> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude & ChatGPT MCP Setup

> Public TLS, OAuth consent and real tool calls from both clients.

# Connect Claude and ChatGPT to DataRelay Link

**Real remote MCP connection and tool calls have been tested with both Claude and ChatGPT.** Claude discovered 20 tools and completed six command/file tasks; ChatGPT exercised commands, files, Git and asynchronous jobs. See [client compatibility](https://link.datarelay.run/reference/mcp-validation.md). Follow the steps below on your installed Server.

## Step 1 — verify the public origin

Use **[https://mcp.example.net/mcp](https://mcp.example.net/mcp)**, replacing the hostname with your own. Public MCP requires **single443** and a publicly trusted certificate. Direct-mode Relay control on TCP/443 is not MCP HTTPS. Managed Host operations use the enrolled Agent; **server:self** targets the Server itself and needs separate authorization, without an Agent or exposed SSH.

Server shell:

```bash theme={null}
sudo drlink system version
sudo drlink system certificate status
sudo drlink system diagnostics mcp
sudo drlink show ai-identities
sudo drlink show ai-access
```

Keep an already working certificate. For first setup only, use your DNS name/email in Server REPL. AUTO\_ACME HTTP-01 needs public TCP/80 during issuance; imported certificates use user-certificate and certificate import.

```text theme={null}
set mcp-tls hostname mcp.example.net
set mcp-tls mode auto-acme
set mcp-tls contact-email admin@example.net
system certificate preflight
system certificate issue
system certificate status
```

From an external shell, check discovery. An unauthenticated MCP POST returning **401** is expected. OAuth issuer/resource/endpoints must share the configured public origin. TLS errors or an HTML login page are not successful discovery.

```bash theme={null}
curl --fail --show-error https://mcp.example.net/.well-known/oauth-authorization-server
curl --fail --show-error https://mcp.example.net/.well-known/oauth-protected-resource/mcp
curl -i -X POST https://mcp.example.net/mcp   -H 'Content-Type: application/json'   --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
```

## Step 2 — prepare identity and authorization

Use `set ai-identity chatgpt-lab` or `set ai-identity claude-lab` on the Server. A name or OAuth login alone does not grant authorization. Prefer distinct identities for the two clients.

The first approved owner may receive all Managed Host MCP capabilities through **mcp-owner-full-access**. Inspect existing rules before describing an identity as read-only. Follow [read-only access](https://link.datarelay.run/use-cases/ai-readonly.md) or the separately authorized [Server control lab](https://link.datarelay.run/use-cases/ai-server-control.md).

## Step 3 — add Claude

In **Customize → Connectors → + Add → Add custom connector**, enter the name and public MCP URL, review detected OAuth and connect. Organization setup may require an owner first. Enable it for the conversation. Check [Claude's current instructions](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) for account availability.

## Step 4 — add ChatGPT

In Plugins, choose **+ → Add custom MCP server**, enter the public HTTPS URL, configure OAuth and use **Create as a plugin**. Install it and @mention it in a new chat. Legacy Apps may use Create/Scan Tools. Check [OpenAI's instructions](https://help.openai.com/en/articles/12584461-connecting-custom-mcp-servers-in-chatgpt) for workspace permissions.

## Step 5 — approve the correct OAuth request

Verify the fresh pending ID and client shown in the browser. Run its displayed command on the Server serving that OAuth origin. Replace the placeholder below with the real ID:

```bash theme={null}
sudo drlink system credential approve-oauth <PENDING-ID> claude-lab
```

Bind ChatGPT's request to chatgpt-lab. A previously bound client may not need an identity argument. Return to the browser to finish. Reject an unwanted request with `system credential deny-oauth <PENDING-ID>`. If the request is not found, check the Server and expiry before retrying. Never paste tokens into chat.

## Step 6 — verify actual allowed and denied calls

Try this in each client and inspect its real tool name, target and result:

```text theme={null}
Use only DataRelay Link MCP to list_hosts I can access.
For the one host I select, show get_system_info.
Do not execute commands or change files.
```

With separately granted Server-self access, **get\_server** returns server:self. An empty Managed Host list does not imply Server-self is unavailable. Use the [read-only lab](https://link.datarelay.run/use-cases/ai-readonly.md) for a genuine command-exec denial, then inspect `show ai-access-log identity <IDENTITY>`.

## Missing tools and troubleshooting

DataRelay Link exposes **20 tools**. If server\_exec / server\_job\_poll / server\_job\_input / server\_job\_stop are missing, inspect the client's saved action snapshot. Supported workspace admin Actions Refresh can review/enable new tools. Personal apps may have no Refresh control; repeated OAuth approval will not refresh a frozen catalog. Where supported, scan a new test connection while retaining the working connection until verified.

For **401**, check authentication. For **AI Access DENY**, inspect identity, target, permission and paths. For OS permission errors, check the execution account. If a runtime function is unavailable, use `system diagnostics mcp` and the product update workflow. The AI client's own approvals and security controls still apply.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.