Sign In

Use Composer through Secure MCP Tunnel and ChatGPT

ChatGPT connects to remote MCP servers. When the Composer endpoint must remain private, OpenAI Secure MCP Tunnel provides an outbound-only path without opening inbound firewall ports or publishing the private server URL.

The tunnel is optional. Composer and the WordPress MCP Adapter also support direct compatible MCP clients.

The Agent Composer overview explains the complete agency-to-draft-to-production workflow. The tunnel changes only how an authenticated client reaches Composer; it does not change who designs the site, what the active contract allows, or how a draft is reviewed and released.

Private WordPress can stay private​

For a local or firewall-protected WordPress environment, the tunnel establishes an outbound connection to the supported agent integration. No inbound WordPress or MCP endpoint needs to be opened solely for the agent.

Transport security and operation authorization remain separate. A successful tunnel connection does not grant unrestricted WordPress access: Composer validates the external user's Cognito access token, mapped group, OAuth client ceiling, active Config Set, Blueprint rules, draft ownership, validation, and audit controls inside WordPress.

Architecture and trust boundaries​

ChatGPT or another supported OpenAI product
                  |
     OpenAI-hosted tunnel endpoint
                  |
       outbound HTTPS polling
                  |
 tunnel-client inside your network
                  |
 private Composer MCP endpoint
                  |
Composer Cognito authentication + contract authorization

tunnel-client authenticates to the OpenAI tunnel control plane and forwards the HTTP MCP exchange between the hosted tunnel endpoint and the private WordPress server. Composer separately authenticates the external user from the forwarded bearer token and enforces group, client, scope, contract, ownership, validation, and human-approval checks.

Prerequisites​

Complete Direct MCP Setup first and verify the Composer server from inside the private network.

You also need:

  • a tunnel created in OpenAI Platform tunnel settings,
  • Tunnels Read + Manage to create or edit it,
  • Tunnels Read + Use to run or select it,
  • a runtime API key stored only on the tunnel host,
  • outbound HTTPS access to api.openai.com:443,
  • access to ChatGPT developer mode under the current plan and workspace policy.

Platform tunnel permissions and ChatGPT workspace permissions are separate. Associate the tunnel with every Platform organization and ChatGPT workspace that should be allowed to discover it.

Install and configure tunnel-client​

Download the current tunnel-client from Platform tunnel settings or the official OpenAI release repository. Follow the latest-release link rather than hard-coding a binary version in an operational runbook.

Protected Composer OAuth access requires an HTTP tunnel profile. The target may be a public URL, a private hostname, or another URL reachable only from the tunnel host; it does not have to be reachable from the public internet. It must resolve to Composer's dedicated HTTP MCP endpoint.

export CONTROL_PLANE_API_KEY="<runtime-api-key>"

tunnel-client init \
  --sample sample_mcp_with_dcr \
  --profile <connector-profile> \
  --tunnel-id <tunnel-id> \
  --mcp-server-url "https://<wordpress-host>/wp-json/mcp/smartcloud-agent-composer"

tunnel-client doctor --profile <connector-profile> --explain
tunnel-client run --profile <connector-profile>

Use sample_mcp_with_dcr only when Composer has a resolved identity provider and advertises OAuth protected-resource metadata. If the endpoint intentionally remains Open without an identity provider, use sample_mcp_remote_no_auth instead. An Open endpoint returns 404 for OAuth metadata candidates so that the no-auth HTTP profile can become ready. Regenerate the profile with sample_mcp_with_dcr when protected OAuth is enabled later.

Keep the process running as a supervised service only after doctor reports healthy and ready. In the local tunnel UI, verify that the main channel reports transport_kind: http-streamable and that OAuth metadata is advertised. An STDIO mcp.command profile cannot transport the HTTP WWW-Authenticate challenge or the external user's bearer token; reserve it for local development or Composer's backward-compatible Open mode.

Before scanning tools in ChatGPT, inspect the running tunnel process or its local /ui and confirm that it targets smartcloud-agent-composer. A successful health check proves that the daemon is alive; it does not prove that the profile selected the intended WordPress MCP server. The discovered tools should use the smartcloud-agent-composer-* prefix and include Blueprint, design-context, validation, draft, and preview operations. For structured-content workflows, also confirm that the catalog contains the canonical smartcloud-agent-composer/get-content-field-contract, smartcloud-agent-composer/search-relation-targets, smartcloud-agent-composer/update-content-fields, and smartcloud-agent-composer/inspect-content-fields abilities. smartcloud-agent-composer/list-content-drafts may also be present, but its purpose is editable or adoptable content discovery, not relation-target resolution. For a taxonomy-enabled workflow, also confirm the canonical smartcloud-agent-composer/get-taxonomy-contract, smartcloud-agent-composer/search-taxonomy-terms, smartcloud-agent-composer/create-taxonomy-term, smartcloud-agent-composer/assign-taxonomy-terms, and smartcloud-agent-composer/inspect-taxonomy-terms tools. Creation is not a fallback for uncertain matching: the client must search first and request explicit confirmation only when a new public-navigation term is justified.

Create the ChatGPT custom MCP app/plugin​

OpenAI's interface and plan availability can change; follow the current developer-mode guide and plugin connection guide.

The current flow is:

  1. Enable Developer mode in the location allowed by the ChatGPT workspace policy.
  2. Open the ChatGPT Plugins/Apps page and create a developer-mode app.
  3. Enter a clear name and description such as Agent Composer and Governed WordPress Gutenberg draft creation and preview.
  4. Choose Tunnel as the connection type.
  5. Select the associated tunnel or enter its <tunnel-id>.
  6. Scan tools and complete authentication if prompted.
  7. Review every discovered tool and its write/modify annotation before creating the app.

Custom MCP write support and developer-mode availability depend on the ChatGPT plan and workspace policy. Do not describe the connection as an OpenAI-verified integration unless it has completed the applicable OpenAI review.

Test safely​

Start a new chat, enable only the Composer app, and use a bounded prompt:

Load the active Composer design context, then the blueprint for <page-type> and
approved patterns, validate a minimal plan, create one agent-owned
WordPress draft, and return its preview. Do not publish, delete normal content,
upload media, or change plugins, themes, users, or configuration.

Verify:

  • ChatGPT selects the Blueprint, design-context, pattern, validation, draft, and preview tools in the expected order;
  • WordPress contains a draft rather than a published item;
  • the preview validation report is clean;
  • the Composer audit log records the authenticated actor and outcome;
  • unsupported publishing or deletion requests do not produce an executable Composer tool.

Troubleshooting​

  • Tunnel absent in ChatGPT: confirm workspace association and Tunnels Read + Use permission.
  • ChatGPT says the server does not implement OAuth: inspect /api/status and /api/oauth in the local tunnel UI. Replace an STDIO profile or metadata_source: not_advertised result with an HTTP/DCR profile targeting /wp-json/mcp/smartcloud-agent-composer, then restart the site-specific tunnel service.
  • Tool scan fails: keep tunnel-client run active, inspect its local /ui, and run doctor --explain.
  • Transport works but WordPress rejects calls: verify the Cognito issuer, App Client allowlist, exact group mapping, and token scopes in Composer; do not bypass the Site Contract or grant administrator access.
  • Old, missing, or unrelated tools appear: first verify that the tunnel profile launches --server=smartcloud-agent-composer. After a Composer upgrade, restart the relevant PHP runtime, the site-specific MCP/tunnel service, and the supervised tunnel process. Refresh the app's actions, review the tool-definition diff, confirm the expected canonical abilities, and start a new conversation. If the current ChatGPT plan does not allow a published app to be updated, recreate and republish it.
  • Calls time out: confirm outbound access to the OpenAI control plane and local reachability from the tunnel host to <mcp-endpoint>.
  • Composer validation fails: treat this as a contract or active-theme mismatch, not a tunnel failure.

Only trusted MCP servers should be connected. Prompt injection and overbroad tool permissions remain application-level risks even when the network path is private.