# Agent Composer with Secure MCP Tunnel and ChatGPT

OpenAI Secure MCP Tunnel is an optional outbound-only connection for a Composer MCP server that must remain private. `tunnel-client` runs inside the network that can already reach WordPress, polls the OpenAI tunnel control plane over outbound HTTPS, forwards MCP JSON-RPC locally, and returns responses through the same path. The private WordPress endpoint does not need a public listener.

The tunnel does not replace WordPress authorization. `tunnel-client` authenticates to the OpenAI control plane, while WordPress authenticates the dedicated `<agent-user>` and Composer enforces the `smartcloud_agent` capability, active contract, draft ownership, validation, and audit boundary.

Setup requires a Platform `tunnel_id`, a runtime API key stored on the tunnel host, Tunnels Read + Manage for tunnel administration, Tunnels Read + Use for operation, outbound HTTPS to the OpenAI control plane, and ChatGPT developer-mode access under the current plan and workspace policy. The tunnel must be associated with the Platform organizations and ChatGPT workspaces that are allowed to discover it.

On a WordPress host with WP-CLI, initialize a named stdio profile whose MCP command explicitly selects `--server=smartcloud-agent-composer` and the dedicated `<agent-user>`. For an already-running private HTTP transport, use a separate profile with `<mcp-endpoint>`. Do not combine the stdio sample with an HTTP server URL.

Run `tunnel-client doctor --profile <connector-profile> --explain` and keep `tunnel-client run --profile <connector-profile>` healthy while scanning or using tools. Before scanning, inspect the running process or local tunnel UI and confirm that the profile targets the canonical Composer server. A healthy daemon can still expose the wrong catalog when its profile names another MCP server. Never commit the runtime API key or WordPress application password with the tunnel profile.

In ChatGPT developer mode, create a custom MCP app/plugin, choose Tunnel as the connection, select the associated tunnel, scan tools, complete authentication, and review every write/modify annotation. Start with a bounded prompt that asks for Blueprint and design-context discovery, plan validation, one agent-owned draft, and a preview while explicitly forbidding publication and site administration.

If ChatGPT shows old or unrelated tools, first correct the profile's MCP server selection and restart the tunnel process. Then refresh the app actions after reviewing the tool-definition diff; recreate and republish the app when the current plan does not support updating a published app. If transport is healthy but WordPress returns forbidden, repair the dedicated WordPress identity rather than granting administrator access.

Official setup sources:

- https://developers.openai.com/api/docs/guides/secure-mcp-tunnels
- https://developers.openai.com/plugins/deploy/connect-chatgpt
- https://help.openai.com/en/articles/12584461-developer-mode-apps-and-full-mcp-connectors-in-chatgpt-beta