chatgpt-mcplisted

# ChatGPT MCP Integration (bearer + OAuth 2.1) Hand-rolled MCP server (~500 LOC, no SDK) + OAuth 2.1 PKCE in front of it so MCP-aware clients (ChatGPT custom apps, Claude.ai web, Cursor, Cline, `mcp-remote` stdio bridge) can talk to it. Two host shapes are covered: - **Next.js + custom auth** — single-tenant admin-gated, MCP endpoint at `/api/mcp`, OAuth on Next routes. - **Convex self-hosted + `@convex-dev/auth`** — multi-user, per-user OAuth + per-user static-bearer tokens, MCP at the SITE origin via `httpRouter`. The Convex-specific gotchas below bit hard in real deployments — read them first if your backend is Convex. ## Decision tree (run first) | Need | Build | |---|---| | Curl/script automation, internal only | **Phase 1 only** (bearer). 30 min, 1 env var. | | ChatGPT custom app | **Phase 1 + 2** (bearer + OAuth). ChatGPT form has no API-key field — OAuth mandatory. | | Production w/ revocable per-user tokens | **Phase 1 + 2 + 3** (admin UI / user-settings UI). | Always build bearer first — keeps a dev escape hatch after OAuth lands. ## Phase 1 — MCP bearer server Generate secret: `openssl rand -hex 32`. Set in BOTH places (frontend env + backend env, e.g. Convex `npx convex env set MCP_API_KEY <hex>`). Multi-tenant apps can skip the env secret entirely and mint per-user DB-backed tokens from day one — no standing shared credential to keep in sync across two runtimes (then pitfall #3 and checklist item 1 don't apply). Files to create (paths from the Next.js