If you last looked at ChatGPT extensibility a year ago, the vocabulary has moved twice and the substance has moved once. The word plugin is back, and it no longer means what it meant in 2023. OpenAI's developer documentation now defines a plugin as a package of three things: skills, an MCP server, and optional UI. The skills add repeatable workflows around the tools; the MCP server provides the tools and the access to external systems; the UI is a set of resources some tools return for display inside ChatGPT.
The practical consequence is easy to miss. A plugin is a distribution wrapper around an MCP server — not a replacement for one, and not a prerequisite for using one. Which means that if your goal is to let ChatGPT read your own files, notes or meeting transcripts, building a plugin is usually the wrong end of the problem. The directory and the protocol are two different layers, and only one of them is in your way.
This piece separates those layers, using OpenAI's own documentation and the Agent Plugins specification as they stood on 15 August 2026.
Per OpenAI's plugin architecture page, a plugin can contain skills, an MCP server, or both. Neither is universally required. Skills alone are enough "when instructions and the tools already available to the model are enough to complete the task"; the MCP server appears when the plugin has to reach a service, authenticate a user, or run behavior on infrastructure someone operates.
The division of labour between the two is worth internalising, because it is the same division that applies to any assistant setup, plugin or not:
| Part | What it is for |
|---|---|
| MCP server | Live data, authentication, authorization, controlled actions |
| Skill | Tool sequences, decision points, output requirements, examples, templates |
| UI | Resources returned by selected tools, rendered in ChatGPT |
That is not a ChatGPT-specific idea. It is the same argument as why tool descriptions alone are not enough: a server tells the model what it can do, a skill tells it how this team wants it done. Packaging them together simply means the two travel as one unit.
ChatGPT and Codex share one plugin directory, and public listings are discoverable
across both. Getting into it is a publishing process with publishing
requirements. OpenAI's build guide is unambiguous about the hosting side: for
public plugin submission, deploy the MCP server at a stable, publicly reachable
HTTPS endpoint, supporting the MCP streamable HTTP transport, typically
responding at a URL ending in /mcp. The endpoint has to stay reachable for
plugin review and domain verification, and the documentation explicitly rules out
using a temporary tunnel or a local endpoint for public submission.
Read that as a statement about listings, not about MCP. Everything in it — public HTTPS, stable URL, review, domain verification — exists because strangers will install the thing. None of it is required for an assistant to use a tool server. It is the app-store tax, and you pay it when you are shipping to other people.
Because the format is not the directory. On 6 August 2026 the packaging itself became an open standard: Agent Plugins 1.0.0, with a technical steering committee drawing core maintainers from Amazon, Cursor, Microsoft, OpenAI and Vercel, and launch support in ChatGPT and Codex, Cursor, GitHub Copilot, Kiro and VS Code. The stated goal is a small interoperability floor — authors package components once instead of rearranging them per client.
The layout is deliberately boring. A plugin is a directory with plugin.json at
the root (only $schema and name are required), Agent Skills in skills/, one
subdirectory each with a SKILL.md, and MCP server configuration in mcp.json.
And mcp.json describes three transports: stdio for a local subprocess started
by a command, streamable-http for a remote endpoint, and sse for the legacy
2024-11-05 transport. The conformance rule is explicit: a client that supports
Agent Plugins MCP servers must support at least one of stdio or
streamable-http, and should support both.
So a plugin whose MCP server runs entirely on your laptop is a valid plugin. It is just not a publishable one in OpenAI's public directory, which is a different claim than "not allowed". VS Code, for instance, installs Agent Plugins from a marketplace or straight from a Git repository URL, and plugin MCP servers appear alongside workspace and user-level servers. Cursor supports the standard next to its own format and manages both from its Customize page.
Skip the plugin. Connect the server.
config.toml, and a local process started by a command
is a first-class case: command, plus optional args, env and cwd. Add it
with codex mcp add, through the desktop app's MCP servers settings, or by
editing ~/.codex/config.toml directly.The distinction between those surfaces is not cosmetic. A local stdio server is a program your client launches and talks to over standard input and output: no port is open, no token is issued, and nothing travels to a third party on the way to the assistant. A hosted endpoint means an operator, a credential, and a network path — which is a reasonable trade for a service that genuinely lives in the cloud, and a strange one for your own notes.
One thing the packaging change does not alter: whether an assistant may act is
decided by the client, not by the plugin. Codex exposes four approval modes —
auto, prompt, writes and approve — where writes prompts for tools that
are not marked read-only, set globally through default_tools_approval_mode or
per tool. VS Code, by contrast, treats plugin MCP servers as implicitly trusted
once you install the plugin: unlike workspace servers, they do not raise a
separate trust prompt at startup. Worth knowing before you install a plugin from
an unfamiliar marketplace.
This is also why "read-only" is a property a server declares rather than a
promise a directory enforces. Speak-Y's server publishes its data-changing
commands — tagging a recording, renaming speakers, sharing into a team channel —
as data-changing, so the client asks before running them; reading is local and
needs nothing else running. A client can be pinned to reading only by adding
--read-only to the server's args, after which the changing commands are not
offered to it at all.
If you are building an integration for other people, plugins are now the right shape: one package, one manifest, several clients, and a directory that reaches ChatGPT and Codex at once. If you are trying to give your own assistant your own context, none of that machinery applies, and reaching for it costs you a hosting bill and a review queue to solve a problem that a line in a config file already solves.
Speak-Y takes the second path deliberately. Its MCP server is a local process, free on every plan including Free, installed in one click from Settings → Integrations — see the MCP overview for what an assistant can read and change. If you are still deciding which assistant to point at it, the client comparison covers who can start a local server and who cannot.
A package, not a protocol. OpenAI's developer documentation defines it as skills, an MCP server, and optional UI: the skills add repeatable workflows, the MCP server provides the tools and the access to external systems, and the UI is a set of resources returned by selected tools. The MCP server is optional — a plugin made only of instructions and resources can consist of skills alone.
No. Publishing a plugin is how you distribute an integration to other people through the shared ChatGPT and Codex directory. To give an assistant access to data on your own machine, you point your client at an MCP server directly — Codex and the ChatGPT desktop app take a local stdio server in config.toml, Cursor and VS Code take one in mcp.json. No listing, no review, no hosting.
The format allows it: the Agent Plugins 1.0.0 specification defines mcp.json entries for stdio, streamable-http and sse transports, and a conforming client must support at least stdio or streamable-http. OpenAI's public directory does not: for public plugin submission the server must sit at a stable, publicly reachable HTTPS endpoint, and the docs explicitly rule out a local endpoint or a temporary tunnel. Checked 15 August 2026.
MCP is the protocol an assistant speaks to a tool server. Agent Plugins, published 6 August 2026, is a packaging format that says where a plugin's parts live: plugin.json at the root, skills in skills/, MCP server configuration in mcp.json. Its technical steering committee includes maintainers from Amazon, Cursor, Microsoft, OpenAI and Vercel, and launch clients are ChatGPT and Codex, Cursor, GitHub Copilot, Kiro and VS Code.
No, and it does not need to be. Speak-Y ships a local MCP server that your client starts on your machine, so recordings and transcripts are read from the library on disk rather than uploaded to an endpoint someone hosts. It installs in one click from Settings → Integrations and is free on every plan, including Free.