Skip to content

Commit 8eb9b1f

Browse files
Merge branch 'main' into patch-1
2 parents b005121 + 0c51a6f commit 8eb9b1f

285 files changed

Lines changed: 8513 additions & 35323 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.changeset/bright-crabs-search.md

Lines changed: 0 additions & 5 deletions
This file was deleted.

.changeset/browser-mcp-crawl-depth-min.md

Lines changed: 0 additions & 5 deletions
This file was deleted.

.changeset/browser-mcp-quick-action-parity.md

Lines changed: 0 additions & 5 deletions
This file was deleted.

.github/ISSUE_TEMPLATE/bug_report.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ assignees: ''
1010
**Client Information**
1111
- LLM Client: [e.g. Claude Desktop, claude.ai, Cursor, VSCode]
1212
- Client Config: [e.g. claude_desktop_config.json or screenshot of client configuration UI]
13-
- Using MCP Remote?: Yes/No
1413
- MCP Server: [e.g. https://observability.mcp.cloudflare.com, https://docs.mcp.cloudflare.com]
1514
- Prompt: [if applicable, add the prompt used]
1615

.syncpackrc.cjs

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,17 @@ const config = {
44
indent: '\t',
55
lintFormatting: false, // handled by prettier
66
versionGroups: [
7+
{
8+
label: 'use the workspace catalog for the MCP migration stack',
9+
dependencies: [
10+
'@cloudflare/workers-oauth-provider',
11+
'@modelcontextprotocol/client',
12+
'@modelcontextprotocol/sdk',
13+
'@modelcontextprotocol/server',
14+
'agents',
15+
],
16+
pinVersion: 'catalog:',
17+
},
718
{
819
label: 'local packages',
920
packages: ['**'],
@@ -53,6 +64,17 @@ const config = {
5364
},
5465
],
5566
semverGroups: [
67+
{
68+
label: 'workspace catalogs resolve exact versions in pnpm-workspace.yaml',
69+
dependencies: [
70+
'@cloudflare/workers-oauth-provider',
71+
'@modelcontextprotocol/client',
72+
'@modelcontextprotocol/sdk',
73+
'@modelcontextprotocol/server',
74+
'agents',
75+
],
76+
isIgnored: true,
77+
},
5678
{
5779
label: 'pin all deps',
5880
range: '',

README.md

Lines changed: 10 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -4,25 +4,28 @@ Model Context Protocol (MCP) is a [new, standardized protocol](https://modelcont
44

55
These MCP servers allow your [MCP Client](https://modelcontextprotocol.io/clients) to read configurations from your account, process information, make suggestions based on data, and even make those suggested changes for you. All of these actions can happen across Cloudflare's many services including application development, security and performance.
66

7-
They support both the `streamable-http` transport via `/mcp` and the `sse` transport (deprecated) via `/sse`.
7+
Every server exposes the same stateless Streamable HTTP handler at `/mcp` and `/sse` through a fresh SDK v2 server factory. `/sse` remains as a URL compatibility alias; it does not use the deprecated HTTP+SSE transport. A legacy SSE `GET /sse` request receives a `410 Gone` Problem Details response with two migration options: configure the existing URL to use Streamable HTTP, or switch to the recommended `/mcp` URL for future compatibility. Modern 2026 requests and stateless 2025 requests share the same request-scoped implementation without an MCP protocol session. OAuth, credentials, account selection, application caches, and product Durable Objects remain application/security state where required.
88

99
The following servers are included in this repository:
1010

1111
| Server Name | Description | Server URL |
1212
| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ---------------------------------------------- |
13-
| [**Documentation server**](/apps/docs-vectorize) | Get up to date reference information on Cloudflare | `https://docs.mcp.cloudflare.com/mcp` |
13+
| [**Documentation server**](/apps/docs-ai-search) | Get up-to-date reference information on Cloudflare | `https://docs.mcp.cloudflare.com/mcp` |
1414
| [**Workers Bindings server**](/apps/workers-bindings) | Build Workers applications with storage, AI, and compute primitives | `https://bindings.mcp.cloudflare.com/mcp` |
1515
| [**Workers Builds server**](/apps/workers-builds) | Get insights and manage your Cloudflare Workers Builds | `https://builds.mcp.cloudflare.com/mcp` |
1616
| [**Observability server**](/apps/workers-observability) | Debug and get insight into your application's logs and analytics | `https://observability.mcp.cloudflare.com/mcp` |
1717
| [**Container server**](/apps/sandbox-container) | Spin up a sandbox development environment | `https://containers.mcp.cloudflare.com/mcp` |
1818
| [**Browser Run server**](/apps/browser-rendering) | Fetch web pages, convert them to markdown and take screenshots | `https://browser.mcp.cloudflare.com/mcp` |
1919
| [**Logpush server**](/apps/logpush) | Get quick summaries for Logpush job health | `https://logs.mcp.cloudflare.com/mcp` |
2020
| [**AI Gateway server**](/apps/ai-gateway) | Search your logs, get details about the prompts and responses | `https://ai-gateway.mcp.cloudflare.com/mcp` |
21+
| [**AutoRAG server**](/apps/autorag) | Search and query account AutoRAG instances | `https://autorag.mcp.cloudflare.com/mcp` |
2122
| [**Audit Logs server**](/apps/auditlogs) | Query audit logs and generate reports for review | `https://auditlogs.mcp.cloudflare.com/mcp` |
22-
| [**DNS Analytics server**](/apps/dns-analytics) | Optimize DNS performance and debug issues based on current set up | `https://dns-analytics.mcp.cloudflare.com/mcp` |
23+
| [**DNS Analytics server**](/apps/dns-analytics) | Optimize DNS performance and debug issues based on current setup | `https://dns-analytics.mcp.cloudflare.com/mcp` |
2324
| [**Digital Experience Monitoring server**](/apps/dex-analysis) | Get quick insight on critical applications for your organization | `https://dex.mcp.cloudflare.com/mcp` |
2425
| [**Cloudflare One CASB server**](/apps/cloudflare-one-casb) | Quickly identify any security misconfigurations for SaaS applications to safeguard users & data | `https://casb.mcp.cloudflare.com/mcp` |
25-
| [**GraphQL server**](/apps/graphql/) | Get analytics data using Cloudflare’s GraphQL API | `https://graphql.mcp.cloudflare.com/mcp` |
26+
| [**Radar server**](/apps/radar) | Explore Cloudflare Radar internet insights | `https://radar.mcp.cloudflare.com/mcp` |
27+
| [**Cloudflare Blog server**](/apps/cloudflare-blog) | Search and read posts from the Cloudflare Blog | `https://blog.mcp.cloudflare.com/mcp` |
28+
| [**Demo Day server**](/apps/demo-day) | Demonstrate a minimal Cloudflare MCP server | `https://demo-day.mcp.cloudflare.com/mcp` |
2629

2730
## Which Cloudflare MCP server should you use?
2831

@@ -49,26 +52,9 @@ Use the **domain-specific servers** in this repository when:
4952

5053
Learn more about the Code Mode server here: [`cloudflare/mcp`](https://github.com/cloudflare/mcp).
5154

52-
## Access the remote MCP server from any MCP client
53-
54-
If your MCP client has first class support for remote MCP servers, the client will provide a way to accept the server URL directly within its interface (e.g. [Cloudflare AI Playground](https://playground.ai.cloudflare.com/))
55-
56-
If your client does not yet support remote MCP servers, you will need to set up its respective configuration file using mcp-remote (https://www.npmjs.com/package/mcp-remote) to specify which servers your client can access.
57-
58-
```json
59-
{
60-
"mcpServers": {
61-
"cloudflare-observability": {
62-
"command": "npx",
63-
"args": ["mcp-remote", "https://observability.mcp.cloudflare.com/mcp"]
64-
},
65-
"cloudflare-bindings": {
66-
"command": "npx",
67-
"args": ["mcp-remote", "https://bindings.mcp.cloudflare.com/mcp"]
68-
}
69-
}
70-
}
71-
```
55+
## Connect to an MCP server
56+
57+
Connect any MCP client with remote-server support directly to a URL in the table above. [Cloudflare AI Playground](https://playground.ai.cloudflare.com/) also accepts server URLs in its interface.
7258

7359
## Using Cloudflare's MCP servers from the OpenAI Responses API
7460

apps/ai-gateway/CHANGELOG.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,42 @@
11
# cloudflare-ai-gateway-mcp-server
22

3+
## 0.2.5
4+
5+
### Patch Changes
6+
7+
- b9e6d76: Return an actionable `410 Gone` Problem Details response when a client attempts the removed HTTP+SSE transport with `GET /sse`. The response explains that clients can configure the existing `/sse` URL to use Streamable HTTP or, preferably, move to `/mcp` for future compatibility. It preserves query parameters, identifies the recommended replacement in a `Link` header, and is available before OAuth authentication. Streamable HTTP `POST` requests continue to work on both `/sse` and `/mcp`.
8+
- Updated dependencies [b9e6d76]
9+
- @repo/mcp-common@0.20.10
10+
11+
## 0.2.4
12+
13+
### Patch Changes
14+
15+
- Updated dependencies [12a9a61]
16+
- @repo/mcp-common@0.20.9
17+
18+
## 0.2.3
19+
20+
### Patch Changes
21+
22+
- Updated dependencies [4e1e6ab]
23+
- @repo/mcp-common@0.20.8
24+
25+
## 0.2.2
26+
27+
### Patch Changes
28+
29+
- 1df6213: Migrate all MCP servers to fresh SDK v2 factories with default stateless 2025 compatibility, request-scoped auth/context, and no live protocol Durable Object or SSE session state. Upgrade the released MCP stack to `agents@0.20.1`, `@modelcontextprotocol/server@2.0.0`, `@modelcontextprotocol/client@2.0.0`, and SDK v1 compatibility package `@modelcontextprotocol/sdk@1.30.0`, using the isolated `agents/mcp/server` stateless handler. Keep `/sse` as a URL alias for the same Streamable HTTP handler as `/mcp`, without retaining the deprecated HTTP+SSE transport. Assemble every deployment through canonical public/authenticated app modules, prune obsolete app-level routing dependencies, and expose a tracked registration context instead of the raw SDK server. Preserve append-only Durable Object migration history while explicitly deleting retired protocol classes, preserve application/security state, upgrade the OAuth provider to 0.8.2 with exact resource matching, bound MCP request bodies, and require explicit Workers Builds identifiers.
30+
- Updated dependencies [1df6213]
31+
- @repo/mcp-common@0.20.7
32+
33+
## 0.2.1
34+
35+
### Patch Changes
36+
37+
- Updated dependencies [cb01861]
38+
- @repo/mcp-common@0.20.6
39+
340
## 0.2.0
441

542
### Minor Changes

apps/ai-gateway/README.md

Lines changed: 4 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ connections, with Cloudflare OAuth built-in.
66
It integrates tools powered by the [Cloudflare AI Gateway API](https://developers.cloudflare.com/ai-gateway/) to search
77
your AI Gateway logs, inspect prompts and responses, and get details about gateway usage.
88

9+
The `/mcp` and `/sse` URLs use the same stateless SDK v2 handler and create a fresh server with request-scoped auth/account context for every request. `/sse` is not the deprecated HTTP+SSE transport. OAuth grants and token validation remain durable security state; the server stores no MCP protocol session.
10+
911
## 🔨 Available Tools
1012

1113
Currently available tools:
@@ -28,25 +30,8 @@ This MCP server is still a work in progress, and we plan to add more tools in th
2830
- `Show logs for gateway 'gateway-001' between January 1, 2023, and January 31, 2023.`
2931
- `Fetch the latest errors from gateway-001 and debug what might have happened wrongly`
3032

31-
## Access the remote MCP server from any MCP Client
32-
33-
If your MCP client has first class support for remote MCP servers, the client will provide a way to accept the server URL (`https://ai-gateway.mcp.cloudflare.com`) directly within its interface (for example in[Cloudflare AI Playground](https://playground.ai.cloudflare.com/)).
34-
35-
If your client does not yet support remote MCP servers, you will need to set up its respective configuration file using mcp-remote (https://www.npmjs.com/package/mcp-remote) to specify which servers your client can access.
36-
37-
Replace the content with the following configuration:
38-
39-
```json
40-
{
41-
"mcpServers": {
42-
"cloudflare": {
43-
"command": "npx",
44-
"args": ["mcp-remote", "https://ai-gateway.mcp.cloudflare.com/mcp"]
45-
}
46-
}
47-
}
48-
```
33+
## Connect to the MCP server
4934

50-
Once you've set up your configuration file, restart MCP client and a browser window will open showing your OAuth login page. Proceed through the authentication flow to grant the client access to your MCP server. After you grant access, the tools will become available for you to use.
35+
Connect your MCP client directly to `https://ai-gateway.mcp.cloudflare.com/mcp`. If prompted, complete the Cloudflare OAuth flow in your browser. The tools become available after authorization.
5136

5237
Interested in contributing, and running this server locally? See [CONTRIBUTING.md](CONTRIBUTING.md) to get started.

apps/ai-gateway/package.json

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "cloudflare-ai-gateway-mcp-server",
3-
"version": "0.2.0",
3+
"version": "0.2.5",
44
"private": true,
55
"scripts": {
66
"check:lint": "run-eslint-workers",
@@ -12,14 +12,9 @@
1212
"test": "vitest run"
1313
},
1414
"dependencies": {
15-
"@cloudflare/workers-oauth-provider": "0.7.0",
16-
"@hono/zod-validator": "0.4.3",
17-
"@modelcontextprotocol/sdk": "1.29.0",
15+
"@cloudflare/workers-oauth-provider": "catalog:",
1816
"@repo/mcp-common": "workspace:*",
19-
"@repo/mcp-observability": "workspace:*",
20-
"agents": "0.13.3",
2117
"cloudflare": "4.2.0",
22-
"hono": "4.7.6",
2318
"zod": "4.4.3"
2419
},
2520
"devDependencies": {
Lines changed: 9 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -1,106 +1,22 @@
1-
import OAuthProvider from '@cloudflare/workers-oauth-provider'
2-
import { McpAgent } from 'agents/mcp'
3-
4-
import { AccountManager } from '@repo/mcp-common/src/account-manager'
5-
import { handleApiTokenMode, isApiTokenRequest } from '@repo/mcp-common/src/api-token-mode'
6-
import {
7-
createAuthHandlers,
8-
handleTokenExchangeCallback,
9-
} from '@repo/mcp-common/src/cloudflare-oauth-handler'
10-
import { getEnv } from '@repo/mcp-common/src/env'
11-
import { getProps } from '@repo/mcp-common/src/get-props'
1+
import { createAuthenticatedMcpApp } from '@repo/mcp-common/src/mcp-app'
122
import { RequiredScopes } from '@repo/mcp-common/src/scopes'
13-
import { CloudflareMCPServer } from '@repo/mcp-common/src/server'
143

15-
import { MetricsTracker } from '../../../packages/mcp-observability/src'
164
import { registerAIGatewayTools } from './tools/ai-gateway.tools'
175

18-
import type { AuthProps } from '@repo/mcp-common/src/cloudflare-oauth-handler'
196
import type { Env } from './ai-gateway.context'
207

21-
const env = getEnv<Env>()
22-
23-
const metrics = new MetricsTracker(env.MCP_METRICS, {
24-
name: env.MCP_SERVER_NAME,
25-
version: env.MCP_SERVER_VERSION,
26-
})
27-
28-
// Context from the auth process, encrypted & stored in the auth token
29-
// and provided to the DurableMCP as this.props
30-
type Props = AuthProps
31-
type State = Record<string, never>
32-
33-
export class AIGatewayMCP extends McpAgent<Env, State, Props> {
34-
_server: CloudflareMCPServer | undefined
35-
set server(server: CloudflareMCPServer) {
36-
this._server = server
37-
}
38-
get server(): CloudflareMCPServer {
39-
if (!this._server) {
40-
throw new Error('Tried to access server before it was initialized')
41-
}
42-
43-
return this._server
44-
}
45-
46-
constructor(ctx: DurableObjectState, env: Env) {
47-
super(ctx, env)
48-
}
49-
50-
async init() {
51-
// TODO: Probably we'll want to track account tokens usage through an account identifier at some point
52-
const props = getProps(this)
53-
const userId = props.type === 'user_token' ? props.user.id : undefined
54-
const accountManager = new AccountManager(props)
55-
56-
this.server = new CloudflareMCPServer({
57-
userId,
58-
wae: this.env.MCP_METRICS,
59-
serverInfo: {
60-
name: this.env.MCP_SERVER_NAME,
61-
version: this.env.MCP_SERVER_VERSION,
62-
},
63-
accountManager,
64-
options: { instructions: accountManager.instructionsSuffix() },
65-
})
66-
67-
// Register Cloudflare Log Push tools
68-
registerAIGatewayTools(this)
69-
}
70-
}
71-
728
const AIGatewayScopes = {
739
...RequiredScopes,
7410
'account:read': 'See your account info such as account details, analytics, and memberships.',
7511
'aig:read': 'Grants read level access to AI Gateway.',
7612
} as const
7713

78-
export default {
79-
fetch: async (req: Request, env: Env, ctx: ExecutionContext) => {
80-
if (await isApiTokenRequest(req, env)) {
81-
return await handleApiTokenMode(AIGatewayMCP, req, env, ctx)
82-
}
14+
const app = createAuthenticatedMcpApp<Env>({
15+
serviceHostnames: ['ai-gateway-staging.mcp.cloudflare.com', 'ai-gateway.mcp.cloudflare.com'],
16+
scopes: AIGatewayScopes,
17+
register: registerAIGatewayTools,
18+
})
19+
20+
export const mcpHandler = app.mcpHandler
8321

84-
return new OAuthProvider({
85-
apiHandlers: {
86-
'/mcp': AIGatewayMCP.serve('/mcp'),
87-
'/sse': AIGatewayMCP.serveSSE('/sse'),
88-
},
89-
defaultHandler: createAuthHandlers({ scopes: AIGatewayScopes, metrics }),
90-
authorizeEndpoint: '/oauth/authorize',
91-
tokenEndpoint: '/token',
92-
tokenExchangeCallback: (options) =>
93-
handleTokenExchangeCallback(
94-
options,
95-
env.CLOUDFLARE_CLIENT_ID,
96-
env.CLOUDFLARE_CLIENT_SECRET
97-
),
98-
// Cloudflare access token TTL
99-
accessTokenTTL: 3600,
100-
refreshTokenTTL: 2592000, // 30 days
101-
// TODO: Remove after 2026-05-01 — all pre-0.4.0 grants will have expired by then
102-
resourceMatchOriginOnly: true,
103-
clientRegistrationEndpoint: '/register',
104-
}).fetch(req, env, ctx)
105-
},
106-
}
22+
export default app.worker

0 commit comments

Comments
 (0)