> For the complete documentation index, see [llms.txt](https://docs.datasentinel.io/manual/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.datasentinel.io/manual/ai-connector/connect-a-desktop-app/configure-chatgpt-desktop-app.md). # Configure the ChatGPT desktop app Connect the ChatGPT desktop app, with ChatGPT and Codex, to your Datasentinel MCP server, sign in, and install the Datasentinel Skill. This page shows how to wire the **ChatGPT desktop app** (OpenAI's application for Windows and macOS) to your Datasentinel platform: add the **MCP server**, **sign in** once, install the **Skill** that tells the assistant how to use it, and check that everything is connected. The desktop app brings **ChatGPT** (with its **Chat** and **Work** modes) and **Codex** together in one app, and they share the same MCP and Skill configuration. Since September 2026, it also replaces the Codex app: updating the Codex app turns it into the ChatGPT desktop app (version 26.924 and later), and existing Codex chats and projects are kept. The setup below serves ChatGPT and Codex alike. For the terminal version, see [Configure OpenAI Codex CLI](/manual/ai-connector/connect-a-cli-assistant/configure-codex-cli.md). {% hint style="info" %} The steps below follow OpenAI's documentation, last checked on 6 October 2026. OpenAI changes the ChatGPT desktop app often. {% endhint %} {% hint style="info" %} **Desktop app, not ChatGPT on the web.** The MCP servers you add in the desktop app run from your machine, so a platform on a private network or behind a VPN works normally, and the sign-in happens in your own browser. Datasentinel has verified it with a private MCP server, from ChatGPT and from Codex. ChatGPT on the web is a different path: its developer-mode apps are called from OpenAI's cloud, which must reach both the MCP endpoint and the sign-in endpoints of the platform. See [Using ChatGPT on the web instead](#using-chatgpt-on-the-web-instead) below. {% endhint %} ## Before you start * The ChatGPT desktop app is installed and you are signed in. Codex requires a ChatGPT Plus, Pro, Business, Edu, or Enterprise plan, or API-key billing. If the app is not installed, follow the steps below. * Your Datasentinel MCP server is reachable over HTTPS at `https:///mcp`. See [MCP Server Setup](/manual/ai-connector/server-setup/mcp-server-setup.md) if it is not yet running. ## Install the ChatGPT desktop app The app is distributed through the Microsoft Store on Windows. Install it with `winget`: ```powershell winget install --id 9PLM9XGG6VKS -s msstore ``` You can also install it from the [Microsoft Store listing](https://apps.microsoft.com/detail/9plm9xgg6vks) directly. On macOS (Apple Silicon), download the installer from OpenAI's [ChatGPT desktop app](https://learn.chatgpt.com/docs/app) page. Launch the app and sign in with your ChatGPT account when prompted. If you had the Codex app, update it instead: it becomes the ChatGPT desktop app. On Windows, Codex runs its agent in a native PowerShell sandbox; you can switch it to WSL2 in the app's settings. {% hint style="warning" %} **Name MCP servers with a `datasentinel-` prefix.** Every Datasentinel MCP server you register must be named starting with `datasentinel-`, for example `datasentinel-production` or `datasentinel-staging`. The Skill discovers Datasentinel servers by this prefix, so a server named otherwise will not be picked up. Use a distinct suffix per platform when you operate more than one (`datasentinel-prod`, `datasentinel-eu`, and so on). {% endhint %} ## Set it up {% stepper %} {% step %} #### Add the Datasentinel MCP server In the app, open **Settings**, select **MCP servers**, then click **Add server**. Enter the name `datasentinel-production`, choose **Streamable HTTP** as the type, and set the URL to `https:///mcp`. Save, then select **Restart** so the app picks the server up. {% hint style="info" %} **Sign in on first use.** The Datasentinel MCP server is protected by OAuth 2.1. Nothing else goes in the configuration: no token, no header. The sign-in is the next step. See [How authentication works](/manual/ai-connector/server-setup/how-authentication-works.md). {% endhint %} The app writes this to the shared Codex configuration file, which on Windows is: ``` %USERPROFILE%\.codex\config.toml ``` You can edit that file directly instead of using the dialog. The equivalent entry is: ```toml [mcp_servers.datasentinel-production] url = "https:///mcp" ``` Because the ChatGPT desktop app, the Codex CLI, and the Codex IDE extension all read this file, a server added in one of them shows up in the others. For the full reference, see OpenAI's [Model Context Protocol](https://learn.chatgpt.com/docs/extend/mcp) documentation. **Self-signed or invalid certificate** If your platform serves the `/mcp` endpoint with a self-signed or otherwise invalid TLS certificate, the app rejects the connection by default. {% hint style="info" %} Using a valid TLS certificate is **highly recommended**. A certificate trusted by your host (from a public authority, or from an internal CA installed in the system trust store) keeps validation on and avoids the workaround entirely. {% endhint %} To trust your internal CA, point the app at a PEM file that contains it with the `CODEX_CA_CERTIFICATE` environment variable. On Windows, set it as a persistent user variable from PowerShell, then restart the app: ```powershell setx CODEX_CA_CERTIFICATE "C:\path\to\internal-ca.pem" ``` If `CODEX_CA_CERTIFICATE` is unset, the app falls back to the standard `SSL_CERT_FILE` variable. The added certificate applies to all outbound HTTPS, including connections to MCP servers. There is no documented switch to turn off certificate verification entirely, so trusting your CA is the supported path. {% hint style="info" %} These certificate variables are documented in the Codex source and changelog rather than the main configuration reference, so confirm them against the version you run. {% endhint %} The sign-in below opens the login page in your browser, so the browser must trust the certificate too. {% endstep %} {% step %} #### Sign in to the platform **With a browser** After the restart, the **MCP servers** list shows which servers are enabled and which require OAuth. Select **Authenticate** next to `datasentinel-production`: the app opens the Datasentinel login page in your browser. Sign in with your **platform login and password**, the same ones as the Datasentinel web interface. The page names the assistant that is asking; after the sign-in the browser hands the session back to the app, and the server shows as connected with its tools. You sign in once. The app stores the session (in the operating system's credential store, or in a file under the `.codex` folder when no store is available) and renews it by itself. It asks again only after ten days without using the server, or when an administrator ends the session. Your password goes to the login page only; the app never sees it and never asks for a token. Because the configuration is shared, the session also serves the Codex CLI and IDE extension on the same machine, and `codex mcp logout datasentinel-production` from the CLI ends it. **Without a browser** The desktop app always runs next to a browser, so the sign-in returns to the app on the same machine. The no-browser case, a Codex CLI on a remote server, is covered on the [Codex CLI page](/manual/ai-connector/connect-a-cli-assistant/configure-codex-cli.md#sign-in-to-the-platform). **For a script or a scheduled run** Where nobody can sign in, register the server with a user token as an authorization header instead. The token is the platform's 24-hour [user token](https://app.gitbook.com/o/DaDQkGCM7r2TghFSBFLQ/s/yE16Xb3IemPxJWydtPOj/implementation/platform-usage/api-reference/access-token). The server entry names an environment variable holding it, so the token is never written in the configuration: ```toml [mcp_servers.datasentinel-production] url = "https:///mcp" bearer_token_env_var = "DS_TOKEN" ``` Set the variable persistently for your user (`setx DS_TOKEN ""` in PowerShell on Windows), then restart the app. A server registered this way never shows **Authenticate**; when the token expires, the calls fail until a fresh one is set. See [Refresh the user token automatically](/manual/ai-connector/developers/refresh-user-token.md) to keep it current. {% endstep %} {% step %} #### Install the Datasentinel Skill The Datasentinel Skill is made of several files (a `SKILL.md` entrypoint plus supporting files) and ships as a single archive, `datasentinel-skill.zip`. Download it from . Skills for the desktop app are file-based, discovered from `%USERPROFILE%\.agents\skills` on Windows (`$HOME/.agents/skills` on macOS). Create that directory if it does not exist yet, then extract the archive into it so it produces a `datasentinel\` folder: ```powershell New-Item -ItemType Directory -Force "$env:USERPROFILE\.agents\skills" | Out-Null Expand-Archive -Path datasentinel-skill.zip -DestinationPath "$env:USERPROFILE\.agents\skills" ``` You should end up with `%USERPROFILE%\.agents\skills\datasentinel\SKILL.md` alongside the Skill's supporting files. Its frontmatter carries the `description` the assistant uses to decide when to apply the Skill: ```markdown --- name: datasentinel description: How to query Datasentinel metrics through the datasentinel-* MCP servers. --- ``` The Skill then appears in the **Skills** panel in the sidebar. Only its name and description are loaded up front; the full instructions load when the Skill is actually applied. For how Skills are packaged and discovered, see OpenAI's [Build Skills](https://learn.chatgpt.com/docs/build-skills) reference. {% endstep %} {% step %} #### Check your configuration Type `/mcp` in the composer to list the MCP servers the app has connected. `datasentinel-production` should appear there with its tools. A server still marked as requiring OAuth has not completed the sign-in: go back to the previous step. If it does not appear, check the URL in `config.toml`, confirm the app was restarted after the edit, and verify the server is up. **Approve the Datasentinel tools** The first time the assistant calls a Datasentinel tool, the app asks you to approve it, once or for the rest of the session. To stop the prompts for good, set the approval mode of the server in `config.toml`, which the app shares with Codex: ```toml [mcp_servers.datasentinel-production] url = "https:///mcp" default_tools_approval_mode = "approve" ``` The modes are `approve` (never ask), `prompt` and `writes` (both ask for tools not marked read-only, which is every Datasentinel tool today), and `auto`. The Datasentinel tools only read monitoring data, so approving the whole server is safe. See the [Codex MCP guide](https://learn.chatgpt.com/docs/extend/mcp?surface=app) for the per-tool override. {% endstep %} {% endstepper %} ## Codex: local and cloud chats When you start a Codex chat, you choose where it runs. **Local** and **Worktree** chats run on your computer: they use your machine's network, so a Datasentinel platform on a private network or behind a VPN is reachable as long as your workstation reaches it, and the MCP server, the sign-in and the Skill all work as described above. A **Cloud** chat or task is different. It runs in an isolated container hosted by OpenAI, with no access to your machine or your private network, and with internet access blocked during the agent phase unless you allow domains in the environment settings. The MCP servers configured on your workstation do not apply there. For a cloud task to reach a Datasentinel platform, the platform has to be reachable from OpenAI's side, in one of two ways: * **A public endpoint.** Publish `https:///mcp` on the internet with a publicly trusted certificate; the OAuth sign-in already protects it, as described in [MCP Server Setup](/manual/ai-connector/server-setup/mcp-server-setup.md). * **OpenAI's Secure MCP Tunnel.** Keep the platform private and run OpenAI's [tunnel client](https://github.com/openai/tunnel-client) on a host that reaches it. See [Using ChatGPT on the web instead](#using-chatgpt-on-the-web-instead) below and OpenAI's [cloud internet access](https://learn.chatgpt.com/docs/cloud/internet-access) reference. See also [MCP servers on a private network](/manual/ai-connector/troubleshooting/private-network-mcp-servers.md). Once the server is connected and the Skill is in place, run through the checks below to confirm the end-to-end flow. ## How the Skill loads The Datasentinel Skill loads on demand. The app reads every Skill's name and `description` up front (that is what the **Skills** panel lists), and applies the full instructions automatically when your prompt relates to Datasentinel: asking about PostgreSQL performance, instances, sessions, or the platform itself is enough. One Skill serves every platform, because it discovers all the `datasentinel-*` MCP servers you registered, so adding a second platform needs no Skill change. If the assistant answers generically instead (no Datasentinel tool calls in the response), load the Skill manually: * In **ChatGPT**, type `@` in the composer and pick `datasentinel` to attach the Skill to your request. * In **Codex**, type `$` and pick `datasentinel`, or run `/skills` to browse and invoke it. * Or name it in the prompt: `Use the datasentinel skill to check the platform status.` If the Skill is missing from the **Skills** panel, re-check the extraction path from the setup step. See OpenAI's [Build Skills](https://learn.chatgpt.com/docs/build-skills) reference for the invocation details. ## Test the MCP server and Skill In the app, ask the assistant in plain language to run the Datasentinel Skill's built-in checks (see [How the Skill loads](#how-the-skill-loads) above). Run these in order: | Ask ChatGPT or Codex for… | What it does | | ------------------------- | ------------------------------------------------------------------------------------- | | `datasentinel help` | Displays the Skill's help, listing the available commands. | | `datasentinel platforms` | Lists every MCP server (platform) the Skill discovered by its `datasentinel-` prefix. | | `datasentinel status` | Checks the platform status, confirming the MCP server answers. | | `datasentinel whoami` | Shows who you are signed in as, your privilege and the session expiry. | These four are the setup checks. The full command list, with what each one needs, is in the [Skill commands reference](/manual/ai-connector/use-the-assistant/skill-commands.md). Start with `datasentinel help` to confirm the Skill responds. Then run `datasentinel platforms` to verify your server is discovered: each `datasentinel-*` MCP server you registered should appear in the list. Then run `datasentinel status` to confirm the platform is reachable and the MCP tools return live data. Finally, `datasentinel whoami` confirms the session belongs to your platform user, with the privilege you expect. {% hint style="success" %} If `datasentinel status` reports a healthy platform, the MCP server and the Skill are wired together correctly. You can now ask the assistant questions about your instances in plain language. {% endhint %} {% hint style="info" %} **Server not discovered? Ask the assistant to find the root cause.** If `datasentinel platforms` lists nothing, or your server is missing from it, ask the assistant to debug the setup rather than hunting by hand. It runs on your machine, so it can read the `[mcp_servers.]` tables in `%USERPROFILE%\.codex\config.toml`, list the tools it actually sees, and probe the endpoint itself. That usually pinpoints the cause in one pass. Ask it something like: ``` The datasentinel-production MCP server is not discovered. Investigate and find the root cause: check my MCP configuration in %USERPROFILE%\.codex\config.toml, the connection status of the server, and whether the /mcp endpoint answers. ``` Typical causes it surfaces: a server name that misses the `datasentinel-` prefix, a typo in the URL, an app that was not restarted after the edit, a server you have not signed in to, a Skill extracted to the wrong folder, a Codex chat run in **Cloud** against a private platform, an untrusted TLS certificate, or a platform that is down. {% endhint %} ## Using ChatGPT on the web instead ChatGPT on the web does not read the local Codex configuration, so the setup above does not apply there. Remote MCP servers are added as **developer mode** apps in your account, and OpenAI's cloud connects to them on your behalf. That changes three things: * **Everything must be reachable from OpenAI's infrastructure.** Not only the `/mcp` endpoint: the sign-in also involves OpenAI's servers, which register ChatGPT as a client and exchange the authorization code for tokens on the platform's OAuth endpoints. The platform therefore needs a public hostname with a publicly trusted TLS certificate; a host behind a VPN, a corporate firewall, or a self-signed certificate does not work as-is. Your own browser must reach the login page too. * **The sign-in is the same, in the conversation.** ChatGPT registers itself with the platform (dynamic client registration) and, when the app is first used, shows a connection prompt: it opens the Datasentinel login page, you sign in with your platform login and password, and ChatGPT keeps the session. OpenAI's [Apps SDK authentication](https://developers.openai.com/apps-sdk/build/auth) reference describes the flow; the redirect address ChatGPT uses is on `chatgpt.com`, which the Datasentinel server accepts. * **Skills work differently.** Standalone file-based Skills are a desktop-app feature; the hosted product uses plugin-bundled Skills instead. To add the server there: {% stepper %} {% step %} #### Enable developer mode Open **Settings**, go to **Security and login**, and turn **Developer mode** on. It is available on Plus, Pro, Business, Enterprise, and Edu plans. In a workspace, an admin may have to enable it first. {% endstep %} {% step %} #### Create the app From the plugins page, click **Create** and fill in a name starting with `datasentinel-`, the URL `https:///mcp`, and a short description. Choose **OAuth** as the authentication, with no client id or secret: ChatGPT registers itself with the platform on its own. Do not choose **No authentication**, which would leave every call rejected with a sign-in error. {% endstep %} {% step %} #### Enable it in a conversation and sign in In a chat, click the **+** button, choose **Developer mode**, and select the Datasentinel app. It has to be enabled per conversation, and stays active for the rest of that conversation. On first use, ChatGPT shows the connection prompt: follow it to the Datasentinel login page and sign in. {% endstep %} {% endstepper %} {% hint style="info" %} **Private platform, no public endpoint?** If the platform must stay private, OpenAI's [Secure MCP Tunnel](https://developers.openai.com/api/docs/guides/secure-mcp-tunnels) keeps it off the internet: you run OpenAI's [tunnel client](https://github.com/openai/tunnel-client) on a host that reaches the platform, it makes outbound-only connections to OpenAI and relays the MCP requests, and the app then points at the tunnel instead of a URL. The tunnel carries the MCP traffic and the OAuth discovery, but OpenAI's guide notes that the authorization server itself is not automatically tunneled; with Datasentinel it lives on the same host as `/mcp`, so verify in that guide that the sign-in endpoints are covered by your tunnel setup, and remember that your browser must reach the login page, for example through the corporate network or VPN. Tunnels are created in the OpenAI platform settings by an organisation administrator. Otherwise, use the desktop app, which reaches your platform directly. {% endhint %} {% hint style="warning" %} The exact labels in these settings screens change fairly often as OpenAI reorganizes apps, connectors, and plugins. If the wording does not match, look for **Developer mode** under the security or advanced settings of your account. See OpenAI's [ChatGPT developer mode](https://developers.openai.com/api/docs/guides/developer-mode) guide for the current reference. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.datasentinel.io/manual/ai-connector/connect-a-desktop-app/configure-chatgpt-desktop-app.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.