ChatGPT

ChatGPT runs in OpenAI's infrastructure. There is no local client, OpenAI calls your MCP endpoint directly. The server must therefore be publicly reachable via HTTPS, with a certificate from a generally trusted CA. localhost, *.ddev.site and self-signed certificates do not work. A firewall or IP allowlist must allow OpenAI's outbound range (see OpenAI's IP ranges).

Authentication uses OAuth 2.1. ChatGPT prefers Client ID Metadata Documents. AI Suite MCP does not offer them, so ChatGPT registers itself via Dynamic Client Registration. Custom MCP servers are only available in paid ChatGPT plans, and administrators can restrict the feature. Which plans these are is described in OpenAI's guide to custom MCP servers.

• enableMcp is enabled (see Configuration).
• mcpAllowedRedirectUris contains chatgpt.com/connector_platform_oauth_redirect. ChatGPT uses this fixed address because AI Suite MCP returns the iss parameter according to RFC 9207.
• mcpAllowedOrigins contains chatgpt.com.
• mcpAllowedClientIds stays empty.
• The backend group has enable_mcp_access and the required feature permissions (see Permissions & Scopes).

Check the public reachability from a computer outside your network. Both calls must return 200:

curl -sS [typo3-url]/aisuite-mcp/health
curl -sS [typo3-url]/.well-known/oauth-authorization-server

If an IP allowlist, HTTP Basic Auth or a self-signed certificate blocks either of the two paths, the connection fails without a useful error message. If the installation is behind Basic Auth, the MCP paths must be exempted, see Production Operation. Also make sure that the Authorization header reaches PHP, otherwise endless 401 responses follow after a successful OAuth flow.

1. Create a custom MCP server. In ChatGPT, create a custom MCP server as a plugin, enter [typo3-url]/aisuite-mcp as the server URL and choose OAuth as authentication. Only use the root URL without a site prefix. Where to find this in ChatGPT and which fields the dialog shows is described in OpenAI's guide to custom MCP servers.

2. Connect and consent. When connecting, ChatGPT registers itself at [typo3-url]/aisuite-mcp/oauth/register and opens the authorization page. There, you sign in with your TYPO3 backend credentials, even if you are already signed in to the backend, followed by the consent page with the requested scopes. After confirmation, the plugin is connected.

3. Invoke it in the chat. Invoke the plugin in the chat with @. Only then are the tools visible to the model. How to connect and test a plugin is described in OpenAI's guide to connecting and testing a plugin.

You end the access either in ChatGPT by removing the plugin or in the TYPO3 backend in the MCP dashboard of the backend module “AI Suite” with “Revoke”.

Nothing happens when connecting, and there is nothing in the TYPO3 log. The server cannot be reached from OpenAI's network or the certificate is not trusted. Check the two curl calls from an external computer.

The model claims it has no MCP access although the plugin is connected. The plugin has not been invoked in the current chat, see step 3.

Individual tools are missing (generating, translating, images, audits). The backend user lacks the corresponding AI Suite feature permissions. Add the permissions and re-authenticate in the plugin.

No logs are viewable on the ChatGPT side. The web server's access log is what tells you something. A 404 on /aisuite-mcp indicates a site prefix, repeated 401 responses indicate the missing Authorization header. Further client-independent cases are collected under Connecting Clients.