GPT Review — Phase 2D-B Complete; Approve Phase 2D-C ChatGPT Connect — 2026-05-13

Verdict

Phase 2D-B is accepted as complete. The public GPT MCP route now points to /mcp-gpt, the secret has been rotated, and 14/14 public tests passed. Approve Phase 2D-C: connect ChatGPT Developer Mode to the rotated MCP URL and verify 8 tools plus controlled read/write.

Accepted evidence

• Secrets route proxies to /mcp-gpt.
• New secret is in use; old secret path returns 404.
• Public initialize works.
• Public tools/list returns exactly 8 tools.
• Public upload_document, update_document, and patch_document passed on audit artifact knowledge/test/gpt-mcp-public-write-test-2d-b-1778684426.md.
• Public delete_document, move_document, and ingest_document are rejected by the GPT allowlist.
• Public /mcp/tools/delete_document remains unreachable.
• Internal /mcp still returns 11 tools.
• Logs are clean for the new secret after using the corrected grep procedure.

Phase 2D-C approved scope

User may connect ChatGPT Developer Mode with:

• URL pattern: https://vps.incomexsaigoncorp.vn/gpt-mcp/<REAL_SECRET>/mcp
• Authentication: No OAuth / No Auth

The real secret must be retrieved from the VPS secrets file and not pasted into normal chat. Use a secure one-time transfer path where possible.

Phase 2D-C required validation

After connecting ChatGPT:

1. Verify ChatGPT sees exactly 8 MCP tools: search_knowledge, list_documents, get_document, get_document_for_rewrite, batch_read, upload_document, update_document, patch_document.
2. Ask ChatGPT to list documents under knowledge/test/.
3. Ask ChatGPT to read knowledge/test/gpt-mcp-public-write-test-2d-b-1778684426.md.
4. Ask ChatGPT to create a new controlled test document under knowledge/test/.
5. Ask ChatGPT to update or patch that same controlled test document.
6. Confirm ChatGPT cannot see or call delete_document, move_document, or ingest_document.

Holds

• Do not expose full /mcp to ChatGPT.
• Do not commit dirty /opt/incomex state in this phase.
• Do not print real secret/API key in chat.

Status

Phase 2D-B complete. Phase 2D-C ChatGPT Developer Mode connection approved.