--- title: "How to List Your SaaS in the ChatGPT Plugin Directory | Viraloop" description: "Submit a ChatGPT and Codex plugin: the .codex-plugin manifest, MCP review, domain verification, test credentials, test cases and the review checklist OpenAI runs." source: https://viraloop.io/ai-plugin-directories/chatgpt-plugins --- [AI plugin directories](/ai-plugin-directories) # How to list on ChatGPT and Codex plugins OpenAI retired the 2023 plugin platform, then brought plugins back in 2026 as the packaging for apps in ChatGPT and Codex: a skill, an MCP server and optional UI, published to one directory both products read. It is the biggest consumer audience on this list and the strictest review. Budget a week for the submission itself, most of it spent on the reviewer materials rather than the code. You ship .codex-plugin/plugin.json, .mcp.json, skills/, a hosted MCP with OAuth Submit at platform.openai.com/plugins Review Human review of the MCP server, tool metadata and eight test cases Auth OAuth 2.1 on the hosted MCP, plus a demo login for reviewers 01 ## What you are submitting The plugin folder is small. The submission form is not. OpenAI wants a public production MCP server it can scan, the exact tool annotations, a demo account, eight scripted test cases and the directory listing copy. Prepare all of it before you open the portal, because the form is easier to finish in one sitting. - .codex-plugin/plugin.json: name, version, description, author, homepage, skills path, mcpServers path, apps path and the interface block (display name, descriptions, category, capabilities, privacy and terms URLs, starter prompts, brand color, icon) - .mcp.json: the local MCP command, and .app.json: the registered ChatGPT MCP connection id for the hosted server - skills//SKILL.md: captured as a snapshot at submission time, so it does not update live - A hosted MCP server on a public URL with OAuth 2.1, dynamic client registration and PKCE - Tool annotations on every MCP tool: readOnlyHint, openWorldHint, destructiveHint 02 ## Before you can submit 1. 1Complete individual or business verification at platform.openai.com/settings/organization/general. The verified name must match the publisher name, website, support contact, privacy policy and terms in the listing. 2. 2Give your role Apps Management write access at platform.openai.com/settings/organization/people/roles. 3. 3Serve the domain challenge token at https:///.well-known/openai-apps-challenge on the MCP hostname or its parent. The endpoint must return only that plugin's token. 4. 4Create a demo account for reviewers with no MFA, no SMS or email confirmation and no private network. Fund it, because the reviewer will run real actions. 5. 5Write five positive and three negative test cases, each with a prompt and the expected behavior, and confirm they pass on ChatGPT web and mobile. 03 ## Submit it 1. 1Open platform.openai.com/plugins and start a submission. 2. 2Enter the MCP server URL and auth config. The portal scans the server and validates the tool metadata. 3. 3Fill in the listing: names, short and long descriptions, logo, category, website, support, privacy and terms URLs. 4. 4Attach the skill bundle, starter prompts, test cases, test credentials, country availability and release notes. 5. 5Submit for review. There is no published timeline; ours took days, not hours. 6. 6After approval, pick the publication moment from the portal. The listing appears in the shared plugins directory for ChatGPT and Codex. 04 ## Review rules that reject submissions - Tool responses that include unnecessary personal data, auth secrets, debug payloads or internal identifiers. Audit every response against a realistic prompt first. - An MCP URL that points at an existing integration instead of your own production server. - A publisher identity that does not match the verified organization. - A demo account that asks for MFA, a confirmation email or a VPN. - A challenge endpoint shared with another plugin on the same host that returns the wrong token. Updates are a new version: re-scan the MCP server, submit again, publish the approved version. Plan your release cadence around that instead of shipping the manifest weekly. 05 ## What we learned shipping ours - The portal caps the icon at 10KB. A 256px PNG made the cut; anything prettier did not. - Stale unique indexes on our OAuth token collection broke every token exchange with a 500 during review. Test the full OAuth round trip from a clean ChatGPT account before you submit. - Normalize free-text inputs a model will send. ChatGPT sent "English" where our API expected an ISO code, and the reviewer's first generation failed. - The challenge token is per submission. If you resubmit and OpenAI issues a new token, redeploy the well-known route before you click submit. - Register the hosted MCP connection in ChatGPT developer mode first, then paste the connection id into .app.json. The id is per registration; recreate it if the connection is ever deleted. Vendor docs this guide is checked against - [Submit plugins](https://developers.openai.com/plugins/deploy/submission)developers.openai.com/plugins/deploy/submission - [MCP server review requirements](https://developers.openai.com/plugins/deploy/app-review)developers.openai.com/plugins/deploy/app-review - [Plugins overview](https://developers.openai.com/plugins)developers.openai.com/plugins ## Listed is step one. Being named is the job. Assistants recommend the brands they keep seeing. Viraloop generates and posts your short-form content daily, so the model's answer about you stays current. [Start posting daily](/register)[All directories](/ai-plugin-directories)