Model Context Protocol (MCP) Server

This is a MCP server which will require the user to first authenticate. The MCP server will then be able to call protected APIs on behalf of the user.

Configuration

Todos API

Before you can use the MCP server, you will need to deploy the Todos API as documented here.

Auth0 Configuration

In the Auth0 dashboard, create a new application in the Applications section (type: "Regular Web Application").

Once the application is created, configure the following URL as the callback URL when developing locally:

http://localhost:8788/callback

Set up a KV namespace

Create the KV namespace: wrangler kv:namespace create "OAUTH_KV"
Update the Wrangler file with the KV ID

Environment Variables

This MCP Server needs a few environment variables to be configured:

Setting	Description
`AUTH0_DOMAIN`	The domain of your Auth0 tenant (e.g., `acme.auth0.com`)
`AUTH0_CLIENT_ID`	The Client ID from the Auth0 application you created
`AUTH0_CLIENT_SECRET`	The Client Secret from the Auth0 application you created
`AUTH0_AUDIENCE`	The unique identifier for your API which you registered in the Auth0 dashbaord (e.g., `urn:todos-api`)
`AUTH0_SCOPE`	The scopes requested by the MCP Server. Here we request basic profile info (`openid email profile`), refresh token capability (`offline_access`), and API access (`read:todos`)
`NODE_ENV`	The environment setting - use `development` for local development
`API_BASE_URL`	The base URL where your Todos API is running

Development

Create a .dev.vars file in the root of the project with the following structure:

AUTH0_DOMAIN=yourdomain.us.auth0.com
AUTH0_CLIENT_ID=The Client ID of the application you created in Auth0
AUTH0_CLIENT_SECRET=The Client Secret of the application you created in Auth0
AUTH0_AUDIENCE=urn:todos-api
AUTH0_SCOPE=openid email profile offline_access read:todos
NODE_ENV=development
API_BASE_URL=http://localhost:8789

Testing the MCP Server

To start the MCP server, you can use the following command:

npm run dev

With MCP Inspector you can connect to the MCP server, list the available tools and call them. Make sure to set the transport type to sse and the URL to http://localhost:8788/sse.

Deploying the MCP Server to Cloudflare

To deploy the MCP Server to Cloudflare, you will first need to set the following secrets:

wrangler secret put AUTH0_DOMAIN
wrangler secret put AUTH0_CLIENT_ID
wrangler secret put AUTH0_CLIENT_SECRET
wrangler secret put AUTH0_AUDIENCE
wrangler secret put AUTH0_SCOPE
wrangler secret put API_BASE_URL

Once the secrets are set, you can deploy the API with the following command:

npm run deploy

In the Auth0 dashboard, also make sure to add a new Callback URL for your deployed MCP server, eg:

https://mcp-auth0-oidc.<your-subdomain>.workers.dev/callback

To test this you can now use the Workers AI LLM Playground. Navigate to https://playground.ai.cloudflare.com/ and connect to your MCP server on the bottom left using the following URL pattern:

https://mcp-auth0-oidc.<your-subdomain>.workers.dev/sse

This will open a popup where you can sign in after which you'll be able to use all of the tools.

Troubleshooting

If you encounter any issues while setting up or using the MCP server, here are some troubleshooting steps:

Check Worker Logs

Visit the Cloudflare Workers Logs in your dashboard

Auth0 Dashboard Logs

Navigate to the Logs section in your Auth0 Dashboard
Review authentication attempts and failures

Common Issues

If authentication fails, verify your Auth0 configuration and secrets
For connection issues, ensure your Worker is deployed and the domain is correct
Check that all callback URLs are properly configured in Auth0
Verify the API_BASE_URL matches your deployed API endpoint