mcp-tools

Cloudflare Workers that speak MCP, in one TypeScript repo.

core/mcp.ts             shared plumbing: HTTP MCP endpoint + RPC surface + tool typing
workers/mcp-wp/         WordPress REST API -> MCP
workers/mcp-toolkit/    aggregator: its own tools + every worker bound under `services`
scripts/mock-wp.mjs     fake WordPress for local testing

A worker is a tools object

import cfg from "../wrangler.json";
import pkg from "../package.json";
import { mcpWorker, tool } from "../../../core/mcp";

export default mcpWorker({
  ...cfg, // name + services come straight from wrangler.json
  version: pkg.version,
  tools: {
    hello: tool({
      description: "Say hi",
      input: { type: "object", required: ["name"], properties: { name: { type: "string" } } },
      run: ({ name }) => `Hi ${name}`, // `name` is typed from `input`; nothing declared twice
    }),
  },
});

Rules the core enforces so nothing needs a mapping table:

• The object key is the tool name. Exposed as <worker>_<key>: worker mcp-wp -> wp_search_posts.

• run may return a string, any JSON value, or a full MCP result ({ content, isError }).

• tools may be a function of the request context when tools depend on the connector URL.

• A worker with services in its wrangler.json re-exports those workers' tools and routes calls by prefix. The connector's query string is forwarded, so each worker reads its own params.

Connector URLs

Local development

npm install
npm run check                                   # wrangler types + tsc, every worker
npm run format                                  # prettier, 100 columns
node scripts/mock-wp.mjs 8799 &                 # a fake WordPress
cd workers/mcp-toolkit && npx wrangler dev -c wrangler.json -c ../mcp-wp/wrangler.json
curl 'http://localhost:8787/?wp=http://localhost:8799'   # lists the generated tools

worker-configuration.d.ts is generated by wrangler types and committed so any editor type-checks a fresh clone. Re-run npm run check after touching a wrangler.json.

Deploying (Workers Builds, per worker)

Dashboard -> the Worker -> Settings -> Build -> Connect repository:

The Worker name in the dashboard must equal name in that folder's wrangler.json. Bindings live in wrangler.json; secrets stay in the dashboard (keep_vars keeps plain vars too).

Adding a worker

1. Copy workers/mcp-wp to workers/mcp-<name>; set name in wrangler.json and package.json.

2. Replace tools in src/index.ts.

3. Add { "binding": "<NAME>", "service": "mcp-<name>" } to workers/mcp-toolkit/wrangler.json.

4. npm run check, commit, connect the new Worker to the repo as above.

Auth (Cloudflare Access)

Access runs before the Worker, so unauthenticated hits cost nothing. Per worker:

1. Zero Trust -> Integrations -> Identity providers -> add One-time PIN (email code, no account needed).

2. Workers & Pages -> the Worker -> Access -> protect it; policy: Include -> Emails -> your list.

3. Zero Trust -> Access controls -> Applications -> edit that application -> Advanced settings -> turn on Managed OAuth, allow dynamic client registration.

4. In Claude.ai, add the connector URL. The browser login is the Access page.

Adding a person = adding their email to the policy.