Connect OpenAI Agents with MCP and Integrations

Model Context Protocol connects agents to external tools and data through a common protocol. OpenAI agents can use hosted remote MCP tools or SDK-managed local/private servers. MCP standardizes discovery and calls; it does not establish trust. Your harness must approve servers, filter tools, scope credentials, validate results, and audit actions.

What will you be able to do?

You will choose an MCP connection model, connect a local learning server, and write a trust checklist for production integrations.

Hosted or runtime-managed?

Mode	Connection owner	Prefer when
Hosted MCP tool	provider/model surface	approved public remote server fits data policy
SDK-managed stdio/HTTP	your runtime	private/local server needs network and approval control

Exact transports and options evolve; use the current OpenAI integration guide when implementing.

How do you connect a local server?

This official-pattern example gives a learning agent read access to a fixture directory:

python

import asyncio

from agents import Agent, Runner
from agents.mcp import MCPServerStdio


async def main() -> None:
    async with MCPServerStdio(
        name="Fixture filesystem",
        params={
            "command": "npx",
            "args": [
                "-y",
                "@modelcontextprotocol/server-filesystem",
                "./fixtures",
            ],
        },
    ) as server:
        agent = Agent(
            name="Fixture reader",
            instructions="Read only fixture files and summarize their contents.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List the fixture files.")
        print(result.final_output)


if __name__ == "__main__":
    asyncio.run(main())

Use a disposable fixtures directory. Do not point a learning filesystem server at your home folder or repository root.

What is the MCP trust checklist?

Who publishes and updates the server?
Which exact tools and schemas are exposed?
What credentials and network paths can it access?
Which tools are read-only, mutating, destructive, or open-world?
Can tool output contain untrusted instructions or secrets?
Which calls require approval?
How are timeouts, size limits, redaction, and audit events enforced?
How is the package/image/version pinned, scanned, and rolled back?

Treat a changed MCP server version like changed application code.

How do you prove the integration is safe?

Test discovery allowlists, denied tools, invalid arguments, oversized output, server timeout, process crash, malicious tool results, credential isolation, and shutdown cleanup. Confirm a compromised server cannot access unrelated tenant credentials.

Failure injection: Return a tool result asking the agent to call another destructive tool. The result is data, not authority; policy must independently evaluate the next proposal.

What mistakes should you avoid?

Connecting an arbitrary remote server because it speaks MCP.
Exposing every discovered tool automatically.
Passing broad environment credentials to stdio children.
Assuming read-only annotations enforce security.
Forgetting to close local server processes.

Check your understanding

What does MCP standardize, and what does it not guarantee?
When should your runtime own the connection?
Why must tool results be treated as untrusted?

Expert extension

Design an MCP gateway that pins server identity/version, filters tool schemas, injects request-scoped credentials, enforces output limits, and emits normalized audit events.

Official references

Connect OpenAI Agents with MCP and Integrations

Mode

Connection owner

Prefer when

Hosted MCP tool

provider/model surface

approved public remote server fits data policy

SDK-managed stdio/HTTP

your runtime

private/local server needs network and approval control

How do you connect a local server?

This official-pattern example gives a learning agent read access to a fixture directory:

python

import asyncio

from agents import Agent, Runner
from agents.mcp import MCPServerStdio


async def main() -> None:
    async with MCPServerStdio(
        name="Fixture filesystem",
        params={
            "command": "npx",
            "args": [
                "-y",
                "@modelcontextprotocol/server-filesystem",
                "./fixtures",
            ],
        },
    ) as server:
        agent = Agent(
            name="Fixture reader",
            instructions="Read only fixture files and summarize their contents.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List the fixture files.")
        print(result.final_output)


if __name__ == "__main__":
    asyncio.run(main())

Use a disposable fixtures directory. Do not point a learning filesystem server at your home folder or repository root.

What is the MCP trust checklist?

Who publishes and updates the server?

Which exact tools and schemas are exposed?

What credentials and network paths can it access?

Which tools are read-only, mutating, destructive, or open-world?

Can tool output contain untrusted instructions or secrets?

Which calls require approval?

How are timeouts, size limits, redaction, and audit events enforced?

How is the package/image/version pinned, scanned, and rolled back?

Treat a changed MCP server version like changed application code.

How do you prove the integration is safe?

Failure injection: Return a tool result asking the agent to call another destructive tool. The result is data, not authority; policy must independently evaluate the next proposal.