ChatGPT developer mode, explained

Updated October 31, 2026

ChatGPT developer mode is the setting that lets ChatGPT use custom MCP servers with their full set of tools, including ones that change or delete data. OpenAI labels it "Elevated risk", and as of October 2026 its help center says Business and Enterprise/Edu users can add a custom MCP server from the Plugins page without switching developer mode on first.

So who still runs into it? Mostly two groups: people on personal plans whose custom server option sits behind the switch, and workspace admins deciding who gets it.

A third group is looking for the old "developer mode" jailbreak prompt. That was text people pasted into a chat in 2023, never a setting, and it switches nothing on.

Developer mode doesn't make ChatGPT smarter or less filtered. It's OpenAI asking you to accept, in writing, that a connected server can now write to your accounts.

What it actually changes

OpenAI introduced developer mode in September 2025, as a beta. Its developer docs at the time described it as full MCP client support for all tools, both read and write. Before that, custom connectors in ChatGPT were built around two read tools, search and fetch.

With it on (or on a plan where it isn't needed), you get:

• The option to add your own MCP server as a plugin.
• Every tool that server offers. OpenAI's guide says custom servers don't need search or fetch at all.
• Write actions, each behind a confirmation by default.
• The full JSON of every tool call, which you can expand to see exactly what was sent and what came back.

When a tool does something odd, that JSON is where you find out why.

Where the switch is in October 2026

It has moved more than once.

On a personal account, Simon Willison found it in July 2026 under Settings → Security and login, marked "Elevated risk" and described as allowing unverified connectors that could modify or erase data permanently. Earlier guides put it under Settings → Apps (or Connectors) → Advanced settings.

On Business, OpenAI's help center says only admins and owners can turn developer mode on and deploy an app, and an admin can't turn it on for individual members. On Enterprise and Edu, admins can use role-based access to give it to a chosen group. OpenAI's ChatGPT docs point admins to Workspace settings → Permissions & roles, where the permission to create plugins with MCPs is off by default.

Which personal plans have it is where the sources split. OpenAI's original docs listed Plus and Pro. Its help center has described Pro as limited to read and fetch tools. A September 2026 guide says personal plans are directory-only now, and one updated in October 2026 still lists Plus. What your own account shows at chatgpt.com/plugins is the answer that counts.

The risks OpenAI lists

OpenAI's MCP docs have a whole section on this, and it's more specific than "only connect servers you trust".

1. Prompt injection. Instructions hidden in a web page, an email or a support ticket can steer the model. OpenAI's examples include tricking ChatGPT into reading private data from one server and sending it out through another server's write action. Trusting the server's developer doesn't fix this, because the attack can come from any content the model reads.
2. Write actions. A write can be destructive, and OpenAI says a write can happen even when the server has tagged the tool read-only. That's why it asks for a confirmation before writes.
3. Malicious servers. A server can ask for more than it needs (OpenAI's example is a flight-booking tool requesting your income and home address) or log what you send it.
4. Data exposure. Even an honest server receives whatever ChatGPT passes it during a query, which can include things you told ChatGPT earlier in the conversation.

ChatGPT's main defence sits with you. Any tool the server hasn't marked with the MCP readOnlyHint annotation is treated as a write, and ChatGPT asks you to confirm each write. You can tell it to remember an approval for one tool for the rest of a conversation. A new conversation, or a refresh, asks again.

A confirmation you click on autopilot protects nothing. Read the parameters, especially on a write to anything public.

A worked example: two confirmations

Here's how a write plays out with a server that has its own checks. Kitepod (we make it) is a free remote MCP server for self-hosted WordPress, connected at https://kitepod.com/mcp with OAuth. Ask it:

ChatGPT shows the tool call and asks you to confirm it. That's the developer mode layer.

Then Kitepod adds a second one. Under its default approval policy, plugin updates wait for a person to approve them on Kitepod's approval page, signed in, so the model can't approve its own request. Once approved, Kitepod takes a checkpoint before each update so it can be rolled back.

ChatGPT's confirmation protects you from a tool call you didn't mean. It can't undo a call you did mean that went wrong. For that you need a server with its own way back, and the WordPress MCP page compares how the WordPress options handle it. The full ChatGPT setup for a site is on ChatGPT for WordPress.

Turning it on

If your account needs the switch:

1. In ChatGPT on the web, open Settings and look under Security and login (or Apps → Advanced settings on older layouts).
2. Turn on Developer mode and accept the warning.

Then add the server itself. The steps for the web and the desktop app are in how to add MCP to ChatGPT, and if you're building the server, start with the ChatGPT Apps SDK.

What goes wrong

The toggle isn't anywhere. Your plan doesn't include it, or your workspace admin hasn't allowed it. On Business, only an admin or owner can turn it on, and only for themselves.

It's on, but you still can't add a server. Workspace permissions and security restrictions, including OpenAI's Lockdown setting, still apply. Ask whoever manages the workspace.

Some of a server's tools are missing. Tools can be switched off one by one on the plugin's details page. Check none were.

Write confirmations feel constant. That's the design. If a tool genuinely can't change anything, ask the server's author to mark it read-only. Don't set "remember" on a tool you haven't watched work a few times.

Finer points

Is ChatGPT developer mode safe?

It's as safe as the servers you connect and the attention you give each confirmation. OpenAI calls it elevated risk because a write tool can change or delete real data, and because prompt injection can come from content you didn't write.

Does developer mode remove ChatGPT's content restrictions?

No. That idea comes from a 2023 prompt that only asked the model to pretend. The real setting is about connecting tools and changes nothing about ChatGPT's rules.

Is developer mode free?

It's a setting, not a product, so there's no separate charge. It's tied to paid plans, and custom MCP servers aren't available on Free as far as OpenAI's pages show in October 2026.

How do I turn developer mode off?

Flip the same switch back in Settings. Plugins you created stay listed at chatgpt.com/plugins, so remove any you no longer use from there too.

Does the ChatGPT desktop app need developer mode for local servers?

OpenAI's desktop docs describe adding a server under Settings → MCP servers and don't mention the developer mode switch. If the option is there, you can use it.

If you run a workspace, the decision that matters is who gets the permission to create plugins with MCPs, because every person you give it to becomes the one reading those confirmations.