# This sends the private CRM data as a query parameter to the attacker's site (evilcorp.net), resulting in exfiltration of sensitive information.
```

The private CRM record can now be exfiltrated to the attacker's site via the
query parameters in search or other MCP servers.

### Connecting to trusted servers

We recommend that you do not connect to a custom MCP server unless you know and
trust the underlying application.

For example, always pick official servers hosted by the service providers
themselves (e.g., connect to the Stripe server hosted by Stripe themselves on
mcp.stripe.com, instead of an unofficial Stripe MCP server hosted by a third
party). Because there aren't many official MCP servers today, you may be tempted
to use a MCP server hosted by an organization that doesn't operate that server
and simply proxies requests to that service via an API. This is not
recommendedâand you should only connect to an MCP once youâve carefully reviewed
how they use your data and have verified that you can trust the server. When
building and connecting to your own MCP server, double check that it's the
correct server. Be very careful with which data you provide in response to
requests to your MCP server, and with how you treat the data sent to you as part
of OpenAI calling your MCP server.

Your remote MCP server permits others to connect OpenAI to your services and
allows OpenAI to access, send and receive data, and take action in these
services. Avoid putting any sensitive information in the JSON for your tools,
and avoid storing any sensitive information from ChatGPT users accessing your
remote MCP server.

As someone building an MCP server, don't put anything malicious in your tool
definitions.

At this time, we only support search and document retrieval.