Remote Development
MCP Server

Server Status

Available Capabilities

Development Workflow

Installation Layout

Source:     /var/www/mcp/
Production: /var/www/mcp/production/
Service:    mcp.service
Domain:     mcp.ai.msheriff.com
Config:     /var/www/mcp/production/config/config.yaml
Secrets:    /etc/mcp/mcp.env

Connect to ChatGPT

Current OpenAI guidance uses a custom MCP app in ChatGPT Web. Full read/write MCP is available in developer mode for Business and Enterprise/Edu workspaces; Pro availability can be limited to read/search. UI and plan availability can change.

1. Have a workspace admin enable custom MCP development in Workspace Settings → Permissions & Roles → Connected Data → Developer mode / Create custom MCP connectors.
2. Enable it for your account at Settings → Apps → Advanced Settings → Developer mode when that control is present.
3. As an admin/owner use Workspace Settings → Apps → Create; authorized users can use Settings → Apps → Create.
4. Name it Remote Development MCP and enter https://mcp.ai.msheriff.com/mcp.
5. Select the offered bearer/access-token authentication option and supply the token obtained by the administrator with sudo /var/www/mcp/scripts/mcp-token get. Never put the token in the URL. If your ChatGPT tenant offers only OAuth or no-auth, static bearer entry is not supported in that UI; use an MCP-compatible client that supports bearer headers or add an OAuth 2.1 authorization layer before connecting ChatGPT.
6. Choose Scan Tools, verify the tool list, then Create. The app appears with a Dev label under Settings → Apps → Enabled Apps.
7. Enable the required write actions in app action controls. Keep delete_file, git_push and deploy approval-gated.
8. Open a new chat, select the draft app from the tools menu (or mention it), and test with the prompts below.

List the workspaces available through my development MCP server.

Search the <workspace> repository for LoginForm and show me the relevant files.

Show git status and current diff. Do not modify anything.

Run the project's tests and summarize any failures.

OpenAI's Responses API is another supported client path. Supply this server URL as server_url and pass the bearer value in the MCP tool's authorization field. Do not embed it in source code.

Operations Cheat Sheet

Service and logs

systemctl status mcp
systemctl restart mcp
systemctl stop mcp
systemctl start mcp
systemctl is-enabled mcp

journalctl -u mcp -f
journalctl -u mcp --since today
journalctl -u mcp -n 200 --no-pager

Rebuild and deploy

cd /var/www/mcp
go test ./...
make downloads
cd dist && sha256sum -c SHA256SUMS && cd ..
sudo /var/www/mcp/scripts/deploy.sh
cat /var/www/mcp/production/VERSION

The deployment script tests, builds all six downloadable binaries and their checksums, builds and validates the native service binary, atomically installs the release, restarts systemd, checks service state, and checks HTTPS health.

NGINX and HTTPS

nginx -t
systemctl reload nginx
systemctl status nginx
journalctl -u nginx --since today
curl https://mcp.ai.msheriff.com/health
curl -I http://mcp.ai.msheriff.com/

MCP connectivity

sudo /var/www/mcp/scripts/check-mcp.sh

# A request without Authorization must return HTTP 401:
curl -i https://mcp.ai.msheriff.com/mcp \
  -H 'Content-Type: application/json' \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Token management

sudo /var/www/mcp/scripts/mcp-token get
sudo /var/www/mcp/scripts/mcp-token rotate

Rotation immediately restarts mcp.service. Update every client afterward. The token is stored only in /etc/mcp/mcp.env with mode 0600; it is never shown here.

Add, disable, and configure a workspace

sudoedit /var/www/mcp/production/config/config.yaml

# Add under workspaces:
- name: myrepo
  path: /var/www/myrepo
  enabled: true
  read_only: false
  protected_paths: [production, .secrets]
  build:
    command: ["make", "build"]
    timeout: 300
  test:
    command: ["make", "test"]
    timeout: 300
  deploy:
    command: ["./deploy.sh"]
    timeout: 600
  run_commands:
    lint:
      command: ["make", "lint"]
      timeout: 180

# Disable without deleting configuration:
enabled: false

sudo systemctl restart mcp
sudo journalctl -u mcp -n 50 --no-pager

Grant the mcp service account only the repository permissions it needs. If a new workspace lives outside /var/www/mcp, also add its path to ReadWritePaths= in /etc/systemd/system/mcp.service, run systemctl daemon-reload, and restart.

Troubleshooting

401 Unauthorized

Retrieve the current token, update the client’s bearer credential, and ensure the header is exactly Authorization: Bearer <TOKEN>. A token rotation invalidates the old value immediately. Tokens never belong in URLs.

502 Bad Gateway

systemctl status mcp
journalctl -u mcp -n 100 --no-pager
curl http://127.0.0.1:8095/health
nginx -t

A failed localhost health call means systemd/service trouble; a successful localhost call with an HTTPS 502 points to NGINX upstream configuration.

Command timeout

The response marks timed_out and returns bounded stdout/stderr. Raise the configured operation timeout deliberately, not globally, then restart the service.

NGINX

nginx -T | sed -n '/server_name mcp.ai.msheriff.com/,/}/p'
tail -n 100 /var/log/nginx/error.log
certbot certificates

systemd

systemctl cat mcp
systemctl show mcp -p User -p Group -p EnvironmentFiles
systemctl reset-failed mcp
systemctl restart mcp

Never enable arbitrary shell execution, force push, hard reset, branch deletion, or history rewriting. Git push and deployment remain separate explicit tools.