# ChatGPT App MCP tool calls blocked by OpenAI safety checks before reaching MCP server **URL:** \ **Category:** ChatGPT Apps SDK\ **Tags:** chatgpt, bug, api, apps-sdk\ **Created:** [July 8, 2026, 3:31pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059 "2026-07-08T15:31:52Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![malteCondor](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@malteCondor](https://community.openai.com/u/malteCondor)\ **Post date:** [July 8, 2026, 3:31pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/1 "2026-07-08T15:31:52Z")
Hi OpenAI team, we are seeing a read-only ChatGPT App MCP tool call being blocked by OpenAI safety checks before it reaches our MCP server. The tool output is: **This tool call was blocked by OpenAI’s safety checks. Please double check what you are sending.** The trace shows: ```json { "externalCallTimeMs": null, "responseMetadata": null, "state": null } ``` Because `externalCallTimeMs` is `null` and we see no corresponding server logs, this appears to be blocked before the MCP request is sent. **Example tool call** ```json { "originIds": ["FRA", "DUS"], "destinationIds": ["IBZ", "PMI"], "departureMonths": ["2026-07-01", "2026-08-01"], "journeyType": "ONE_WAY", "passengers": { "adults": 1, "adolescents": 0, "children": 0, "infants": 0 }, "localeId": "en_US" } ``` This is a benign read-only flight search. We also tested equivalent payloads using `destinationRegionId` and alias fields like `originAirports`, `destinationAirports`, and `travelMonths`; all were blocked in the same way. **What we checked** - MCP endpoint authentication works. - The server can be reached and tool definitions load. - Direct calls through another MCP/client path work. - The backend returns valid flight offer data for these routes/months. - The tool does not create, update, delete, book, send, or mutate anything. - Tool metadata is aligned with Apps SDK guidance: - `readOnlyHint: true` - `destructiveHint: false` - `openWorldHint: false` - `_meta.securitySchemes: [{ "type": "noauth" }]` - widget resources use `text/html;profile=mcp-app` **Question** Could you help identify why this read-only MCP tool call is being blocked before reaching the MCP server? Is there a way to get more specific diagnostics for the safety-block reason, or is this possibly a false positive? ---
**Author:** ![moorecj](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/moorecj/32/752627_2.png) [@moorecj](https://community.openai.com/u/moorecj)\ **Post date:** [July 8, 2026, 3:35pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/2 "2026-07-08T15:35:53Z")
Bumping this for visibility. I am seeing this as well. Many benign queries are being blocked in my app as well. All of which were previously working fine. ---
**Author:** ![KernelDebug](https://avatars.discourse-cdn.com/v4/letter/k/278dde/32.png) [@KernelDebug](https://community.openai.com/u/KernelDebug)\ **Post date:** [July 8, 2026, 3:53pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/3 "2026-07-08T15:53:49Z")
Getting the same issue, was working fine yesterday ---
**Author:** ![plparadis](https://avatars.discourse-cdn.com/v4/letter/p/58f4c7/32.png) [@plparadis](https://community.openai.com/u/plparadis)\ **Post date:** [July 8, 2026, 5:53pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/4 "2026-07-08T17:53:01Z")
same issue here and it was working fine previously ---
**Author:** ![tom\_rivers](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@tom\_rivers](https://community.openai.com/u/tom_rivers)\ **Post date:** [July 8, 2026, 6:05pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/5 "2026-07-08T18:05:41Z")
I have also seen this fail since sometime yesterday. Absolutely benign calls are getting blocked. For example, I send this to my personal MCP server for GItea to retrieve a file: `{` `"repo": "mcp-diagnostic-harness",` `"path": "pyproject.toml",` `"ref": "main"` `}` This is the reply I get: “This tool call was blocked by OpenAI’s safety checks. Please double check what you are sending.” Additionally, I am seeing “Error in message stream” messages appear in the middle of the model replying lately as well. Tom ---
**Author:** ![Kavy](https://avatars.discourse-cdn.com/v4/letter/k/ee59a6/32.png) [@Kavy](https://community.openai.com/u/Kavy)\ **Post date:** [July 8, 2026, 6:33pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/6 "2026-07-08T18:33:54Z")
Seeing the same issue as well! ---
**Author:** ![euge](https://avatars.discourse-cdn.com/v4/letter/e/7993a0/32.png) [@euge](https://community.openai.com/u/euge)\ **Post date:** [July 8, 2026, 7:21pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/7 "2026-07-08T19:21:27Z")
I get the same issue, which started 2 days go. I’ve tried extensive testing in the past 2 days, tried with the browser and the desktop. It is not an issue with platform - I’ve tried with a .Net api and a node.js api. Tools that do not require parameters execute successfully. But Tools that accept one or more parameters are inconsistently blocked by ChatGPT. Once a block occurs in a window, that window is effectively poisoned. The request doesn’t even hit the mcp endpoint server. It’s clearly the Chatgpt client blocking the send request. ---
**Author:** ![Changju\_Na](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/changju_na/32/718412_2.png) [@Changju\_Na](https://community.openai.com/u/Changju_Na)\ **Post date:** [July 9, 2026, 12:35am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/9 "2026-07-09T00:35:03Z")
I’m facing the same issue. ---
**Author:** ![Cyberwizard\_Producti](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/cyberwizard_producti/32/732718_2.png) [@Cyberwizard\_Producti](https://community.openai.com/u/Cyberwizard_Producti)\ **Post date:** [July 9, 2026, 1:56am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/10 "2026-07-09T01:56:29Z")
i am seeing this as well, and I’ve got both claude code and GPT working on this - what we’re finding is that files getting the block error, when retried, pass and don’t return the error ---
**Author:** ![Cyberwizard\_Producti](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/cyberwizard_producti/32/732718_2.png) [@Cyberwizard\_Producti](https://community.openai.com/u/Cyberwizard_Producti)\ **Post date:** [July 9, 2026, 2:23am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/11 "2026-07-09T02:23:42Z")
I’m seeing intermittent MCP tool-call failures in ChatGPT where benign filesystem-style connector calls are blocked by OpenAI before they reach my MCP server. The error shown in ChatGPT is: ```auto ``` ```auto This tool call was blocked by OpenAI's safety checks. Please double check what you are sending. ``` When this happens, the MCP server receives no request and logs nothing. So the failure appears to happen in ChatGPT/OpenAI’s pre-dispatch safety layer, not in my server code. The connector is a root-only virtual filesystem connector with tools similar to: ```auto ``` ```auto list_dir read_file read_text_range write_file move_path trash_path delete_path search fetch ``` The schema is clean and small. The root connector exposes only those tools. The same connector successfully handles normal read/write/list operations. ### Repro-style observations A benign read-only call such as: ```auto ``` ```auto { "tool": "read_file", "arguments": { "path": "/STARTUP_FILE.md" } } ``` sometimes fails with the OpenAI safety-check message before reaching the server. The same exact call can later succeed unchanged. In one test sequence, the pattern looked like this: ```auto ``` ```auto read_file("/STARTUP_FILE.md") -> blocked by OpenAI safety checks read_file("/STARTUP_FILE.md") -> blocked by OpenAI safety checks read_text_range("/STARTUP_FILE.md") -> blocked by OpenAI safety checks read_file("/safe/startup.md") -> succeeds read_file("/STARTUP_FILE.md") -> succeeds read_file("/STARTUP_FILE.md") -> succeeds read_file("/STARTUP_FILE.md") -> blocked again read_file("/STARTUP_FILE.md") -> blocked again read_file("/safe/startup.md") -> succeeds ``` The two files had the same benign content. Only the virtual path/filename differed. In a later timed test, the same suspicious-looking path did not reproduce the block: ```auto ``` ```auto read_file("/STARTUP_FILE.md") -> succeeds wait ~10 sec read_file("/STARTUP_FILE.md") -> succeeds wait ~30 sec read_file("/STARTUP_FILE.md") -> succeeds wait ~60 sec read_file("/STARTUP_FILE.md") -> succeeds wait ~60 sec read_file("/STARTUP_FILE.md") -> succeeds read_text_range("/STARTUP_FILE.md", 1, 12) -> succeeds fetch("/STARTUP_FILE.md") -> succeeds list_dir("/") -> succeeds search("STARTUP_FILE.md") -> succeeds ``` This suggests the block is not deterministic by tool name, path, filename, or content alone. ### Things I checked The server-side connector returns structured error buckets for real server errors, such as: ```auto ``` ```auto filesystem/path error permission/convention refusal response/size limit connector/server error ``` But the OpenAI safety-check failure does not return any connector bucket, and there is no server log entry. That strongly suggests the request is blocked before dispatch. I also tested path/filename variants. These did not by themselves reproduce the block: ```auto ``` ```auto /lowercase.md /UPPERCASE.md /two_words.md /two-words.md /wake.md /gpt.md /wake_gpt.md /wake-gpt.md /WAKE_GPT.md ``` So caps and underscores alone do not appear to be the trigger. ### Current hypothesis This looks like a transient ChatGPT/OpenAI-side preflight false positive, possibly involving some warm/cold state or temporary trust/cache behavior. A suspicious-looking parameterized filesystem call may block when “cold,” then equivalent or repeated calls may pass after a benign connector call succeeds. Later, after some unknown state change or timeout, the same call may block again. ### Current workaround Operational workaround for now: ```auto ``` ```auto 1. If a call gets the OpenAI safety-check block, do not immediately treat the MCP server as broken. 2. Wait a few seconds. 3. Retry once. 4. If it still blocks, retry with a narrower or plainer call shape: - avoid bare root "/" if a named subdirectory will do - use specific virtual paths - avoid broad scans/searches unless necessary - prefer bounded reads for larger files - use a less instruction-looking filename/path where possible 5. Check server logs: if there is no request, it was likely blocked before MCP dispatch. ``` It would help if ChatGPT surfaced whether the block happened pre-dispatch and exposed a stable error code/category separate from connector/server errors. ---
**Author:** ![jxd01](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@jxd01](https://community.openai.com/u/jxd01)\ **Post date:** [July 9, 2026, 7:10am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/12 "2026-07-09T07:10:39Z")
I was receiving the same issue yesterday, however my requests seem to be going through now (touch wood). Whilst not ideal, I found it helps listing all your tools as non-destructive. ---
**Author:** ![achieving100ms](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/achieving100ms/32/697107_2.png) [@achieving100ms](https://community.openai.com/u/achieving100ms)\ **Post date:** [July 9, 2026, 11:05am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/13 "2026-07-09T11:05:37Z")
Same here. on an app that is in production for a few months now, a simple read operation is not working. The model can discover them, but can’t call some of the tools ```auto At the moment, though, the runtime is still only surfacing the tool schemas rather than allowing me to execute those Glinded tool calls. I can inspect their signatures, but I can't actually invoke ``` No matter how many times I try, it won’t work. BUT, if I do retry the ask with a thinking model (GPT 5.5 Thinking Mini) it solves it and it works. ---
**Author:** ![AldiPower](https://avatars.discourse-cdn.com/v4/letter/a/bbce88/32.png) [@AldiPower](https://community.openai.com/u/AldiPower)\ **Post date:** [July 10, 2026, 8:47am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/14 "2026-07-10T08:47:32Z")
Same here! App in production for some months. Getting a lot of user complaints currently! This is a large scale regression (at least for us). @OpenAI_Support Please investigate ASAP. ---
**Author:** ![abhishek15](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/abhishek15/32/512906_2.png) [@abhishek15](https://community.openai.com/u/abhishek15)\ **Post date:** [July 10, 2026, 11:20am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/15 "2026-07-10T11:20:28Z")
Same here, this seems unnecessary given we ourselves have given the permission to run certain tools without filters. Please at the very least keep this safety filtering optional as it otherwise hampers our existing workflows. ---
**Author:** ![casey-chow](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/casey-chow/32/742396_2.png) [@casey-chow](https://community.openai.com/u/casey-chow)\ **Post date:** [July 10, 2026, 12:59pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/16 "2026-07-10T12:59:26Z")
Hey all, we’re aware of the issues and are working to tune things. ---
**Author:** ![AldiPower](https://avatars.discourse-cdn.com/v4/letter/a/bbce88/32.png) [@AldiPower](https://community.openai.com/u/AldiPower)\ **Post date:** [July 10, 2026, 1:10pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/17 "2026-07-10T13:10:31Z")
Thank you. One best practice though, as ChatGPT Apps getting more traction. We need a status dashboard for things like this. The forum and normal “support” channel isn’t enough for large scale ChatGPT apps. Simply not professional. I understand that it is pretty new, but for the future, there has to be more trust and thrust. 🙂 ---
**Author:** ![Chris\_Godden](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/chris_godden/32/512525_2.png) [@Chris\_Godden](https://community.openai.com/u/Chris_Godden)\ **Post date:** [July 15, 2026, 8:51am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/18 "2026-07-15T08:51:16Z")
@OpenAI_Support Any update on this issue please? ---
**Author:** ![Sam\_Bateman](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/sam_bateman/32/511558_2.png) [@Sam\_Bateman](https://community.openai.com/u/Sam_Bateman)\ **Post date:** [July 15, 2026, 8:53am UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/19 "2026-07-15T08:53:29Z")
Has there been any movement on getting this resolved? ---
**Author:** ![abhishek15](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/abhishek15/32/512906_2.png) [@abhishek15](https://community.openai.com/u/abhishek15)\ **Post date:** [July 20, 2026, 1:22pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/20 "2026-07-20T13:22:45Z")
Unfortunately, this is still happening. Please make it an opt in feature. ---
**Author:** ![tom\_rivers](https://avatars.discourse-cdn.com/v4/letter/t/e274bd/32.png) [@tom\_rivers](https://community.openai.com/u/tom_rivers)\ **Post date:** [July 20, 2026, 4:25pm UTC](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059/21 "2026-07-20T16:25:05Z")
I have found the following change makes a lot of these safety platform issues go away. Go to Workspace settings → Apps, Click on the ellipsis and select Manage App. For me, the Configure actions was already enabled for everything but switching to Allow all actions in Configure approvals was the trick. I still have issues every so often but this change produced non-trivial results for me - YMMV. NOTE: I only use MCP servers I programmed myself so I am comfortable with this. I personally would not recommend doing this with a third-party tool. ![image](https://us1.discourse-cdn.com/openai1/original/4X/2/a/d/2ad1bc426d4f1570cc5734c83b7252a1d107646e.png) [Next page](https://community.openai.com/t/chatgpt-app-mcp-tool-calls-blocked-by-openai-safety-checks-before-reaching-mcp-server/1386059.md?page=2)