remote-mcp-server-with-auth

Use this Cloudflare Workers template with GitHub OAuth built in. Configure GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and COOKIE_ENCRYPTION_KEY in .dev.vars, create a KV namespace for OAuth state, then run wrangler dev locally or wrangler deploy for production.

Create a new file in src/tools/ defining a Zod input schema and a register function that calls server.tool with a name, description, schema, and handler. Then add the register call to registerAllTools in src/tools/index.ts so the server exposes it.

Streamable HTTP at the /mcp endpoint is the recommended modern transport, while SSE at /sse is the legacy option kept for older clients. Both endpoints in this template create the same MCP server instance with the authenticated username in context.

Yes, the template enforces role-based access through an ALLOWED_USERNAMES set of GitHub usernames. The executeDatabase tool checks meta.username against this allowlist and rejects write queries from unauthorized users, while read-only queries remain available to all authenticated users.

Verify the tool is registered inside registerAllTools, confirm the Zod schema has no validation errors, and restart Claude Desktop after editing claude_desktop_config.json. Test the endpoint first with the MCP Inspector using npx @modelcontextprotocol/inspector.

Always use parameterized queries with placeholders like $1 instead of string concatenation. The template also validates query types with regex so the read-only queryDatabase tool only accepts SELECT, SHOW, DESCRIBE, or EXPLAIN statements.