ChatGPT

Create an app with the MCP server in developer mode and sign in with ByDomu.

GuideRead-onlyOAuth

Before you start. Whoever connects needs to be able to manage the agency’s API keys, a Business plan or higher (or support-approved access), to be past the free trial and to have a verified email.

Turn on developer mode

Custom MCP servers are added in ChatGPT’s developer mode, on the web, with Plus, Pro, Business, Enterprise and Education plans. Go to Settings › Security and login › Developer mode and turn it on. On Business, Enterprise and Education, if it doesn’t show up, a workspace admin has to enable it.

Create the ByDomu app

Open Plugins and tap + to create a developer-mode app for an MCP server.
Name ByDomu, URL https://mcp.bydomu.com/mcp and OAuth authentication, with no client ID: ChatGPT registers itself.
When you create it, ChatGPT opens ByDomu: review the agency and the permissions and tap Allow.

Names are those in OpenAI’s English docs and may appear translated. If something on the server changes, use Refresh on the app.

Use it in a chat

In the chat, + › Developer mode › ByDomu. The nine tools are declared read-only (readOnlyHint), so ChatGPT doesn’t ask you to confirm each query as it would for a write. Ask, for example, “Which deals are in negotiation and how much do they add up to?”.

What you can’t do

ChatGPT doesn’t allow your own keys or headers: with ByDomu it connects only with sign-in (OAuth).
Deep research only uses servers with tools named search and fetch; ByDomu doesn’t have them, so it’s used in developer mode, not there.
It doesn’t create or change anything in ByDomu: for that, use the API from your own code.

What it can do, how to revoke it and good practices

The server is read-only: the AI can query, but it doesn’t create, change or delete anything, and it never messages your customers. It only sees what these permissions allow, with a secret key’s limit (60 requests per minute).

It canPermission

Search and view published listingsportal:read

Search and view contactscontacts:read

Calendar and appointmentsappointments:read

Read a contact’s messagesconversations:read

Pipelines and dealsdeals:read

Pending taskstasks:read

With sign-in, each connection gets its own read-only credential. To remove it, go to Settings › API Keys › Connected apps › Remove access: the app’s next call fails and it has to ask for permission again. There you see who connected it, when it was last used and how many calls it made in 30 days. Access lasts while it’s used; after 30 days without use it must be allowed again.

One key per integration, with only the read permissions it uses. Leave conversations:read out if you don’t need messages.
The key goes in an environment variable or the client’s secret store, never pasted into a chat, a repository file or a URL.
What ByDomu returns includes text your customers wrote: treat it as data, not instructions. Don’t chain this connector with tools that send emails or messages without a person approving it.
Review Connected apps now and then and remove what’s no longer used.