Manage your Linux and Windows servers directly from ChatGPT. Run tasks and scans, search your fleet and act on cloud VMs, all through natural language in the ChatGPT interface.
The ManageLM ChatGPT plugin is an OpenAI GPT that connects ChatGPT to your infrastructure through the ManageLM portal API. It uses OAuth 2.0 for authentication. Each user signs in with their own ManageLM credentials and gets access to their own servers.
The GPT calls the same REST API used by the n8n and Slack plugins and covers the same features as the ManageLM MCP server, with each user's own permissions. No middleware or proxy is required.
Tell ChatGPT what you need in plain English. It picks the server, the skill and the instruction, and asks you when the agent needs input.
OAuth 2.0 login, each user signs in with their own ManageLM account and acts with their own permissions. No shared API keys.
Security audits, inventory, SSH keys and sudo rules, certificates and user activity, run on a server and read in the chat.
Inventory, security issues, logins, SSH access, certificates, monitors, backups, credentials, keystore and cloud resources, without running anything on the servers.
Start, stop, reboot or snapshot a VM through its hosting connector. ChatGPT asks for your confirmation every time.
Use the public GPT with ManageLM SaaS, or create your own GPT for self-hosted portals.
The GPT uses OpenAI Actions (an OpenAPI spec) to call the ManageLM portal REST API directly. Each user authenticates via OAuth 2.0 and gets their own bearer token. The GPT never stores credentials.
GPT Actions allow 30 operations, and the spec covers the ManageLM MCP tools in 29. Two lists stay out: the skill catalog, which is too large for an action response, and the sites list.
| Area | Operations |
|---|---|
| Servers & account | searchAgents, getAgent, getAgentSkills, getAccount, listGroups |
| Search | searchInventory, searchSecurity, searchActivity, searchSshKeys, searchSudoRules, searchCertificates, searchPki, searchMonitors, searchBackups, searchCredentials, searchKeystore |
| Hosting | listConnectors, searchCloud, getConnectorActions, runConnectorAction |
| Tasks | submitTask, listTasks, getTask, answerTask, followUpTask, getTaskChanges, revertTask |
| Scans | startScan, getScan (security, inventory, sshkeys, certscan, activity) |
ChatGPT stops waiting for an action after 45 seconds, so a task waits 35 seconds. A longer task returns its ID, and the GPT checks it with getTask. Tasks and scans run on one server at a time. Approving servers, users, skills, groups, API keys and webhooks are managed in the portal.
If you use ManageLM at app.managelm.com, the public GPT is ready to use:
Open the ManageLM GPT in ChatGPT (requires ChatGPT Plus, Team, or Enterprise)
Click Sign in to ManageLM when prompted
Log in with your ManageLM email and password
Start managing your servers, try "Show me all my servers"
Tip: The GPT works in the ChatGPT web interface at chatgpt.com. The macOS desktop app does not fully support OAuth redirects.
If you run ManageLM on your own server, you can create a private GPT that connects to your portal. The source files are on GitHub.
OAUTH_APP_CLIENT_ID and OAUTH_APP_CLIENT_SECRET set in your portal .envOn your portal server, generate credentials and add them to your .env:
node -e "const c=require('crypto');
console.log('OAUTH_APP_CLIENT_ID=mlm_oc_'+c.randomBytes(8).toString('hex'));
console.log('OAUTH_APP_CLIENT_SECRET=mlm_os_'+c.randomBytes(32).toString('hex'))"
Add the output to your portal .env file and restart the portal.
Go to chatgpt.com/gpts/editor and click Create a GPT
In the Configure tab, set:
instructions.md from the repoUnder Actions, click Create new action:
OAUTH_APP_CLIENT_ID valueOAUTH_APP_CLIENT_SECRET valuehttps://your-portal.example.com/oauth/authorizehttps://your-portal.example.com/oauth/tokenIn the Schema box, paste the contents of openapi.yaml from the repo. Before pasting, change the server URL:
servers: - url: https://your-portal.example.com/api
Click Save (private or share with your team via link)
Note: The OAuth app credentials (OAUTH_APP_CLIENT_ID / OAUTH_APP_CLIENT_SECRET) identify the GPT application. They do not grant access by themselves. Each user must still sign in with their own ManageLM account.
> Show me all my servers > What's the disk usage on web-prod-1? > Install nginx on staging-web-02 > Run a security audit on db-primary > Which servers have CPU usage above 80%? > List running services on lb-01 > Show the last 50 lines of /var/log/syslog on monitoring-1 > Who logged in to db-primary yesterday? > Which certificates expire this month?
The GPT submits tasks using skills. Each skill defines what the agent can do on the server. The GPT reads the skills assigned to a server with getAgentSkills, or passes auto to let the agent choose. Common skills:
| Skill | Use for |
|---|---|
base | Read files, search content, check disk usage, system info (read-only) |
system | OS info, performance tuning, hostname, timezone, kernel parameters |
packages | Install, remove, update, search packages |
services | Manage systemd services, cron jobs, view logs, process control |
users | Manage user accounts, groups, SSH keys, sudo |
network | Interfaces, routes, DNS, ports, connectivity testing |
security | Security hardening, fail2ban, SSH config, SELinux, SSL/TLS |
Additional skills (firewall, containers, web servers, databases, certificates and more) can be imported from the skill catalog in the portal.
| Feature | ChatGPT GPT | Claude Extension |
|---|---|---|
| Task execution | Yes (via API Actions) | Yes (via MCP) |
| File upload/download | No | Yes |
| Streaming output | No (request/response) | Yes (SSE) |
| Dynamic tool discovery | No (static spec, 29 operations) | Yes (per-user skills) |
| Long tasks | Waits 35 s, then checks back | Waits for the result |
| Multi-agent targeting | One at a time | Hostname, group, or "all" |
| Desktop app | Web only | Desktop + CLI |
This happens when OpenAI has cached OAuth state from a previous GPT configuration. Delete the GPT entirely at chatgpt.com/gpts/mine and create a new one from scratch.
The OAUTH_APP_CLIENT_ID in your portal .env doesn't match the Client ID in the GPT editor, or the portal hasn't been restarted after adding the env var.
Check that the Authorization URL and Token URL in the GPT editor point to the correct portal. For self-hosted, these must match your portal's public URL exactly.
OpenAI caches OAuth tokens. To force re-authentication, go to ChatGPT Settings > Connected apps and disconnect ManageLM. If that option isn't available, delete and recreate the GPT.
If you set an MCP / API Key IP Whitelist (per user, in Settings > MCP & API), calls from ChatGPT come from OpenAI's servers and are refused with 403. Add OpenAI's egress IP ranges to the whitelist, or leave it empty.
ChatGPT stops waiting for an action after 45 seconds, so a long task (a package upgrade, a large search on the server) returns its ID. Ask the GPT to check the task again, and it reads the result with getTask.
The ChatGPT macOS desktop app doesn't fully support OAuth redirects. Use chatgpt.com in your browser instead.