Can ChatGPT Sites host MCP servers? Yes — and nobody's gating what the tools do

Yes. On October 1, 2026, OpenAI's Codex lead Tibo Sottiaux said you can build and deploy MCP servers right through ChatGPT — then restrict access or share them — and Plugins lead Max Stoiber said ChatGPT Sites can host MCP servers, including plugin extensions. By October 3, "Sites in ChatGPT" was on the front page of Hacker News (~209 points, 218 comments). The hosting how-to is well covered — including a strong piece by explainx.ai with the exact prompts, the save-then-deploy path, and who can see what. What nobody is covering is the second-order question: every MCP tool call an agent makes is a small authorization decision, and Sites just removed the hosting tax that kept the callable-tool count low. A todo list hosted in a weekend demo is one thing. A flood of prompt-built servers with write tools — and, since September 30, paid tools — is the thing that needs judgment, not just uptime.

What actually happened (receipts, dated)

What the field lacks (every one of them)

The October 1–3 field is hosting coverage: explainx.ai's how-to (the strongest piece — exact prompts, the Sites→plugin sequence, save-vs-deploy, least-privilege warnings, D1/secrets guidance), its HN practitioner analysis (prototypes vs production, lock-in, the *.chatgpt.site optics problem), the HN thread itself, and the official Sites/plugin docs (mechanics only). Every one of them answers how do I host it. None of them asks: when anyone with a Plus plan can ship an MCP server by Friday, who approves what the agent does with the tools? Nobody maps the paid-tool intersection (Cloudflare's gateway is three days old). Nobody has a live scored gate. Nobody gives you the per-task budget math. That gap is this page's whole reason to exist — hosting answered the where; judgment is the whether, and it's missing.

The tool-call gate: authorization is per call, not per install

Installing a plugin is one decision. Calling its tools is a thousand. The gate applies where the action is — per tool call, against the call's stakes:

The design thesis: the hosting tax was never the real tax. The judgment tax is. When every tool needs a box, TLS, and OAuth, the tool count stays low and install-time review is enough. When a prompt and a Plus plan ships a server, the tool count explodes and install-time review is obsolete — the authorization has to live at the call, scored, logged, and banded. The pattern we plant our flag on.

SML products that implement the missing layer

Two of the seven ScriptMasterLabs products ship the judgment layer Sites-hosted MCP servers need:

• Decision-gated payments — the canonical pattern: every machine action carries a confidence score, and the band decides — ≥0.80 auto, 0.50–0.79 human confirm, below 0.50 block, log, escalate. The live gate endpoint used for today's receipts (/api/harness/decide) runs this pattern now.
• Provider Trust — trust scoring for the endpoints themselves: does this Sites-hosted MCP server deserve your agent's calls — and your agent's money? Authorization has two halves — should this call fire (the gate) and does this server deserve it (trust).

Live gate receipts (minted today, not hypotheticals)

Scored against the live endpoint POST https://scriptmasterlabs.com/api/harness/decide — local-heuristic-v1, gate bands 0.80/0.50 live on the endpoint, October 3, 2026 ~14:20 EDT. Exact shape: {"state": {...}, "questions":[{"id","type":"score","scale":[0,1],"question"}]}.

Honest finding: the uncalibrated heuristic scores the free read (0.4132) and the unreviewed paid call (0.4045) almost identically — both escalate, and it cannot discriminate between them. That's the eighth consecutive run with this finding (seatbelt, XRPL, Sigo, Robinhood, zkAPI, Cloudflare, x402 Foundation, now this page): the heuristic is a fail-closed floor, not a decider. Note the tension it exposes: fail-closed would have blocked even the free read — "block everything" is a seatbelt, not judgment. A production gate needs a calibrated decider behind it — exactly the JEV-27B-class slot. Meta: decider=local-heuristic-v1, calibrated=false, typesafe_wired=false.

Do it yourself: gate the tools, not just the install, in 5 steps

1. Keep every new Site private until the tool list is boring. Owner-only while you review. Demand the inventory before deploy: tool names, who can call writes, where state lives, whether it's Streamable HTTP. Three or fewer least-privilege tools (list, add, complete — not execute_arbitrary). Save a version; deploy only when the list is boring.
2. Score the call, not just the server. The gate belongs at the tool-call boundary: ≥0.80 auto-call, 0.50–0.79 hold for human confirm, below 0.50 block, log, escalate. The exact live shape is above — curl -X POST https://scriptmasterlabs.com/api/harness/decide with {"state":{...},"questions":[{"id","type":"score","scale":[0,1],"question"}]}.
3. Give paid tools a per-task envelope, not just a per-call price. 0.10 USDC × 100 calls = 10 USDC per task. Set the envelope before the task starts (e.g. 5 USDC), and any call that would breach it drops below 0.50 automatically. Price is a fact; the envelope is the judgment.
4. Log like the FTC is watching. Record instruction, authority, intent, and outcome for every tool call — especially paid and write calls. The September 30 FTC rogue-agent probe (Anthropic, OpenAI, METR) and the September 22 six-bank audit demand made that the regulator's ask. Prompt-built servers multiply the call volume; the audit trail is the only way to know what your agents did with them.
5. Don't outsource the judgment to ChatGPT's permission settings. Permission prompts are UX, not an authorization layer — they can't score, band, budget-envelope, or produce an audit record. Run your own gate at the call boundary; the install-time settings are the last line of defense, not the first.

Claim Receipts

Honest caveats

• The October 1 hosting announcement is known via explainx.ai's reporting of OpenAI staff posts (Sottiaux, Stoiber) — press-based, not hands-on: we did not deploy a Sites-hosted MCP ourselves. If the Sites UI and the staff posts disagree on a button name, trust what you see in chatgpt.com/sites.
• HN points/comments (~209 / 218) via explainx.ai's October 3 analysis; thread position shifts hourly.
• No volumes disclosed: no count of Sites-hosted MCP servers, no paid-tool transaction figures from Cloudflare's closed beta. Claims above are about the authorization layer, not market size.
• Gate receipts are scored by local-heuristic-v1 (uncalibrated; calibrated=false, typesafe_wired=false) — the eighth consecutive run where the honest finding is that the heuristic cannot discriminate and fail-closed is the protection, not the judgment.
• Sites is beta: plans, D1/R2 limits, audience behavior, and hostname optics can change. Check the live docs before you deploy.

Published 2026-10-03 · ScriptMasterLabs — the x402/MCP/AI pedia. Sources checked today; links verified at publish time.