mcp-tools

Cloudflare Workers that speak MCP, in one TypeScript repo.

core/mcp.ts             shared plumbing: HTTP MCP endpoint + RPC surface + tool typing
workers/mcp-wp/         WordPress REST API -> MCP
workers/mcp-toolkit/    aggregator: its own tools + every worker bound under `services`
scripts/mock-wp.mjs     fake WordPress for local testing

A worker is a tools object

import cfg from "../wrangler.json";
import pkg from "../package.json";
import { mcpWorker, tool } from "../../../core/mcp";

export default mcpWorker({
  ...cfg, // name + services come straight from wrangler.json
  version: pkg.version,
  tools: {
    hello: tool({
      description: "Say hi",
      input: { type: "object", required: ["name"], properties: { name: { type: "string" } } },
      run: ({ name }) => `Hi ${name}`, // `name` is typed from `input`; nothing declared twice
    }),
  },
});

Rules the core enforces so nothing needs a mapping table:

• The object key is the tool name. Exposed as <worker>_<key>: worker mcp-wp -> wp_search_posts.

• run may return a string, any JSON value, or a full MCP result ({ content, isError }).

• tools may be a function of the request context when tools depend on the connector URL.

• A worker with services in its wrangler.json re-exports those workers' tools and routes calls by prefix. The connector's query string is forwarded, so each worker reads its own params.

Related MCP server: WordPress MCP Python

Connector URLs

Local development

npm install
npm run check                                   # wrangler types + tsc, every worker
npm run format                                  # prettier, 100 columns
node scripts/mock-wp.mjs 8799 &                 # a fake WordPress
cd workers/mcp-toolkit && npx wrangler dev -c wrangler.json -c ../mcp-wp/wrangler.json
curl 'http://localhost:8787/?wp=http://localhost:8799'   # lists the generated tools

worker-configuration.d.ts is generated by wrangler types and committed so any editor type-checks a fresh clone. Re-run npm run check after touching a wrangler.json.

Deploying (Workers Builds, per worker)

Dashboard -> the Worker -> Settings -> Build -> Connect repository:

The Worker name in the dashboard must equal name in that folder's wrangler.json. Bindings live in wrangler.json; secrets stay in the dashboard (keep_vars keeps plain vars too).

Adding a worker

1. Copy workers/mcp-wp to workers/mcp-<name>; set name in wrangler.json and package.json.

2. Replace tools in src/index.ts.

3. Add { "binding": "<NAME>", "service": "mcp-<name>" } to workers/mcp-toolkit/wrangler.json.

4. npm run check, commit, connect the new Worker to the repo as above.

Auth (Cloudflare Access)

Access runs before the Worker, so unauthenticated hits cost nothing. Per worker:

1. Zero Trust -> Integrations -> Identity providers -> add One-time PIN (email code, no account needed).

2. Workers & Pages -> the Worker -> Access -> protect it; policy: Include -> Emails -> your list.

3. Zero Trust -> Access controls -> Applications -> edit that application -> Advanced settings -> turn on Managed OAuth, allow dynamic client registration.

4. In Claude.ai, add the connector URL. The browser login is the Access page.

Adding a person = adding their email to the policy.