ChatGPT App Connector
Updated 2 months ago
.
ChatGPT App Connector
Gratona exposes a read-only agent connector for authenticated Gratona admins. ChatGPT, Codex, and other MCP clients can use it to search and summarize donor, recipient, sponsorship, donation, dashboard, note, activity, saved-view, and report data that the connected admin is already allowed to view.
Use the production MCP endpoint for public ChatGPT and Codex connections:
https://api.helpyousponsor.com/mcpUse staging or a short-lived HTTPS tunnel for private developer-mode tests:
https://api-staging.helpyousponsor.com/mcpWhat admins can ask
Useful prompts include:
Find a donor by name or email and summarize their profile, giving, sponsorships, notes, and recent activity.
Summarize donations for the last 90 days and fetch one donation record.
Show sponsorship health for a program and fetch one sponsored recipient.
List saved donor views, donation views, reports, and scheduled reports that can help staff plan follow-up work.
Show notes and activity for a specific donor or recipient.
Explain what the connected admin can access in the current Gratona workspace.
When a prompt does not include enough information for a record-specific lookup, the assistant should ask a short follow-up question instead of guessing.
Available read-only tools
The current connector exposes read-only MCP tools including donor lookup, donor list/search/get, recipient/entity list/get, donation list/get/summary, sponsorship summary, notes list, activity-log list, saved filters/listed views, reports list, dashboard snapshot, dashboard brief, forms list, programs list, system context, standard connector-style search, and record fetch.
Create, update, delete, and archive tools are hidden by default. Mutation tools should only be enabled after explicit scopes, idempotency keys, audit metadata, confirmation UX, and production tests are complete.
Authentication and permissions
Production ChatGPT connections should authenticate with OAuth account linking. Private developer-mode smoke tests may use a scoped Gratona API key or bearer token, but production API keys must not be placed in query strings.
Gratona enforces access in layers:
Authentication resolves the admin, API key or OAuth token, scopes, and Gratona workspace.
The primitive registry filters discovery and invocation by primitive scope.
Each primitive applies Gratona group permission sets such as donor forms, program access, reports, notes, activity logs, and dashboard permissions.
Record queries always use the server-derived workspace boundary.
Admins can receive donor PII, custom fields, notes, activity, reports, and saved views when their Gratona permissions allow them. The connector does not redact permitted admin data at the app layer; it avoids exposing secrets, request tokens, API keys, payment processor identifiers, trace IDs, and unrelated internal diagnostics.
MCP discovery endpoints
Endpoint | Purpose |
|---|
Every unauthenticated MCP request returns an OAuth bearer challenge with the protected-resource metadata URL so compatible clients can discover the auth configuration.