Meeting OpenAI's Strict OAuth 2.1 & PKCE Connector Requirements
ChatGPT Developer Mode and Custom Connectors require RFC 9728 Protected Resource Metadata, RFC 8414 Authorization Server Metadata, RFC 7591 Dynamic Client Registration, and S256 PKCE—which local-only stdio wrappers do not provide.
Full OAuth 2.1 + PKCE Gateway + `.codex-plugin` Bundle
- Serves `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server` with Dynamic Client Registration (`/oauth/register`) and S256 PKCE (`/oauth/authorize`, `/oauth/token`).
- Encrypts tenant credentials in memory with `ChaCha20-Poly1305` AEAD and executes every tool call in an isolated sandbox.
- Includes `.codex-plugin/plugin.json` and `ghl-agency init-config --client codex` for OpenAI Codex CLI users.
- Enforces read-only/dry-run safety defaults so ChatGPT never mutates a live sub-account without confirmation.
Side-by-Side Technical & Pricing Comparison
| Capability / Requirement | Local-Only Stdio MCP Wrappers | Zapier ChatGPT Actions | HighLevel Agency & Builder MCP |
|---|---|---|---|
| Works in ChatGPT Web & Mobile via OAuth 2.1 | ❌ Fails (no HTTP / OAuth 2.1 endpoints) | ⚠️ Requires per-zap paid tasks | ✅ Native RFC 9728/8414 OAuth 2.1 + S256 PKCE |
| Sub-Account Audits, DNS, IVR & Snapshot Diffs | ⚠️ Partial v2 CRUD | ❌ Basic contact/lead triggers only | ✅ All 55 native agency & builder tools |
CLI & MCP Configuration
# In ChatGPT Settings -> Connectors -> Add Custom MCP Connector:
https://ghlagencymcp.com/mcp
# For OpenAI Codex CLI (~/.codex/config.toml):
ghl-agency init-config --client codex
Copy-Paste AI Prompt
Check the health of our HighLevel connection, list all sub-accounts in our agency, and run a readiness audit on location <LOCATION_ID>.
Frequently Asked Questions
Does `ghlagencymcp.com` support Dynamic Client Registration for ChatGPT?
Yes. `POST /oauth/register` implements RFC 7591 Dynamic Client Registration with strict HTTPS and loopback redirect URI validation.
Can I use OpenAI Codex CLI in local mode?
Yes. Run `ghl-agency init-config --client codex` to generate the `[mcp_servers.ghl_agency]` block for `~/.codex/config.toml`.