Add cloud MCP server with WorkOS OAuth - #128
Merged
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | c112518 | Commit Preview URL Branch Preview URL |
Apr 09 2026, 06:20 AM |
Collaborator
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
Static top-level import of cloudflare:workers in env.ts breaks TanStack Start SSR, causing every route to 500. Move all Cloudflare binding access to dynamic import() calls at each call site. Also adds MCP server middleware and dependencies.
- Add /mcp endpoint with WorkOS OAuth (JWT verification via AuthKit JWKS) - Add /.well-known/oauth-protected-resource and oauth-authorization-server endpoints - Use Durable Objects for session persistence (client capabilities, pause/resume) - Custom server entrypoint for DO class export - Workers-compatible JSON Schema validator (replaces Ajv which uses new Function()) - Fix static cloudflare:workers import causing SSR 500s (dynamic imports) - Show only HTTP transport option in MCP install card for cloud app
Users must already exist (created at signup). The MCP handler now fails with a clear error if no team is found instead of silently creating accounts.
RhysSullivan
force-pushed
the
feat/cloud-mcp-server
branch
2 times, most recently
from
April 9, 2026 06:15
6aef748 to
71d3d23
Compare
RhysSullivan
force-pushed
the
feat/cloud-mcp-server
branch
from
April 9, 2026 06:18
71d3d23 to
c112518
Compare
Collaborator
Author
Merge activity
|
RhysSullivan
added a commit
that referenced
this pull request
May 31, 2026
## Summary - Add MCP server endpoint at `/mcp` on the cloud app with WorkOS OAuth authentication (JWT verification via AuthKit JWKS at `signin.executor.sh`) - OAuth discovery via `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server` endpoints - Durable Object sessions (`McpSessionDO`) to persist client capabilities and support pause/resume for clients without elicitation - Custom server entrypoint (`src/server.ts`) for DO class export with TanStack Start - Workers-compatible JSON Schema validator replacing Ajv (which uses `new Function()`) - Fix static `cloudflare:workers` import causing SSR 500s → dynamic imports - MCP install card only shows HTTP transport option on cloud app ## Test plan - [x] OAuth flow works — Claude Code authenticates via AuthKit - [x] `execute` tool visible (elicitation-capable clients hide `resume`) - [x] Code execution works end-to-end through MCP - [x] Well-known endpoints return correct metadata - [x] Unauthenticated requests get 401 with `WWW-Authenticate` header
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/mcpon the cloud app with WorkOS OAuth authentication (JWT verification via AuthKit JWKS atsignin.executor.sh)/.well-known/oauth-protected-resourceand/.well-known/oauth-authorization-serverendpointsMcpSessionDO) to persist client capabilities and support pause/resume for clients without elicitationsrc/server.ts) for DO class export with TanStack Startnew Function())cloudflare:workersimport causing SSR 500s → dynamic importsTest plan
executetool visible (elicitation-capable clients hideresume)WWW-Authenticateheader