Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SEM-G Secure Enterprise MCP Gateway check the internal CRM for urgent support tickets"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
SEM-G is a high-performance, zero-trust gateway designed to securely broker interactions between Enterprise AI Models (via the Model Context Protocol) and sensitive internal databases/tools. Built entirely on Cloudflare's Edge infrastructure using the 100% Free Tier.
Zero-Trust Authorization: Validates sessions via simulated Cloudflare Access JWTs.
Data Loss Prevention (DLP): High-speed Regex engine intercepts tool responses to mask PII (SSNs, Credit Cards, Phone Numbers) before the context reaches the AI.
Prompt Injection Defense: Uses Workers AI (@cf/baai/bge-base-en-v1.5) and Vectorize to detect and block adversarial prompts in real-time.
LLM-as-a-Judge: Leverages a fast evaluation model (@cf/meta/llama-3-8b-instruct) to score finalized context blocks for safety and alignment before returning payloads over Streamable HTTP /mcp.
Edge Native: Stateless architecture utilizing Cloudflare KV for sub-millisecond session governance and rate limiting.
Related MCP server: MCPGuard
Routing Layer: Hono.js manages API endpoints securely.
Session Governance: Cloudflare KV tracks transactions to prevent abuse.
Security Middleware: Embeddings and Vector Search classify inputs.
Tool Execution: Handles standard JSON-RPC 2.0 requests following the MCP specification.
Node.js & npm
A Cloudflare Account (Free Tier is sufficient)
Wrangler CLI installed globally.
Clone the repository and install dependencies:
npm installLogin to Cloudflare:
npx wrangler loginProvision Cloudflare Resources: Create the required KV Namespace and Vectorize database for your project:
npx wrangler kv:namespace create "SESSION_STORE"
npx wrangler vectorize create threat-signatures --dimensions=768 --metric=cosineNote: Update the IDs inside your wrangler.jsonc file with the outputs from the above commands.
Run Locally (Development):
npm run devThe test suite validates DLP masking patterns and routing authorization natively inside a simulated Cloudflare Edge environment.
npm run testDeploy globally to the Cloudflare Edge network:
npm run deployThis is a demonstration of enterprise concepts adapted for the Cloudflare Free Tier. In a true enterprise setting, it is recommended to use Cloudflare Access for verifying JWTs via JWKS, and utilizing robust ML/NER models for DLP masking rather than pure regular expressions.
This server cannot be deployed
Zero-trust gateway for AI agents: score tool calls, verify agent cards, enforce policy, audit.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
