Reach Gateway

Reach Gateway is an owner-authenticated, read-only service for normalized public evidence. It runs on Cloudflare Workers, uses Cloudflare Access OAuth, and exposes the registered private app Reach the G to ChatGPT and Codex through MCP and a Custom GPT Action facade.

Discovery stays with the host assistant. Reach uses no paid search API and provides no private-account or write access.

Actions

Production MCP endpoint: https://reach-gateway.izeesub.workers.dev/mcp

ChatGPT's header-constrained private adapter uses https://reach-gateway.izeesub.workers.dev/mcp-token/<owner-secret>. The path token is validated by the Worker against REACH_GATEWAY_TOKEN; the transport may be configured as No Auth in ChatGPT without making the server public. Cloudflare Access OAuth remains available in parallel on /mcp.

Custom GPT schema: https://reach-gateway.izeesub.workers.dev/openapi.json

The Action bundle and exact GPT Builder instructions are under actions. Its operation IDs are checkEvidenceChannels, readPublicUrl, and getPublicTranscript; all three call the same retrieval core as MCP.

Related MCP server: Genius Sports RSS Monitor MCP

Local verification

Requires Node.js 24 or newer.

npm ci
npm run check
node scripts/verify-no-secrets.mjs
npx wrangler deploy --dry-run

Credentialed source tests are separate and do not certify a release when skipped:

REACH_LIVE_TESTS=1 npm run test:live

Security boundary

• Exact-owner OAuth is enforced by Cloudflare Access and Worker-side identity verification.

• Retrieval accepts only public HTTPS destinations and passes through SSRF-safe URL policy.

• Retrieved content is labeled and treated as untrusted evidence.

• Cookies, bearer tokens, private-account credentials, writes, and paid search keys are outside the product contract.

• The service is stateless and does not create a research-memory authority.

Private distribution

The Codex bundle is under plugin/reach-gateway and maps to the existing registered app instead of creating a duplicate MCP identity. The release is distributed through the owner's personal plugin catalog. Public multi-user directory submission is intentionally unavailable because reusable reviewer access would conflict with owner-only OTP/MFA.

See docs/evidence/release-verification.md for exact verification state and remaining device checks.

Rollback

Use one explicit, previously verified Cloudflare deployment ID:

./scripts/rollback.sh <deployment-id>

Rollback is a production mutation and must remain human-authorized.