Connect ShareFile to ChatGPT: Search Files and Generate Reports

You want to connect ShareFile to ChatGPT so your AI agents can search enterprise files, run audit reports, and manage secure sharing at scale. If your team uses Claude, check out our guide on connecting ShareFile to Claude, or explore our broader architectural overview on connecting ShareFile to AI Agents.

Giving a Large Language Model (LLM) read and write access to an Enterprise File Sync and Share (EFSS) platform like ShareFile is an engineering challenge. You are not just dealing with simple folders and documents. You have to handle complex access control lists, cross-zone asynchronous operations, and strict data loss prevention (DLP) states.

You either spend weeks building, hosting, and maintaining a custom Model Context Protocol (MCP) server, or you use a managed infrastructure layer that handles the boilerplate for you. This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for ShareFile, connect it natively to ChatGPT, and execute complex compliance and reporting workflows using natural language.

The Engineering Reality of the ShareFile API

A custom MCP server is a self-hosted integration layer that translates an LLM's tool calls into REST API requests. While Anthropic's open standard provides a predictable way for models to discover tools, the reality of implementing it against vendor APIs is painful.

If you decide to build a custom MCP server for ShareFile, you are responsible for the entire API lifecycle. ShareFile's API introduces several unique architectural quirks that break standard CRUD assumptions.

The Zone and Async Operation Maze

ShareFile utilizes distinct StorageZones, separating data between on-premise servers and managed cloud storage. If your AI agent tries to copy or move a file from one zone to another, the API does not execute the request synchronously. Instead, it returns an AsyncOperation record. Your custom MCP server must implement polling logic to check the share_file_async_operations_get_batch_progress endpoint before confirming to the LLM that the file move succeeded. If you do not handle this state gracefully, the LLM will hallucinate that the file is available in the target zone before the transfer completes.

Hierarchies, Symbolic Links, and 302 Redirections

Traversing folder hierarchies in ShareFile is complex. When an LLM requests the contents of a folder, that folder might actually be a SymbolicLink pointing to an external provider (like SharePoint or a Network Drive). In these cases, the ShareFile API returns an HTTP 302 redirection. A naive MCP implementation will crash on 3xx responses. Your server must intercept these redirections, resolve the external protocol links, and normalize the data back into a format the LLM can understand.

StreamIDs vs Standard Identifiers

ShareFile maintains strict version control over documents. If an AI agent needs to analyze historical versions of a file, it cannot query the standard item ID. It must extract the file's StreamID and query the share_file_items_get_stream endpoint. Your tool descriptions must explicitly train the LLM on when to use an Id versus a StreamID, otherwise tool calls will fail with opaque 404 errors.

Rate Limits and 429 Errors

ShareFile strictly throttles heavy traffic, which is a major issue when an LLM tries to iterate over massive directory trees. It is critical to understand how Truto handles these rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream ShareFile API returns an HTTP 429 Too Many Requests, Truto passes that error directly to the caller.

However, Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (your AI agent or framework) is entirely responsible for reading these headers and implementing exponential backoff.

Creating the ShareFile MCP Server

Instead of building custom polling logic and maintaining YAML schemas, you can use Truto to dynamically generate a ShareFile MCP server. This server translates ShareFile's documented endpoints into a JSON-RPC 2.0 format that ChatGPT natively understands.

You can create this managed MCP server using either the Truto UI or the API.

Method 1: Via the Truto UI

1. Navigate to the integrated account page for your connected ShareFile instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (name, allowed methods, specific tags, and expiration limits).
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the API

You can programmatically generate MCP servers for your end-users. This is highly useful for B2B SaaS platforms provisioning temporary agentic access.

Make an authenticated POST request to /integrated-account/:id/mcp:

curl -X POST https://api.truto.one/integrated-account/<sharefile_account_id>/mcp \
  -H "Authorization: Bearer <YOUR_TRUTO_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ShareFile Compliance Agent",
    "config": {
      "methods": ["read", "write"]
    }
  }'

The response contains the secure URL you will feed into ChatGPT:

{
  "id": "abc-123",
  "name": "ShareFile Compliance Agent",
  "config": { "methods": ["read", "write"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

Connecting the MCP Server to ChatGPT

Once you have the secure URL, you can connect it to ChatGPT. You can do this through the ChatGPT interface or via a manual configuration file if you are running local agent loops.

Method A: Via the ChatGPT UI

1. In ChatGPT, navigate to Settings -> Apps -> Advanced settings.
2. Enable the Developer mode toggle (MCP support requires this flag).
3. Under MCP servers / Custom connectors, click to add a new server.
4. Enter a name (e.g., "ShareFile Truto MCP").
5. Paste the Truto MCP URL into the Server URL field.
6. Save the configuration. ChatGPT will immediately connect, handshake with the server, and discover the available ShareFile tools.

Method B: Via Manual Config File / Local CLI

If you are running local LLM clients or building custom agent loops, you can connect to the remote Truto server using the standard Server-Sent Events (SSE) bridge. Configure your local MCP setup (often represented in JSON config files for desktop clients) like this:

{
  "mcpServers": {
    "sharefile_prod": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Hero Tools for ShareFile Automation

Truto automatically generates tools based on the available ShareFile API endpoints. Here are the highest-leverage tools for automating reports and file discovery in ShareFile.

1. search_in_folder

Instead of recursively listing directories, this tool allows the LLM to execute an advanced search within a specific folder boundary, returning items matching name, description, or metadata queries.

"Search the 'Q3 Financials' folder (ID: fo-987) for any spreadsheets containing the word 'Audit'."

2. reports_run

This tool allows an AI agent to execute a pre-configured ShareFile report. It returns a run ID, which the agent can subsequently use to fetch the generated data.

"Trigger the 'Monthly Access Audit' report (ID: rep-456) and let me know when it starts."

3. reports_get_json_data

Once a report is running, the LLM uses this tool to extract the raw JSON-formatted results, allowing it to parse, summarize, and analyze the data without needing to download and OCR an Excel file.

"Fetch the JSON data for report run ID 'run-888' and summarize the list of users who downloaded files from the restricted folder."

4. access_controls_list_by_item

Security is paramount in EFSS platforms. This tool allows the LLM to inspect the exact effective access control list (ACL) for a specific file or folder, detailing exactly which Principals have View, Download, or Delete permissions.

"Check the access controls on the 'Merger Guidelines' document (ID: fi-112). Who has permission to download it?"

5. shares_send

This tool allows the agent to create a secure, trackable ShareFile email containing links to specific items. The LLM can configure expiration dates and determine if login is required.

"Create a secure Send Share containing the 'Q3 Audit Results' file. Send it to auditor@example.com, require them to log in, and set the link to expire in 7 days."

6. items_bulk_download

When an LLM needs to ingest multiple files at once, it can pass an array of file IDs to this tool. The tool returns a 302 redirect link to a consolidated ZIP archive.

"Generate a bulk download link for the five invoice files I just identified in the finance folder."

For a complete list of available operations, schemas, and required parameters, review the full inventory on the ShareFile integration page.

Workflows in Action

Connecting tools to an LLM is only useful if the agent can chain them together autonomously. Here is how ChatGPT executes real-world ShareFile workflows using the Truto MCP server.

Use Case 1: Automated Compliance Audits

Persona: IT Security Administrator

"Run the 'External Vendor Access' report. Once it finishes, fetch the data, identify any external contractors who downloaded files in the last 30 days, and list the specific file IDs."

sequenceDiagram
    participant User as User
    participant ChatGPT as ChatGPT
    participant Truto as Truto MCP
    participant ShareFile as ShareFile API

    User->>ChatGPT: "Run the External Vendor Access report..."
    ChatGPT->>Truto: Call share_file_reports_run(id: "rep-99")
    Truto->>ShareFile: POST /Reports(rep-99)/Run
    ShareFile-->>Truto: Return run_id "run-123"
    Truto-->>ChatGPT: run_id "run-123"
    ChatGPT->>Truto: Call share_file_reports_get_json_data(id: "run-123")
    Truto->>ShareFile: GET /ReportRecords(run-123)/JsonData
    ShareFile-->>Truto: Return JSON array of downloads
    Truto-->>ChatGPT: JSON audit data
    ChatGPT->>User: "Found 3 contractors. Here are the downloaded file IDs..."

What happens: The LLM triggers the report generation asynchronously. It then fetches the compiled JSON data, parses the payload in memory, filters the rows for users outside the corporate domain, and outputs a clean summary.

Use Case 2: Secure Document Distribution

Persona: Account Executive

"Search the 'Client Acme' folder for the final signed SLA document. Check the access controls to ensure it's not restricted, then securely email it to procurement@acmecorp.com with a 7-day expiration."

graph TD
    A["User Prompt"] --> B["share_file_items_search_in_folder<br>(query: 'signed SLA')"]
    B -->|"Extract File ID"| C["share_file_access_controls_list_by_item<br>(id: 'fi-777')"]
    C -->|"Verify no internal-only restrictions"| D["share_file_shares_send<br>(Items: ['fi-777'], Emails: ['procurement@acmecorp.com'])"]
    D --> E["Client receives trackable ShareFile email"]

What happens: The LLM searches the designated folder and identifies the correct file ID. It explicitly audits the ACL to ensure the document isn't flagged for internal use only. Finally, it formats the payload for the share_file_shares_send tool, dispatching a secure, expiring link to the external client.

Security and Access Control

Giving an LLM access to your enterprise file repository requires strict boundaries. Truto provides multiple layers of security at the MCP token level, ensuring your AI agents operate on a principle of least privilege.

• Method Filtering: You can restrict the MCP server to read-only operations by passing config: { methods: ["read"] } during creation. This ensures the LLM can search folders and run reports, but cannot delete files or alter access controls.
• Tag Filtering: You can group ShareFile operations by tags (e.g., "reports", "shares") and restrict the MCP token to only expose those specific subsets of tools.
• Required API Token Auth: By setting require_api_token_auth: true, possession of the MCP URL is no longer enough. The client must also pass a valid Truto API token in the Authorization header, preventing unauthorized access if the URL leaks.
• Ephemeral Servers: You can set an expires_at timestamp when generating the server. Once the timestamp passes, the distributed edge storage automatically evicts the token and an automated cleanup scheduler deletes the configuration, instantly revoking the LLM's access.

Strategic Wrap-up

Integrating ShareFile into your AI workflows unlocks massive operational efficiency, but building the plumbing to handle EFSS-specific quirks - like zone transfers, symbolic links, and async polling - drains engineering resources. By using Truto, you bypass the boilerplate. You can instantly provision secure, strictly scoped MCP servers that give ChatGPT native access to your ShareFile environment, allowing your team to focus on building intelligent agentic workflows instead of parsing complex rate limits.