Yahoo Finance

You deploy a secure, OAuth-enabled MCP server that lets clients connect over the web or locally, protecting your tools behind Cloudflare Access. This server runs stdio MCP tools in a container and exposes them to authorized users and applications through a simple, scalable remote interface.

How to use

You connect to your MCP server with an MCP client such as Inspector, Claude Desktop, Cursor, or Windsurf. After authentication through your Access identity provider, you gain access to the Tools exposed by your server. Use the Inspector to test your remote server by pointing it at the server’s SSE endpoint, then follow the prompts to list and run available tools. In Claude Desktop, configure your MCP server in the Developer settings so Claude can access and invoke the Tools after you complete the OAuth login flow.

How to install

Prerequisites you need before starting:

Node.js and npm installed on your machine

Wrangler installed for Cloudflare Workers development

How to install

npm create cloudflare@latest -- test-mcp --template=de4ps/secure-mcp-server

npm install

For Production

Follow these steps to enable external Access and secure your MCP server.

For Production

# Create an Access for SaaS OIDC App
# For the Authorization callback URL, specify:
#   https://secure-mcp-server.<your-subdomain>.workers.dev/callback
#   http://localhost:8788/callback  (for local development)
# Note your Client ID and Client Secret, then store them securely

# Put secrets using the provided script
./infra/put-secrets.sh

# Or manually set each secret in Wrangler
wrangler secret put ACCESS_CLIENT_ID
wrangler secret put ACCESS_CLIENT_SECRET
wrangler secret put ACCESS_TOKEN_URL
wrangler secret put ACCESS_AUTHORIZATION_URL
wrangler secret put ACCESS_JWKS_URL
wrangler secret put COOKIE_ENCRYPTION_KEY # add any random string here e.g. openssl rand -hex 32

# Create and update KV namespace
wrangler kv:namespace create "OAUTH_KV"
# Update the Wrangler file with the KV ID as needed

# Deploy to your workers.dev domain
wrangler deploy

# Test the remote server using Inspector
npx @modelcontextprotocol/inspector@latest

Enter https://secure-mcp-server.<your-subdomain>.workers.dev/sse and hit connect. After authentication, you will see the Tools available.

Access Control

Access control is implemented via Cloudflare Zero Trust Access. Authentication and authorization are managed by Cloudflare policies, not by hardcoded server settings.

Access the remote MCP server from Claude Desktop

Open Claude Desktop and go to Settings -> Developer -> Edit Config. Replace the content with the following configuration. Restart Claude Desktop to trigger OAuth login and grant access to your MCP server. After authentication completes, the Tools will appear for use.

For Local Development

To iterate locally, you can run the server and test against a local URL.

Homepage URL: http://localhost:8788
Authorization callback URL: http://localhost:8788/callback

# Create local dev environment variables
# In a project root, create a .dev.vars file with the following
ACCESS_CLIENT_ID=<your client id>
ACCESS_CLIENT_SECRET=<your client secret>
ACCESS_TOKEN_URL=<your Access for SaaS token url>
ACCESS_AUTHORIZATION_URL=<your Access for SaaS authorization url>
ACCESS_JWKS_URL=<your Access for SaaS JWKS url>
COOKIE_ENCRYPTION_KEY=COOKIE_ENCRYPTION_KEY

# Start the local dev server
wrangler dev

To test the local server, open http://localhost:8788/sse in Inspector and click connect. After authentication, you will be able to list Tools.

Using Claude and other MCP Clients

When using Claude to connect to your remote MCP server, you may see some error messages because Claude Desktop doesn’t yet support remote MCP servers everywhere. To verify the connection, hover over the tools icon in Claude and confirm your Tools are available.

Using Cursor and other MCP Clients

To connect Cursor to your MCP server, set the Type to Command and place the combined command and arguments in the Command field, for example: npx mcp-remote https://<your-worker-name>.<your-subdomain>.workers.dev/sse. Cursor supports HTTP+SSE servers, but you still need to use the mcp-remote approach and a STDIO server for full tool interaction.

How to connect to other MCP clients

You can connect Windsurf by adding the same JSON configuration used for Claude and restarting the client to recognize your MCP server.

How does it work

OAuth Provider: A complete OAuth 2.1 server implementation handles token issuance, validation, and management, authenticating MCP clients and managing connections to Access services.

Tools and endpoints

The server exposes tools that can be invoked by clients such as Inspector. Tools are defined through the MCP protocol, enabling structured requests and responses over the SSE connection.

Notes and troubleshooting

If you encounter issues with remote access from Claude Desktop, verify that you completed the OAuth flow and that your Access policies allow the requested user to reach the MCP server. For local development, ensure wrangler dev is running and the SSE endpoint is accessible at http://localhost:8788/sse.

Available tools

mcp-remote

Command or tool wrapper used to invoke remote MCP server tools from clients like Claude or Cursor.

Inspector

Remote testing tool that connects to the server's SSE endpoint to list and run available tools after authentication.