ChatGPT App

HoneyGrid Admin ChatGPT App

Architecture

ChatGPT App connects to HoneyGrid Admin MCP at /mcp. OAuth is handled by Stytch Connected Apps. The HoneyGrid Admin Worker introspects Stytch bearer tokens, captures token scopes, resolves the Stytch member and roles, then enforces tool policies for every MCP tool call.

• ChatGPT App → HoneyGrid Admin MCP /mcp
• OAuth via Stytch Connected Apps
• Token introspection in Worker
• Role enforcement in MCP tool policies

Endpoints

Staging:

https://admin-staging.honeygrid.ai/mcp
https://admin-staging.honeygrid.ai/.well-known/oauth-protected-resource
https://admin-staging.honeygrid.ai/.well-known/oauth-authorization-server

Production:

https://admin.honeygrid.ai/mcp
https://admin.honeygrid.ai/.well-known/oauth-protected-resource
https://admin.honeygrid.ai/.well-known/oauth-authorization-server

Security model

• Scopes = app/token consent and ChatGPT securitySchemes.
• Roles = user authorization and actual tool access.
• Flags = write/destructive feature enablement by provider/environment.
• Approval IDs = destructive production guardrail requiring separate human approval.
• Audit = traceability for every MCP tool call.

Do not add mcp:prod:destructive-approver as a public OAuth scope. Destructive approval is a Stytch member role only.

Stytch setup

1. Run the policy script against test first. Either pass explicit management credentials or use --target test with STYTCH_ADMIN_TEST_MANAGEMENT_KEY_ID / STYTCH_ADMIN_TEST_MANAGEMENT_SECRET in .env.local:

pnpm tsx apps/honeygrid-admin/scripts/update-stytch-admin-policy.ts \
  --target test \
  --dry-run

pnpm tsx apps/honeygrid-admin/scripts/update-stytch-admin-policy.ts \
  --target test

Explicit form:

pnpm tsx apps/honeygrid-admin/scripts/update-stytch-admin-policy.ts \
  --key-id <STYTCH_MANAGEMENT_KEY_ID> \
  --secret <STYTCH_MANAGEMENT_SECRET> \
  --project-slug <STYTCH_PROJECT_SLUG> \
  --environment-slug <STYTCH_ENVIRONMENT_SLUG>

2. Verify resources, roles, and scopes in the Stytch Dashboard, then run the audit. The audit can verify policy shape with management credentials; member assignment checks require a project secret:

pnpm --filter=honeygrid-admin check:stytch-roles -- --target test

3. Run the policy script against live with --target live and STYTCH_ADMIN_LIVE_MANAGEMENT_KEY_ID / STYTCH_ADMIN_LIVE_MANAGEMENT_SECRET, then audit live:

pnpm tsx apps/honeygrid-admin/scripts/update-stytch-admin-policy.ts \
  --target live \
  --dry-run

pnpm tsx apps/honeygrid-admin/scripts/update-stytch-admin-policy.ts \
  --target live

pnpm --filter=honeygrid-admin check:stytch-roles -- --target live

4. Configure the redirect URL from the ChatGPT app page:

https://chatgpt.com/connector/oauth/{callback_id}

Warning: Stytch RBAC policy PUT overwrites the entire policy. The script prints resources, roles, and scopes before PUT; review before running against live.

ChatGPT setup

1. Enable Developer Mode.
2. Open Settings → Apps/Connectors → Create.
3. Set Connector URL to the /mcp endpoint.
4. Choose OAuth/CIMD if available.
5. Refresh metadata after deploy.

Testing checklist

• search lists tools.
• execute read-only call works.
• Missing Stytch role blocks tool despite scope.
• Missing scope triggers reauthorization.
• Write tools require proper role and env flag.
• Production destructive flow requires separate approval.
• Audit log records the call.