Why was my ChatGPT plugin rejected?

The reviewer couldn’t sign in or reach the server

This is the first thing reviewers hit, and the first reason on OpenAI’s own list. Check that:

• the MCP server is public, on HTTPS, and not limited to your office network or an IP allowlist;
• the test account works without multi-factor prompts, email or SMS codes, or magic links, and doesn’t expire during review;
• the account has sample data, so every test case has something to show;
• OAuth follows the MCP authorization spec with PKCE, and a server that needs sign-in isn’t declared as having none.

A test case didn’t give the expected result

The usual email says one or more test cases didn’t produce correct results, often without naming which. Run every prompt yourself, word for word, before you resubmit:

• on desktop and on mobile, since the plugin has to work on both;
• in light and dark themes, if your plugin shows a UI;
• with an expected result that describes what the user sees, not what the API returns.

If your plugin shows a UI, declare exactly the domains it loads from. Leftover development domains in the content security policy, or a screen that loads empty, are enough to fail a case.

A response returned data you didn’t disclose

Reviewers read what your tools send back. Trouble starts when a response carries more than the task needs:

• debug payloads, trace or request IDs, internal record IDs or timestamps the user doesn’t need;
• personal data that your privacy policy doesn’t mention;
• “just in case” fields, the full chat history or precise location.

Some data is off limits whatever the policy says: payment card numbers, health records, government IDs and credentials such as passwords, API keys or one-time codes. The privacy policy itself has to say what you collect, why, who receives it, how long you keep it and how users control it.

The tool annotations didn’t match the tools

Every tool needs three hints, each set to true or false. A missing or null value counts against you.

Expose each operation as its own tool. Servers that route everything through one generic “find action, take action” pair get flagged, even ones that were approved before.

The name or listing broke a rule

• The developer name must match your verified identity exactly. A small difference from the legal name is enough for a rejection.
• No generic one-word names, and don’t add “MCP”, “MCP Server” or “Plugin” to your brand.
• Descriptions describe. No comparisons with other products, no claims you can’t back up, no prices, trials or promotions.
• No steering. Tool names can’t say “best” or “official”, and nothing the model reads may push it toward your plugin or away from others.

Within those rules, the name and short description are still where search visibility comes from. Our guide on why plugins don’t show up in directory search shows how to use them, and the listing checker tests a draft against these rules.

The plugin doesn’t do enough, or sells the wrong things

• It has to add something ChatGPT can’t do alone. Demos, trials, copycats and plugins that exist mainly to advertise are turned down.
• Selling has limits. Physical goods only, with checkout on your own site. No subscriptions, credits or other digital goods, and no upgrade or upsell links.
• Some categories are closed: adult content, gambling, drugs, weapons, and moving money or crypto among them.
• It must suit teenagers. Content has to be fine for users aged 13 to 17, and the plugin can’t target children under 13.

What if the rejection gives no reason?

It happens: a near-empty email, a status that turns to Rejected without one, or a tool update held for “further review”. Before you resubmit:

1. Check spam for mail from OpenAI’s trust and safety or no-reply addresses.
2. Reply to the rejection email. That is how you appeal or ask what failed.
3. Re-read the plugin guidelines. They change, and a rule added while you waited can decide the outcome.
4. Run the four checks above: sign-in, test cases, response data and annotations.

How do I resubmit after a rejection?

Fix the problem, upload a corrected ZIP and submit again. A plugin can have one review at a time. If the fix is only on your MCP server, rescan it from the MCPs tab. You can appeal an automated tool finding from the dashboard too, though automatic MCP updates pause while it’s open.

Each resubmission waits in the same queue, so check everything at once rather than one fix per round. The full process is in how to submit a ChatGPT plugin, and current wait times are on how long approval takes.