Build and test a ChatGPT app with MCP, UI, and authentication

{
  "name": "chatgpt-mcp-app",
  "private": true,
  "type": "module",
  "scripts": {
    "start": "node --env-file=.env src/index.mjs",
    "check": "node --check src/index.mjs",
    "smoke": "node --env-file=.env test/smoke.mjs",
    "test:failures": "node test/failures.mjs",
    "eval": "node eval/run.mjs"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "1.30.0",
    "@modelcontextprotocol/ext-apps": "1.7.5",
    "express": "5.2.1",
    "zod": "4.4.3"
  }
}

import express from "express";
import { randomUUID } from "node:crypto";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { z } from "zod";

const app = express();
app.use(express.json({ limit: "256kb" }));

function createMcpServer(auth) {
  const server = new McpServer({
    name: "support-status",
    version: "1.0.0"
  });

  server.registerTool(
    "lookup_status",
    {
      title: "Look up service status",
      description: "Read the status of one server-authorized service.",
      inputSchema: { serviceRef: z.string().max(80) },
      annotations: {
        readOnlyHint: true,
        destructiveHint: false,
        openWorldHint: false
      }
    },
    async ({ serviceRef }) => {
      const status = await statusStore.read(auth.tenantId, serviceRef);
      return {
        content: [{ type: "text", text: "Status retrieved." }],
        structuredContent: {
          serviceRef,
          state: status.state,
          observedAt: status.observedAt
        }
      };
    }
  );
  return server;
}

app.post("/mcp", authenticateBearer, async (req, res) => {
  const server = createMcpServer(req.auth);
  const transport = new StreamableHTTPServerTransport({
    sessionIdGenerator: () => randomUUID()
  });
  res.on("close", () => {
    transport.close();
    server.close();
  });
  await server.connect(transport);
  await transport.handleRequest(req, res, req.body);
});

app.listen(3000, "127.0.0.1");

import { z } from "zod";
export const resultSchema = z.object({
  status: z.enum(["completed", "needs_review", "refused", "failed"]),
  summary: z.string().max(8000),
  evidence: z.array(z.object({
    locator: z.string().max(500),
    note: z.string().max(1000)
  })).max(100),
  warnings: z.array(z.string().max(500)).max(20)
}).strict();

import assert from "node:assert/strict";

const initialize = await mcpFixture.initialize({
  origin: "https://chatgpt.com",
  token: "fixture-token"
});
assert.equal(initialize.protocolVersion.length > 0, true);

const tools = await mcpFixture.listTools();
const lookup = tools.find(tool => tool.name === "lookup_status");
assert.equal(lookup.annotations.readOnlyHint, true);

const result = await mcpFixture.callTool("lookup_status", {
  serviceRef: "service-fixture"
});
assert.equal(result.structuredContent.state, "operational");
assert.equal(mcpFixture.crossTenantReads, 0);
assert.equal(mcpFixture.unconfirmedWrites, 0);
console.log("SMOKE_OK id=mcp_fixture evidence=6 artifact=chatgpt-app");