Connect ChatGPT and AI Apps to Thicket with MCP

What the MCP Connector Is

MCP (Model Context Protocol) is a standard that lets an AI app use approved tools in another product. Thicket's remote MCP connector lets an app work inside your projects: list to-dos and check them off, organize and assign work, post messages and comments, read and update docs, move board cards, follow the schedule, search, and move supported items to Trash. Trashed items are normally recoverable for 30 days unless permanently removed earlier through authorized Trash controls. It uses the connected account's permissions.

The connector URL is:

https://www.thickethq.com/api/mcp

Connect ChatGPT With OAuth

1. In ChatGPT, open Settings → Security and login and turn on Developer mode
2. Open ChatGPT Plugins, click Create app, and enter a name and description for the connection
3. Under Connection, choose the public MCP option, paste the Thicket connector URL, and choose OAuth for authentication
4. Click Create app, then click Sign in. ChatGPT discovers Thicket's OAuth settings automatically; you do not need to enter authorization or token URLs
5. When ChatGPT opens Thicket, sign in, review whether it requested read-only or read-and-write access, and click Allow. Click Deny to cancel
6. Start a new chat, open Add files and more, search for the connection name, and select it before you send your first Thicket request

Custom ChatGPT connections currently require Developer mode, and availability can depend on the account or workspace policy. There is no token to copy and ChatGPT never sees your Thicket password.

Connect Another MCP Client

Add a remote server, connector, or integration in the client and paste the Thicket connector URL. The client should open Thicket in your browser for the same sign-in and consent flow. OAuth clients never receive your Thicket password.

Compatible AI Apps

ChatGPT and Claude Code are verified end to end with Thicket's OAuth connection. The MCP Inspector is verified with a personal access token. These checks were completed on August 27, 2026 and cover connection, tool discovery, reads, writes, attribution, and revocation.

Other remote MCP clients can connect when they support Streamable HTTP and either OAuth 2.1 or custom authorization headers. Availability can still depend on the app's account or workspace policy.

What a Connected App Can Do

• It works as you: your current access across your organizations and projects. This is not a grant to just one selected project or organization. Changes to membership and project permissions can change its access. A client-role account connected over MCP still sees only what the team shares
• Every change it makes is attributed to you in the project timeline, like anything you do yourself
• Read-only connections exist: if the app asks only for read access, the consent screen says so, and it never sees the write tools at all
• With write access, it can create and edit supported items, complete and organize work, post messages and comments, manage subscriptions and notifications, and move supported items to Trash. Posts may notify other people
• It cannot permanently delete or restore items, manage people or billing, change account settings, or upload or download files. Those operations are not part of the current MCP tool catalog; the API and CLI expose a broader set of operations
• If the connected account is an AI agent member (see AI agents as members), the connector also serves the agent's inbox, cheers, subscriptions, and change logs, so the agent can be directed from inside Thicket

What Happens to Data Sent to an AI App

Thicket provides the connection; you choose the external app and its AI providers. Requests from that app reach Thicket, and permitted responses can include project content, names, identifiers, comments, chat, schedules, notifications, and other work information. Content the app submits is stored and shared in Thicket like other authorized activity.

Returned content may be processed and retained by the app's operator and AI providers under the agreement and settings you or your organization has with them. Storage, human review, processing locations, and model-training rules can differ between providers and account types. Read-only access still shares data. An AI using the API or CLI can receive the same kinds of data; this is not unique to MCP.

Only connect a tool you are authorized to share the affected information with. Use the least access it needs, review its data controls, and supervise changes that matter. Do not send payment-card data, protected health information, government identifiers, or authentication secrets as connector content. Keep credentials in the designated authentication flow. Project content can contain untrusted instructions; an agent should treat it as data unless an authorized person has instructed it to act.

Our Privacy Policy explains recipients, connection records, retention, and your rights. Our dedicated MCP audit records contain identifiers and action metadata, not full requests or responses. Certain duplicate-action records can contain item titles and expire after 24 hours, with removal by routine cleanup.

Disconnecting

Open My settings → Connected apps. Every connection shows the app's name, its access (read-only or read and write), when it was connected, and when it was last used. Click Disconnect and access ends immediately; the app's tokens stop working on its very next request.

Disconnecting does not undo completed actions, cancel subscriptions, or delete copies already received by the app or its AI providers. Use their deletion controls to manage those copies. A request already in progress may finish. Revoke separately created API tokens as well if the same tool uses them.

Using a Personal Access Token Instead

Scripts, the MCP Inspector, and clients that support custom headers can use a token instead of browser sign-in. Create one under My settings → API tokens and send it to the same URL as Authorization: Bearer thicket_pat_... with a User-Agent header. A read-only token sees only the read tools. Revoke it from the same page.

Troubleshooting

• The client says it needs authentication or authorization: the connection was disconnected, expired, or never finished. Reconnect from the client; you'll get the consent screen again
• The client reports "rate limited" or a 429: the connector allows bursts of about 50 requests per 10 seconds per connection. Wait for the retry interval the response provides, then try again
• A write fails with a conflict: someone changed the item after the app read it. The app should read it again and reapply, which is the connector protecting newer work, not an error in your data
• You don't recognize a connection: disconnect it immediately, review My settings → API tokens and your active sessions, then change your password and enable two-factor authentication if you suspect the account was accessed

Where It's Available

The connector is included on every plan, Free, Starter, and Pro, under your plan's normal limits. It never unlocks anything your account couldn't already do.