OpenAI Plugin
DebugBundle plugin for ChatGPT and Codex, combining a production-debugging skill with a read-only remote MCP connection.
DebugBundle OpenAI Plugin 1.0.0 is a production candidate for ChatGPT and Codex. Its production OAuth-protected MCP endpoint is active at the permanent origin https://mcp.debugbundle.com, and it has passed a connected Developer Mode smoke test. It is not submitted, approved, published, or publicly installable yet.
The existing @debugbundle/mcp stdio package remains a separate, fully compatible product surface. The OpenAI candidate does not replace local CLI authentication, member tokens, OpenClaw, installed projects, or existing APIs.
What v1 can do
The remote projection exposes exactly twenty-three read-only tools:
| Area | Tools |
|---|---|
| Projects | list_projects, list_services |
| Incidents | list_incidents, get_incident, get_incident_context |
| Existing artifacts | get_bundle, get_reproduction |
| Runtime improvements | list_improvements, get_improvement, get_improvement_bundle |
| Aggregate analytics | get_usage_summary, get_route_metrics, get_journey_patterns, get_device_breakdown, get_referrer_metrics, get_action_metrics, list_funnel_metrics, get_funnel_analysis, get_incident_impact |
| Endpoint health | list_health_checks, get_health_check, list_health_check_results, list_health_check_daily_rollups |
Every tool is annotated readOnlyHint: true, openWorldHint: false, and destructiveHint: false. Unknown input fields are rejected. Hosted readers return only already-stored evidence and never regenerate artifacts, enqueue work, or mutate customer state.
get_incident_context requires both incident-read and artifact-read scope. It returns bounded structured context without raw logs. Health-check URLs remove user information, query strings, fragments, and secret-like path material before output.
Authentication and consent
The remote connection uses DebugBundle OAuth/OIDC with PKCE S256. A linked grant is limited to these scopes:
openidemaildebugbundle:projects:readdebugbundle:incidents:readdebugbundle:artifacts:readdebugbundle:improvements:readdebugbundle:analytics:readdebugbundle:health:read
The email identity claim is obtained only from verified UserInfo and supports account/workspace policy; it is not included in access tokens, tool results, or operational logs. A user must explicitly consent before the remote connection receives a grant and can later revoke it in DebugBundle.
The consent interface is implemented with the DebugBundle design system. It shows the verified identity purpose, all requested product scopes, the data-transfer categories, and the read-only boundary. A user may remove any product scope before allowing access and may later revoke the connection in Settings. Outside-network reviewer validation and OpenAI submission remain separate manual gates.
Data and privacy boundaries
The candidate may return authorized project/service metadata, incident lifecycle metadata, existing redacted bundles and reproductions, stored runtime-improvement evidence, bounded aggregate product analytics, sanitized endpoint-health configuration, bounded health results, and navigation/control metadata.
It excludes raw logs, individual analytics journeys and sample IDs, raw analytics events, custom dimensions, credentials, request authorization data, object-storage keys or signed URLs, database-only IDs, internal hashes, local files, and mutation controls. Customer-provided strings remain untrusted evidence and are never instructions to execute commands, make network requests, or change state.
OAuth provider artifacts are encrypted at rest and physically deleted after their bounded expiry windows. Used authorization codes are retained for replay detection for at most 24 hours; used or revoked refresh-token families for at most 30 days; and expired or revoked grants for at most 90 days. Active grants remain until expiry, revocation, account suspension/deletion, or loss of required membership.
See the security documentation, privacy policy, and terms for the broader hosted-service model.
Candidate and release gates
Repository validation proves package structure, schemas, deterministic artifacts, tests, and source/runtime composition. Separate live evidence records the production deployment, Developer Mode registration, owner OAuth connection, MCP authentication challenge, selected client cases, and rollback rehearsal. None of that proves OpenAI review, publication, or directory discovery.
Before submission, the exact production endpoint must pass MCP Inspector, authentication, tenant-isolation, load/capacity, rollback, privacy, reviewer, and retained evaluation checks. Submission, Cancel Review, publication, directory edits, launch communication, and new recurring spend always require separate owner approval and manual action.