TopolearnMCP lets you reuse ready-made tool servers, but they act on your behalf, so control and approval matter.
MCP (Model Context Protocol) is an open standard for packaging tools as a server that any AI app can use. Many services publish MCP servers for their products. The Responses API can connect to a remote MCP server (one reachable over the internet) and let the model call its tools, without you writing glue code.
Add a tool entry with type: "mcp", a server_label (your name for it), a server_url, and optionally a server_description. Two settings control risk:
allowed_tools: a list of tool names the model may use. Expose only what the task needs.require_approval:"always","never", or an object listing tools that skip approval.
With approval on, the first response contains mcp_approval_request items (tool name and arguments) instead of results. Your app shows them to a person or checks them in code, then sends a follow-up request with previous_response_id and an mcp_approval_response item per request (approve: true or false).
Servers that need a login take an OAuth token in authorization. It is not stored, so send it on every request. Older "connectors" that used connector_id are being phased out for newer models.
Security first: only connect servers you trust. A malicious or compromised server can read anything that enters the model's context and send it elsewhere. Keep approvals on for anything that writes, sends or spends.
Example
from openai import OpenAI
client = OpenAI()
MCP = {
"type": "mcp",
"server_label": "openai_docs",
"server_url": "https://developers.openai.com/mcp",
"require_approval": "always",
}
first = client.responses.create(model="gpt-6-astra", tools=[MCP],
input="Find the docs page about streaming responses.")
requests = [i for i in first.output if i.type == "mcp_approval_request"]
for req in requests:
print("wants to call", req.name, req.arguments) # review here
final = client.responses.create(
model="gpt-6-astra", tools=[MCP], previous_response_id=first.id,
input=[{"type": "mcp_approval_response", "approval_request_id": r.id,
"approve": True} for r in requests],
)
print(final.output_text)Remember
- MCP tool entry: type mcp + server_label + server_url
- Limit with allowed_tools; gate with require_approval
- Approve via mcp_approval_response; connect only trusted servers
Watch out for
- Setting require_approval to never on a server that can send email or modify data.