAI's own pages as we read them on October 11, 2026. Each rule links to the requirement on our ChatGPT Plugins Directory page, where its source and the date we last checked it are.

Before you start

• Who can submit. Organization owners can submit. Other members need Apps Management write access, which an owner grants. To publish under your name or your company's, the submitter needs a verified individual or business identity, completed in the organization settings.
• Which project. Projects with EU data residency cannot currently submit MCP plugins. OpenAI's review page says to use a project with global data residency.
• Your MCP server. It runs on a publicly accessible domain, not a local or testing endpoint.
• Your sign-in. The portal supports no authentication, OAuth, or a mix of the two. It has no API-key or bearer-token flow, so a server that signs users in with an API key needs OAuth first. Our MCP OAuth guide covers what to build.
• Your public pages. The submission lists website, support, privacy policy and terms of service URLs, each over HTTPS.

The submission, step by step

OpenAI's portal is the Plugins page at platform.openai.com/plugins. The flow has five steps.

1. Upload the plugin ZIP. Choose your verified developer identity and upload the package. Put the MCP server in the first ZIP: OpenAI says adding an MCP server to an existing skills-only plugin isn't currently supported. Keep credentials and secrets out of the archive.
2. Resolve the checks.
   • Connect the MCP server and confirm its URL and authentication settings. If you use a registered OAuth client, the portal asks for its client secret; the secret never goes in the package.
   • Serve the domain verification token as plain text at /.well-known/openai-apps-challenge on the MCP host or an eligible parent domain. Return only the token, not JSON.
   • Wait for the automated tool scan, review the tools it found, and resolve any issues it raises. OpenAI's errors page says a scan can take up to 2 hours.
3. Fill in the listing. A display name and a short description (30 characters or fewer each), a long description (up to 4,000), the developer name, a category, capabilities, a square logo, and up to three optional starter prompts (128 characters or fewer each, without an @mention). Screenshots are allowed only when the scan finds a UI output template.
4. Add the review details.
   • Exactly five positive and three negative test cases. Each positive case names the tools it should trigger and the behavior you expect.
   • Reviewer credentials for a dedicated test account with sample data, never a real user's account. It must work without MFA, email or SMS codes, one-time sign-in links, or a private network.
   • A demo recording that reviewers can open.
   • Release notes for the version you submit.
5. Submit for review and complete the required policy attestations. Setup and validation errors must be fixed first; other automated findings go to the review team with your submission.

What OpenAI's reviewers check

OpenAI's plugin guidelines set the minimum standard for staying in the directory. For a SaaS plugin backed by an MCP server, these are the rules most likely to matter:

• Tool hints, with reasons. Every tool sets readOnlyHint, openWorldHint and destructiveHint as explicit booleans, and the submission justifies each one.
  • readOnlyHint is true only for tools that strictly fetch, look up or list.
  • destructiveHint is true for deleting, overwriting, cancelling, revoking access, or an irreversible send or transaction. Being able to undo it doesn't make it false.
  • openWorldHint is true for public or open-ended entities; a bounded private catalog may set it to false.
  • Your justifications don't override what your server returns, and the hints don't replace sign-in or a confirmation step.
• Names and descriptions. Tool names are unique, plain and descriptive, ideally verbs such as get_order_status. Each description matches what the tool does, including its limits and side effects.
• Independent, minimal tools. Each tool works on its own, without relying on another plugin or hiding operations behind a generic executor. Inputs ask only for what the task needs: never the full chat history, earlier turns or a precise location.
• Small results. Responses carry only what the request needs, without internal IDs, trace IDs or telemetry.
• Listing copy. The name isn't generic and doesn't append "MCP", "MCP Server" or "Plugin" to your product's name. Descriptions don't compare with or disparage others, make claims that can't be verified, or advertise pricing.
• No trials or pass-throughs. OpenAI says trial or demo plugins will not be accepted, and unofficial connectors that mainly pass through to someone else's service cannot be approved.
• Privacy. A published privacy policy, the minimum data, and none of the restricted kinds: payment card data, protected health information, government IDs, or credentials such as API keys and passwords.
• No upsell. Commerce is limited to physical goods. A plugin may not show plans, start subscriptions, promote upgrades or link to a checkout page, so a SaaS plugin sells nothing inside ChatGPT.
• Test cases that pass. One rejection reason OpenAI lists is a test case that did not produce the correct result. Write each expected behavior precisely, and run every case yourself before you submit.

After you submit

• One review at a time. Only one review can be active per plugin. You follow it under Review status, and feedback arrives by email.
• You choose when to publish. An approved version goes live only when you select Publish plugin. It then appears in the Plugins Directory shared by ChatGPT and Codex.
• If it is rejected, fix the cause, upload a corrected ZIP and resubmit, or reply to the rejection email to appeal. Our guide to why connector submissions get rejected maps the rules reviewers apply.
• Tool changes need no new upload. OpenAI scans your hosted MCP server daily, and you can rescan after a deploy. Changed tools go live once they pass automated checks, and new tools stay unavailable until they are approved. Moving the server to a new URL needs OpenAI support.

Checklist before you press Submit

1. The project has global data residency, and the submitter is verified, with Apps Management write access.
2. The MCP server answers on a public HTTPS URL, and the domain token URL returns the bare token.
3. Sign-in is OAuth or none, with no API-key step.
4. Every tool has a verb name, a description that states its limits and side effects, and three explicit hints, each with a written justification.
5. No tool asks for chat history, a precise location, or a free-form method or endpoint.
6. Results carry no internal or trace IDs.
7. Five positive and three negative test cases, each run by hand, with the expected result written down.
8. The test account has sample data and signs in from a fresh browser profile with no second factor.
9. Reviewers can open the demo recording, and the release notes describe this version.
10. The website, support, privacy policy and terms URLs all load over HTTPS.

Where we come in

The Agent Distribution Audit checks your server against this list, and against Claude's and Cursor's rules, before you submit. Every ChatGPT requirement we track, with its source and the date we last checked it, is on our ChatGPT Plugins Directory page, and the switch from apps to plugins is in our change note.