# Build Production-Ready ChatGPT Apps

Building a ChatGPT App requires coordinated server, widget, security, testing, and submission work. This skill provides a phased workflow and reusable TypeScript templates.

## Install

```bash
npx skillstore add bayramannakov/chatgpt-app-builder
```

## Metadata

- Status: approved
- Slug: bayramannakov-chatgpt-app-builder
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: edb99a92ea35056cf5890550166be359782b5df96123c6b00b3513c07a429337
- Author: BayramAnnakov
- GitHub username: BayramAnnakov
- License: MIT
- Repository: https://github.com/BayramAnnakov/chatgpt-app-skill/tree/main/chatgpt-app-builder/
- Ref: 8c3e20bba512c392d9b02ee748b18e0b09d4982c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands, filesystem, env\_access, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/bayramannakov-chatgpt-app-builder
- Manifest: https://skillstore.pages.dev/api/skills/bayramannakov-chatgpt-app-builder/manifest

## Capabilities

- Evaluates product fit with the Know, Do, and Show framework.
- Creates app specifications with tools, widgets, authentication, and golden prompts.
- Provides a Node.js MCP server scaffold with validated tool inputs.
- Provides React widget patterns for state, actions, responsive layouts, and dark mode.
- Guides local testing with MCP Inspector, ngrok, and golden prompts.
- Covers OAuth planning, deployment configuration, and submission readiness.

## Use Cases

- Evaluate Product Fit: Assess whether a product offers useful knowledge, actions, or visual experiences inside ChatGPT.
- Build an MCP Application: Design tools and implement a TypeScript server with an interactive React widget.
- Prepare a Secure Release: Review authentication, testing, deployment, and submission requirements before public launch.

## Prompt Templates

### Evaluate a Product

```
Evaluate whether [product] should become a ChatGPT App. Assess Know, Do, and Show value, blockers, and three strong user prompts.
```

### Design the App Specification

```
Create an app specification for [product]. Define two to five tools, widget needs, authentication, data boundaries, and golden prompts.
```

### Implement the Application

```
Build the ChatGPT App from [specification]. Customize the MCP server and React widget, validate inputs, add tests, and document required configuration.
```

### Audit Production Readiness

```
Audit [project] for production. Verify OAuth, authorization, CORS, security headers, rate limits, idempotency, responsive widgets, deployment, and submission requirements.
```

## Limitations

- Templates contain placeholders and mock items that require product-specific implementation.
- The base server template does not enforce production authentication or restricted CORS.
- Local testing requires Node.js 18\+, npm, network access, and usually ngrok.
- The skill does not host, submit, or operate the finished application automatically.

## Best Practices

- Complete the fit evaluation and app specification before generating code.
- Validate every tool input and require authentication for user data or write operations.
- Test tools, widgets, discovery prompts, mobile layouts, and failure paths before submission.

## Anti Patterns

- Do not deploy the placeholder server without authentication and origin restrictions.
- Do not place sensitive records in model-visible content when widget metadata is sufficient.
- Do not expose broad tools with overlapping descriptions or unbounded inputs.

## Security Audit

- Audited at: 2026-07-23T10:46:43.931\+00:00
- Summary: All 400 static findings were adjudicated. The metadata address is blocked defensively, while other matches are documentation, template literals, configuration reads, or fixed asset paths. The deployable MCP template still needs authentication and restricted CORS before public use. Static review was capped at 400/457 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

## Stats

- Views: 282
- Downloads: 9
- Favorites: 0
- Popularity score: 0