lionbank-wealth

A ChatGPT app (MCP server) that answers market and wealth-management questions using only the insights published by HSBC Private Banking at privatebanking.hsbc.com. Once connected to ChatGPT in Developer mode, users enable lionbank-wealth from the composer's tools menu and ask a question directly in chat.

How it works

The server exposes a single MCP tool, lionbank_wealth_insight(query). It makes one call to OpenAI's Responses API with the built-in web_search tool, restricted via filters.allowed_domains to privatebanking.hsbc.com. The model searches that site, then answers the user's question from what it finds, citing the specific page(s) used. If nothing relevant exists on the site, it says so instead of falling back on outside knowledge.

Built with FastMCP (Python) and served over the MCP Streamable HTTP transport, which is what lets it run as a normal HTTP container on Cloud Run.

Related MCP server: hidrix-tools

Project layout

Configuration

Run locally

pip install -r requirements.txt
OPENAI_API_KEY=sk-your-key python server.py

The server listens on http://0.0.0.0:8080/mcp.

Test locally

Quick structural check (no OpenAI call):

fastmcp inspect server.py

Call the tool against a running server:

fastmcp call http://127.0.0.1:8080/mcp lionbank_wealth_insight query="What is HSBC's outlook on gold?"

Interactive browser UI:

fastmcp dev inspector server.py

Test the real ChatGPT connection flow before deploying, tunnel the local server with a public HTTPS URL:

ngrok http 8080

then use the printed https://....ngrok-free.app/mcp URL as the MCP server URL when adding the connection in ChatGPT (see below).

Deploy to Cloud Run

gcloud config set project YOUR_PROJECT_ID
gcloud services enable run.googleapis.com cloudbuild.googleapis.com secretmanager.googleapis.com

# store the OpenAI key as a secret rather than a plain env var
printf '%s' 'sk-...' | gcloud secrets create openai-api-key --data-file=-

gcloud run deploy lionbank-wealth \
  --source . \
  --region us-central1 \
  --allow-unauthenticated \
  --set-secrets=OPENAI_API_KEY=openai-api-key:latest \
  --set-env-vars=OPENAI_MODEL=gpt-5.6-luna \
  --min-instances=0 \
  --max-instances=2

• --allow-unauthenticated is required — ChatGPT calls this endpoint directly and this server doesn't implement OAuth, so Cloud Run's IAM auth would block it.

• --min-instances=0 means the service scales to zero when idle (no cost while unused), at the cost of a cold start on the first request after idling.

• --max-instances=2 caps how far it can scale under load, which also caps worst-case cost since there's no auth to stop someone from hammering the endpoint (see Known limitations).

• The MCP endpoint is the printed Cloud Run service URL + /mcp.

Verify the deployment:

curl -s https://YOUR-SERVICE-URL/mcp -X POST \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

Connect it in ChatGPT

1. Settings → Security and login → turn on Developer mode. (Availability depends on account/workspace policy.)

2. Go to chatgpt.com/plugins and select the + button to add a server.

3. Enter a user-facing name (lionbank-wealth) and description.

4. Under Connection, choose the public-endpoint option and enter the MCP server URL, including the /mcp path: https://YOUR-SERVICE-URL/mcp.

5. Select Create the connection — ChatGPT connects and lists the tools it discovered (lionbank_wealth_insight). No authentication step is needed since this server doesn't require any.

6. Start a new conversation, open the composer's tools menu, enable the lionbank-wealth connection, and ask your question.

If ChatGPT can't connect, verify the public HTTPS endpoint with MCP Inspector first (see Test locally) before retrying step 5.

This makes the app usable from your own ChatGPT account only (Developer mode). Making it installable/discoverable for other users requires packaging it as a plugin and submitting it through OpenAI's review process separately.

Known limitations

• No auth on the endpoint — anyone with the URL can call it and consume your OpenAI quota. --max-instances=2 caps concurrent scale, but set a usage budget/alert on the OpenAI project too — it's the real backstop on cost.

• web_search calls have their own OpenAI API cost, separate from model tokens.