MLC-Digital-Transformation/remote-mcp-server

Remote MCP Server on Cloudflare

Let's get a remote MCP server up-and-running on Cloudflare Workers complete with OAuth login!

Develop locally

# clone the repository
git clone https://github.com/cloudflare/ai.git
# Or if using ssh:
# git clone git@github.com:cloudflare/ai.git

# install dependencies
cd ai
# Note: using pnpm instead of just "npm"
pnpm install

# run locally
npx nx dev remote-mcp-server

You should be able to open http://localhost:8787/ in your browser

Connect the MCP inspector to your server

To explore your new MCP api, you can use the MCP Inspector.

• Start it with npx @modelcontextprotocol/inspector
• Within the inspector, switch the Transport Type to SSE and enter http://localhost:8787/sse as the URL of the MCP server to connect to, and click "Connect"
• You will navigate to a (mock) user/password login screen. Input any email and pass to login.
• You should be redirected back to the MCP Inspector and you can now list and call any defined tools!

Connect Claude Desktop to your local MCP server

The MCP inspector is great, but we really want to connect this to Claude! Follow Anthropic's Quickstart and within Claude Desktop go to Settings > Developer > Edit Config to find your configuration file.

Open the file in your text editor and replace it with this configuration:

{
  "mcpServers": {
    "math": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://localhost:8787/sse"
      ]
    }
  }
}

This will run a local proxy and let Claude talk to your MCP server over HTTP

When you open Claude a browser window should open and allow you to login. You should see the tools available in the bottom right. Given the right prompt Claude should ask to call the tool.

Deploy to Cloudflare

1. npx wrangler kv namespace create OAUTH_KV
2. Follow the guidance to add the kv namespace ID to wrangler.jsonc
3. npm run deploy

Call your newly deployed remote MCP server from a remote MCP client

Just like you did above in "Develop locally", run the MCP inspector:

npx @modelcontextprotocol/inspector@latest

Then enter the workers.dev URL (ex: worker-name.account-name.workers.dev/sse) of your Worker in the inspector as the URL of the MCP server to connect to, and click "Connect".

You've now connected to your MCP server from a remote MCP client.

Connect Claude Desktop to your remote MCP server

Update the Claude configuration file to point to your workers.dev URL (ex: worker-name.account-name.workers.dev/sse) and restart Claude

{
  "mcpServers": {
    "math": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://worker-name.account-name.workers.dev/sse"
      ]
    }
  }
}

Using Authentication Token (Optional)

The MCP server supports optional authentication tokens that will be passed to all FastAPI backend requests. When a valid token is provided, you can use the get_user_data tool to retrieve user information from the database.

There are multiple ways to provide the auth token:

Method 1: Query Parameter (Recommended for testing)

Add the token as a query parameter to the SSE URL:

{
  "mcpServers": {
    "mlcd-mcp-server": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://remote-mcp-server.matthew-ludwig.workers.dev/sse?auth_token=your-auth-token-here"
      ]
    }
  }
}

Method 2: Environment Variable (For Cloudflare Worker deployment)

Set the MCP_AUTH_TOKEN environment variable in your Cloudflare Worker:

wrangler secret put MCP_AUTH_TOKEN
# Enter your auth token when prompted

Method 3: Authorization Header

If your MCP client supports custom headers, you can pass the token as a Bearer token in the Authorization header.

The token will be automatically included in all API requests to the FastAPI backend as a Bearer token in the Authorization header.

Debugging

Should anything go wrong it can be helpful to restart Claude, or to try connecting directly to your MCP server on the command line with the following command.

npx mcp-remote http://localhost:8787/sse

In some rare cases it may help to clear the files added to ~/.mcp-auth

rm -rf ~/.mcp-auth