MCP Events in ChatGPT: Why an event subscription is a credential

MCP Events is a draft Model Context Protocol extension that enables servers to notify clients such as ChatGPT when connected-app events occur, using stored subscriptions that include a user identity, event filters, webhook URL, signing secret, and expiration. Although OpenAI has announced support for webhook-based MCP Events, the underlying working group has not yet published the accepted specification intended to define subscription lifecycle management, and ChatGPT does not support several draft mechanisms for notifying clients that a subscription has ended. The central concern is that subscriptions can persist beyond the access token that created them, potentially indefinitely, while the draft requires servers to recheck permissions only “periodically” without specifying an interval. This leaves implementers responsible for choosing revocation windows, preventing continued delivery after a user loses access, and maintaining auditable records of active subscriptions. The text recommends finite, short-lived subscription TTLs, scheduled authorization revalidation, offboarding workflows that remove all subscriptions for departed users, and safeguards including callback verification, SSRF protections, minimal payloads, idempotent delivery handling, and fresh authorization for actions triggered by received events.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.