ChatGPT and Claude App Approval: How the Review Works

Last updated: July 2026

Getting an app into ChatGPT or Claude is not a config file you flip on. Both OpenAI and Anthropic now run public submission pipelines, and both put a human review in front of the directory. You build an app on the Model Context Protocol (MCP), you submit it, a reviewer checks it against a policy, and only then can users discover and connect it. The bar, the process, and the timelines differ between the two platforms. Here is what each one actually looks like.

If you want the discovery side of this, how apps get recommended once they are approved, see ChatGPT app directory optimization. This piece is about clearing review in the first place.

The ChatGPT (OpenAI) approval process

OpenAI opened third-party app submissions in December 2025, after previewing apps in ChatGPT at DevDay in October 2025. You build with the Apps SDK, which is built on MCP and still in beta, test in ChatGPT’s Developer Mode, then submit through the OpenAI Developer Platform, where you also track approval status.

A ChatGPT submission has to include:

• MCP connectivity details. The endpoint and how ChatGPT connects to your server.
• Testing guidelines. Instructions and examples so a reviewer can exercise your app.
• Directory metadata. The name and descriptions that appear in the listing.
• Country and locale availability. Where the app is allowed to run.
• A clear privacy policy, and a commitment to request only the minimum data the app needs to function.

The review itself is a manual, mobile-app-store-style process: build, submit, wait, iterate on feedback. OpenAI has been explicit about the policy bar, apps must comply with its usage policies, be appropriate for all audiences, respect third-party terms of service, and disclose data sharing, but deliberately vague about ranking and featuring criteria beyond “strong guardrails” and demonstrated quality. OpenAI has not published a formal review SLA; early developers report an initial pass on the order of one to two weeks, with back-and-forth for revisions. Treat that as an estimate, not a guarantee. The official reference is OpenAI’s app developer guidelines.

Two constraints matter for planning. First, geography: apps launched to logged-in users outside the EEA, Switzerland, and the UK, with EU availability gated on regulatory work. Second, monetization: in this phase you monetize by linking out to your own site or app, with in-chat checkout (the Agentic Commerce Protocol) still rolling out. For most companies today, the ChatGPT app is a top-of-funnel and conversion surface, not a payment rail.

The Claude (Anthropic) approval process

Anthropic curates a directory too, now the Anthropic Software Directory (it grew out of the Connectors Directory), and listing there is the credential: acceptance is what “verified by Anthropic” means for a third-party connector. You submit a remote MCP server through Anthropic’s review form (linked from the Software Directory Policy), a human reviews it, and once approved it appears at claude.com/connectors for one-click connection across Claude web, Desktop, mobile, Code, and the API.

Anthropic’s requirements are more explicitly technical than OpenAI’s. Before submitting, your server needs:

• Tool annotations on every tool, specifically readOnlyHint or destructiveHint plus title, so Claude knows what each tool does before it calls it.
• OAuth 2.0 with certificates from recognized authorities, if the app requires authentication.
• HTTPS and the Streamable HTTP transport (SSE is being deprecated), reachable from Anthropic’s IP ranges.
• A published, accessible privacy policy. A missing or incomplete one is among the fastest rejections.
• Comprehensive documentation, verified contact information, and dedicated support channels.
• A test account with sample data and at least three working example prompts that demonstrate core functionality.
• Proof you own or control any endpoint or domain the server connects to, and a production-ready (GA) server.
• Tool names under 64 characters, token-frugal responses, and graceful error handling.

There is no published SLA; Anthropic reviews manually and says complete submissions with no missing requirements move through faster. One thing to be clear about: Anthropic reviews connectors against its listing criteria but does not security-audit your server, and it runs ongoing reviews, an app that becomes unstable, unresponsive, or falls out of compliance can be removed after it is listed. Staying in the directory is a maintenance commitment, not a one-time gate.

Side by side

What is the same, and why that helps

Both platforms build on MCP, and that is the practical shortcut. The core of your submission, an MCP server, its tools, their descriptions, the documentation, a privacy policy, and a set of example prompts, is largely the same package for both. Clear tool definitions, a live privacy policy, and a working test account are what carry a submission through in either place. Once you have built and hardened that package for one directory, submitting to the other is mostly repackaging to a different form and a different bar, not rebuilding. For the deeper mechanics of how the tools themselves get read and called, see how ChatGPT uses MCP tools and what MCP is.

Where regulated products get stuck

For most apps, approval is an engineering and documentation exercise. For insurance, banking, and health, it is where the compliance work starts. The privacy-policy and data-minimization requirements are table stakes; the harder questions are jurisdictional. ChatGPT’s app surface launched outside the EU, so a European carrier cannot simply submit and go live in its home market. Licensing, advice boundaries, and record-keeping do not disappear because the channel is an assistant; they move inside your app, and both reviews expect you to have answered them. We covered that live tension in the AI insurance distribution compliance grey zone.

This is the part that is hard to bolt on after the fact, and it is a large share of what makes getting, and staying, listed non-trivial for regulated companies. The reviews are gates you pass once; compliance is a state you have to keep. For the wider context on why this channel is worth the effort, start with what AI distribution actually is.

FAQ

How long does ChatGPT app approval take?
OpenAI has not published a formal SLA. Early developers report an initial review on the order of one to two weeks, with additional rounds for revisions. Plan for iteration rather than a single verdict, and expect the timeline to move as the process matures.

How long does Claude connector approval take?
Anthropic does not publish a review SLA and cannot guarantee individual responses due to volume. Submissions that meet every requirement, tool annotations, OAuth, a live privacy policy, a working test account, move through faster than incomplete ones.

What gets an app rejected fastest?
On both platforms, a missing or incomplete privacy policy. On Claude specifically, missing tool annotations (readOnlyHint / destructiveHint / title) and no working test account. On ChatGPT, policy violations and metadata that misrepresents what the app does.

Do I need a separate app for ChatGPT and Claude?
No. Both are built on MCP, so one server can serve both. You submit the same core package to two different review processes, each with its own form and its own bar, rather than building two apps.

Does Anthropic or OpenAI security-audit my server?
No. Anthropic states plainly that it reviews connectors against listing criteria but does not security-audit or manage MCP servers. OpenAI reviews against its usage and safety policies. Securing your own backend and endpoints is your responsibility on both.

Can my app be removed after it is approved?
Yes. Anthropic runs ongoing reviews and can delist servers that become unstable, unresponsive, or non-compliant with updated policies. OpenAI requires continued policy compliance. Approval is a gate you pass and then have to keep passing.

Is the app available in the EU?
ChatGPT’s app surface launched to users outside the EEA, Switzerland, and the UK, with EU availability gated on regulatory work. Claude connector availability follows Anthropic’s supported-countries policy. For regulated products, treat geography as a first-order planning constraint, not a detail.