GPT WORLD / INDEPENDENT CODEX FIELD MANUAL Source review · 2026-07-31

Retrospective edition / APPS

Add a UI to an MCP tool without moving trust into the browser

The MCP server owns tool truth and authorization; the embedded component renders state and requests actions through a narrow bridge.

01 / DECIDE

Architecture decision

Use it when a ChatGPT-integrated tool benefits from forms, maps, tables, previews, or other interactive presentation.

The MCP server owns tool truth and authorization; the embedded component renders state and requests actions through a narrow bridge. Map input, output, state, and side effects as one observable path before deciding which layer owns add a ui to an mcp tool without moving trust into the browser.

02 / BUILD

Three-step implementation

  1. 01

    Frame the contract

    Write down the caller, data classification, success condition, timeout, cancellation, and ownership. Use it when a ChatGPT-integrated tool benefits from forms, maps, tables, previews, or other interactive presentation.

  2. 02

    Build one narrow path

    Implement one end-to-end path with request correlation, typed state, and reversible failure handling. The MCP server owns tool truth and authorization; the embedded component renders state and requests actions through a narrow bridge.

  3. 03

    Prove the outcome

    Turn acceptance into a repeatable fixture, contract test, or browser test. Integration tests validate the tool descriptor, component resource, bridge messages, auth denial, loading, error, and retry states.

03 / BOUND

Production boundary

Treat component messages as untrusted input, enforce CSP and origin rules, and keep consequential authorization on the server.

04 / PROVE

Acceptance evidence

Integration tests validate the tool descriptor, component resource, bridge messages, auth denial, loading, error, and retry states.

SOURCE / HTTP

Reproducible source probe

curl -fsSI 'https://developers.openai.com/plugins/build/chatgpt-ui' | sed -n '1,5p'