The artifact
A Launch is a small remote MCP service that speaks Streamable HTTP
on a path like /mcp. Official clients open a session,
list tools, and call them. We do not wrap your whole OpenAPI spec.
We pick one user workflow and cut it to a handful of read-only tools,
usually 8 to 12, with titles, descriptions, JSON Schema inputs, and
read-only annotations the clients actually read.
The model never sends a tenant id that expands its access. Tenant comes from the authenticated principal on the request. If the tool args name a resource from another tenant, the server returns a closed denial. We do not distinguish “not found” from “not yours” in the payload. That is on purpose.
Tool results are compact JSON, capped so the model does not drown. Errors are explicit. Unknowns stay labeled unknown. We do not dump internal notes, secrets, or extra fields because a serializer was lazy.
You own the repository, the cloud account, the OAuth application, the domain, the privacy policy, the sandbox tenants, and the submit button. We work in that repo. We leave a runbook. We leave tests. We leave.
Authorization is the product
Most intern MCP demos die here. Claude and ChatGPT do not want a long-lived personal access token in a README. Directory review wants OAuth with a real user in the loop. Custom connectors are sloppier. Production is not.
We wire your existing user-scoped OAuth so an agent can only do what that user could already do. We do not stand up a new identity provider unless you hire us to, and that is a change order. We do not mint a static bearer and call it OAuth.
Each client has its own handshake. Get it wrong and the UI says the server is down, even when it is not. That is a week of someone’s life. It is also the job.
First launches stay read-only. No payments. No deletes. No “fetch this URL.” No proxying another customer’s traffic through your connector.
How we know it works
Two layers. First, deterministic tests against the MCP handler: protocol handshake, tool list, happy path, missing token, bad scope, cross-tenant id. Those tests call the expected tool. They prove the server. They do not prove a model.
Second, a signed set of 20 to 30 natural-language prompts. A human or a live client runs them. The model has to pick the right tool and return the right fact, including the denial case. A Launch is not done until those prompts hold up in each agreed client, three runs, at least 90 percent correct. Directory ranking is not a pass condition.
Grok
Grok is three different MCP surfaces. The CLI, grok.com, and the xAI API do not fail the same way. Loopback that works in the CLI is not a grok.com connector. A public HTTPS name that works in chat is not the same as an API-side agent. We name the path you care about and verify that one. We do not promise a directory slot.
Claude
Custom connectors and the Connectors Directory share a runtime. Review is the difference. A Launch can stop at custom. Directory submission is your org, your test account, your click. We prepare the package. Anthropic still decides.
The failure you will hear is “Couldn’t reach.” curl is fine. The UI is not. That usually means Claude did not like the auth handshake, not that the process died. Token expiry, the wrong transport, and a hostname the server does not expect all show up as the same toast. We treat that as the work.
Humans see tool titles. The model reads descriptions. We write both as if a stranger’s agent will use them, because it will. Widgets and extra UI in the transcript are out of the default Launch.
ChatGPT and GPT
ChatGPT will not talk to localhost. The form for a custom MCP does not have a box that says “paste a bearer.” OAuth is what production wants. A static token at the HTTP gate does not map onto that form. If you go looking for an Apps toggle in Settings, you will think the feature is missing. It has moved. Twice.
Codex is another client on the same server. Widgets in the transcript are a different product. Default Launch is tools and JSON. A Pro upsell after a long tool thread is not a requirement.
Plugin submission is yours: org, policy URL, test account, public MCP. We draft the pack. OpenAI still says no sometimes. That is not a refund condition.
Side by side
| Grok | Claude | ChatGPT / GPT | |
|---|---|---|---|
| Where it runs | CLI, grok.com, xAI API | claude.ai, Desktop, Code | ChatGPT web, Codex |
| Local dogfood | CLI to loopback HTTP | Needs public HTTPS | Needs HTTPS or OpenAI tunnel |
| Auth it wants | CLI can prove it privately. grok.com cannot. | OAuth for anything you would show a reviewer | OAuth for production. A README token will not do. |
| How it fails | Doctor/handshake errors you can read | “Couldn’t reach” on discovery and 401s | Plugin create fails, or tools never attach in the + menu |
| What we verify | Signed prompts on the paths you named | Same, plus permission UI and titles | Same, plus Developer mode and plugin attach |
What we will not do
We will not build you a multi-tenant MCP SaaS. We will not copy production end-user credentials. We will not take write or payment tools on a first Launch. We will not promise Anthropic or OpenAI will list you. We will not expand to “all of the API” because a generator made that look cheap.
If the honest engineering answer is “don’t ship this workflow as an agent yet,” that is the Audit. You should want that answer before you want code.