Overview
This help article will show you how to utilize iTwin IoT's MCP server with OpenAI.
Setting up the MCP Server for ChatGPT Web App
Official Connector
This is on the way. Stay tuned for a guide.
Custom Connector
1. On the ChatGPT web app, open Settings > Security and login > Developer mode and toggle on Developer mode
2. Navigate to Plugins and click the + symbol
3. Select Create app, then click on Create MCP App
4. Type a representative name such as iTwin IoT, and use the MCP server address https://itwiniotai-mcp.bentley.com/mcp
5. Click Advanced OAuth settings and select the registration method: User-Defined OAuth Client and fill in the OAuth
Client ID, using the naming convention itwiniot-chatgpt-{org/user}. Each organization or user must request its own Bentley Systems' IMS client ID because ChatGPT supplies a connector-specific redirect URI (Callback URL in the screen below). Copy the Callback URL and the Client ID used, and send them to us to enable your access. Make sure the checkbox next to "I understand and want to continue" is checked, then click Create. You won't be able to authenticate and use the MCP server at this stage.
6. Provide Bentley Systems' IMS with the Client ID (such as itwiniot-chatgpt-{org/user}) and the exact redirect URI ChatGPT supplies. Once IMS registers your client ID and the provided redirect URI, you will be able to authenticate and use the MCP server.
Using the MCP Server in OpenAI
Once you have set up the MCP server, you can use OpenAI to utilize the MCP server functionalities.
Data handling and privacy
- What we collect. When Claude calls a tool, the connector logs the authenticated user identifier (your IMS
subclaim), the tool name, the duration of the call, and the outcome (success/error code). We do not log the contents of conversation messages or the raw parameter values you pass to tools. The data is kept for only 30 days and is used solely for monitoring, troubleshooting, and abuse prevention. - What we forward. Each tool call is authorised with your IMS access token. The iTwin IoT backend independently re-validates the token and enforces RBAC on every call; the connector cannot return data that your account is not entitled to.
- Storage. Audit logs are stored in Bentley's Azure tenant under the same governance as iTwin IoT itself.
- Third-party sharing. None beyond the iTwin IoT backend that you already use.
- Retention. Audit logs follow the default Bentley operational retention for monitoring data.
- Full privacy policy: see Bentley's global data privacy notice at https://www.bentley.com/legal/privacy-policy/.
Limits and quotas
To protect the iTwin IoT backend, the connector applies per-user sliding-window rate limits:
- 100 tool calls / 60 seconds per user (read-mostly tools).
- 30 tool calls / 60 seconds per user for destructive tools (
delete_*,cancel_*, mutating ML-job operations).
When you hit the limit, the connector returns a structured rate_limited error and the agent will wait and retry, or surface the limit to you to decide.