This guide wires a reviewed SmeltSec-generated MCP server into ChatGPT Desktop through Settings > MCP servers or the shared Codex configuration file. Both STDIO and Streamable HTTP servers are supported by the current OpenAI documentation.
The current CLI package accepts Node.js 22.22.2 through 22.x, 24.15.0 through 24.x, or 26 and later. Use a current ChatGPT Desktop build on a documented desktop platform and review the generated server before exposing any credentials or write-capable tools.
In ChatGPT Desktop, open Settings and select MCP servers. Choose Add server, enter a name, and select STDIO or Streamable HTTP. OpenAI also supports direct configuration in~/.codex/config.toml; ChatGPT Desktop, Codex CLI, and the Codex IDE extension share this host configuration.
If MCP servers is unavailable, update the desktop app and confirm that your account or workspace policy exposes the feature. See the current OpenAI MCP documentation for the authoritative UI and configuration options.
The public npm release is 0.1.0. Pin that version so the commands in this guide match your installed CLI. Review its package files and dependencies before installation.
npm install -g @smeltsec/cli@0.1.0 smeltsec --version
The version check prints the CLI version. If the command is not found, fix your npm global bin path before moving on.
smeltsec init interactively scaffolds the project and asks for an output directory. smeltsec ci evaluates that directory against configured security and quality thresholds. Review blocking findings before moving to ChatGPT.
smeltsec init smeltsec ci ./my-server --output ./my-server/smeltsec-ci.json cd my-server npm run build
Copy the absolute path to dist/server.js. You will use it in the ChatGPT MCP server dialog orconfig.toml in the next step.
In Settings > MCP servers, select Add server and choose STDIO. Enter the executable and argument shown below, save, and select Restart. For finer control, the equivalent TOML is shown as well.
[mcp_servers.my_server] command = "node" args = ["/absolute/path/my-server/dist/server.js"] default_tools_approval_mode = "prompt" [mcp_servers.my_server.env] API_KEY = "replace-with-a-scoped-secret"
For a remote server, choose Streamable HTTP and provide its URL. In TOML, useurl and, when needed, bearer_token_env_var or OAuth. Do not put production credentials in a copied example; use a scoped secret source and review the server's tools first.
Open a new chat and enter /mcp in the composer to view connected servers. Confirm my_server initialized and that its reviewed tools are available.
Start with a read-only tool and keep its approval mode set to prompt while evaluating it. Confirm the result against the underlying system rather than treating a successful tool response as proof that the action was correct.
Run the configured command directly in a terminal and check its stderr. Verify the absolute path, Node.js engine, environment variables, and that the process speaks MCP over stdio rather than writing application logs to stdout.
The server process started but never returned a tools/list response. Run smeltsec test . --verbose to confirm tools register. Out-of-date MCP SDK versions also cause this; run npm update inside the server project.
Use /mcp to confirm the server is connected. Review the tool name, description, and input schema, then test with an explicit prompt that names a read-only tool. Approval policy controls authorization prompts; it does not force model tool selection.
Confirm whether the server expects bearer-token or OAuth authentication. For bearer tokens, set bearer_token_env_var to the name of an environment variable available to the host, then restart the client. Rotate a token that may have been exposed.
Free tier includes Gate 1 scanning and 5 generations per month.