Submit and publish to the directory

Lesson rewritten on November 3, 2026 based on the Upload and submit your plugin page in the OpenAI Plugins documentation. The previous lesson described publishing to a “ChatGPT Store” with a “pricing” step. Today, you submit a ZIP file of your plugin from the OpenAI platform’s plugins portal, and the plugin is published in the directory shared by ChatGPT and Codex. Source: Upload and submit your plugin.

How it works

You submit the already-built package (Lesson 10) as a ZIP file, address any findings from automated checks, and then send it for review. Once your plugin is approved, you decide when to publish it. Afterward, changes to your MCP server are picked up automatically after validation; only changes to metadata or skills require a new ZIP. A remote server is submitted via the With MCP path, using a stable, public HTTPS endpoint. A plugin that runs a local MCP server follows the desktop plugins workflow.

1. Upload the ZIP

Select the organization and project that own the plugin. Organization owners can submit; other members need the Apps Management Write permission. Verify your identity—individual or business—in your organization settings: the name associated with this identity is what the directory will display.

If the plugin uses an MCP server, include it in the initial ZIP: adding an MCP server to an existing plugin that only has skills is not currently possible. Next, open Plugins, select Upload new or existing plugin, choose your developer identity, then click Upload plugin and select your ZIP. After validation, the draft page opens. Never include credentials or secrets in the ZIP.

2. Address automated findings

The plugin page separates two panels because they evolve differently: Metadata & Skills, which tracks the version of the uploaded package, and MCPs, which shows the connected server and its analyzed tools.

• Metadata. Wait for checks to complete, review the Issues, fix your source package, and upload a corrected ZIP. Public URLs must be accessible and identify the same publisher as the submission. The Copy issues button lets you paste the findings into ChatGPT or Codex to suggest fixes.
• Skills. Skills are analyzed automatically; fix their instructions or files based on the findings. Required analyses must pass before any submission.
• MCP Server. A package can declare multiple servers, but only one can be connected per plugin. Open MCPs, select the server, then click Connect; verify the URL and authentication, complete the domain verification challenge, log in if required, wait for tool analysis, and review the findings.

Domain verification involves serving the challenge token, as plain text and nothing else, at the address specified by the portal:

https://<challenge-host>/.well-known/openai-apps-challenge

The host must be an HTTPS origin on the MCP server’s hostname or an eligible parent domain.

3. Submit for review

Reviewers need specific items to test the integration. Some of these can be included in plugin.json to be imported with the ZIP:

• Test credentials, if login is required: a dedicated account with sample data, never a real user’s account, usable immediately—without MFA, email/SMS codes, magic links, or private network access. Enter these credentials separately, outside the public package;
• Five positive test cases: scenario, prompt, expected tools, expected result, each already run with the test account;
• Three negative test cases: a request the plugin should not fulfill, why, and the expected refusal, clarification, or fallback;
• A video demonstrating the test cases and plugin functionality;
• Release notes for the submitted package.

Next, select the draft, click Submit for review, and confirm the required compliance attestations. Only one review can be active per plugin. Feedback arrives via email; if rejected, fix the issues and submit a corrected ZIP, or appeal by replying to the email.

4. Publish

Once the plugin is approved, open the approved version and select Publish plugin. Users can then find it in the directory shared by ChatGPT and Codex, either via a direct link to its listing or by searching for its name.

Updating

Two workflows coexist. For metadata, visuals, or skills, upload a new complete ZIP with an incremented version number to the existing plugin: the new version undergoes its own checks and review, and its publication replaces the previous one. For your server tools, nothing to upload: after the initial publication, OpenAI analyzes your server daily and makes eligible updates available as soon as they pass automated checks; you can also request an analysis immediately after a deployment. To change the URL of an existing MCP server, you must contact support.

Key takeaways

• Submit a ZIP of your plugin on the Plugins portal under a verified identity
• Metadata and skills on one side, MCP server and tools on the other: two separate control panels
• Domain verification via a token served at /.well-known/openai-apps-challenge
• Review requirements: test account without MFA, 5 positive cases, 3 negative cases, a video, and release notes
• After publication: new ZIP for metadata and skills, daily analysis for tools