Skip to content

Cloudflare Worker MCP Server - Edition v1

Edition metadata

Targets: Cloudflare Workers, remote MCP, TypeScript, Zod, optional Durable Objects Reviewed: 2026-07; Next review due: 2027-07 Status: latest; Pin as: cloudflare-worker-mcp-server@v1 Canonical URL: https://vibecodeqa.online/standards/cloudflare-worker-mcp-server/v1/

This edition captures the gold standard for remote MCP servers hosted on Cloudflare Workers. It focuses on the seam between HTTP transport, OAuth authorization, tool schema quality, Worker bindings, Durable Object or platform storage, auditability, and deployment.

Rule shape

Each rule has a stable ID (R-<AREA>-<n>), one checkable statement, the reason it exists, a vcqa signal that describes how a scanner or judge evaluates it, and upstream references when the rule depends on external authority.

Protocol revision this edition cites

This edition is written against MCP protocol revision 2025-11-25 - the revision recorded as this edition's mcp target in the standards registry, and the revision every specification link in these chapters points at. VCQA does not certify a fixed set of revisions on a repo's behalf: which revisions a given deployment negotiates, on which transport, under which auth mode, and against which clients is a claim the repo itself must state and evidence. See R-PROTO-5 for the required matrix and R-DEPLOY-5 for the evidence that has to back it.

The rubric

# Area Code What it governs
1 Project shape SHAPE Worker entrypoint, MCP endpoint ownership, binding types
2 Protocol and transport PROTO MCP Streamable HTTP, routing, sessions, errors
3 Authorization and permissions AUTH / PERM OAuth, protected resource metadata, scopes, consent
4 Tool schemas and validation TOOL / VAL tool definitions, Zod schemas, side-effect gates
5 State storage and audit STATE / AUDIT Durable Objects, KV/R2/D1 boundaries, mutation trails
6 Output safety and observability OUT / OBS untrusted tool output, logs, safe errors, metrics
7 Deployment gates DEPLOY / CI Wrangler config, environments, tests, least-privilege CI

Non-negotiables

  • R-AUTH-1 - protected remote MCP endpoints enforce authorization at the Worker boundary before tool dispatch.
  • R-AUTH-2 - OAuth-protected MCP servers publish protected resource metadata or an equivalent challenge path required by the MCP authorization spec.
  • R-PERM-1 - every tool maps to a narrow permission boundary; mutating tools are not covered by generic read grants.
  • R-TOOL-1 - every tool has a narrow input schema advertised to clients and enforced at runtime.
  • R-VAL-1 - parsed tool arguments are used for authorization and side effects; raw JSON is never trusted.
  • R-STATE-1 - Durable Object IDs and storage keys are scoped to the tenant, user, session, or resource boundary they coordinate.
  • R-AUDIT-1 - mutating tool calls produce a traceable event with actor, tool, target, outcome, and request correlation.
  • R-OUT-1 - tool output and fetched content are treated as untrusted data, not as executable instructions for later tool calls.

Reports and scans should cite this pinned edition URL: https://vibecodeqa.online/standards/cloudflare-worker-mcp-server/v1/