You can secureModel Context Protocol (MCP) servers ↗ by using Cloudflare Access as an OAuth Single Sign-On (SSO) provider.

This guide walks through how to deploy a remoteMCP server onCloudflare Workers that requires Cloudflare Access for authentication. When users connect to the MCP server using anMCP client, they will be prompted to log in to youridentity provider and are only granted access if they pass yourAccess policies.

• Add anidentity provider to Cloudflare Zero Trust
• Installnpm ↗
• InstallNode.js ↗

To deploy ourexample MCP server ↗ on Workers:

1. Open a terminal and clone our example project:

   npmcreatecloudflare@latest--mcp-server-cf-access--template=cloudflare/ai/demos/remote-mcp-cf-access

   When asked if you want to deploy to Cloudflare, selectNo.

2. Go to the project directory:

   cdmcp-server-cf-access

3. Create aWorkers KV namespace to store the key. The binding name should beOAUTH_KV if you want to run the example as written.

   npxwranglerkvnamespacecreate"OAUTH_KV"

   The command will output the binding name and KV namespace ID:

   {
   "kv_namespaces": [
   {
   "binding":"OAUTH_KV",
   "id":"<YOUR_KV_NAMESPACE_ID>"
   }
   ]
   }

4. Openwrangler.jsonc in an editor and insert yourOAUTH_KV namespace ID:

   "kv_namespaces":[
   {
   "binding":"OAUTH_KV",
   "id":"<YOUR_KV_NAMESPACE_ID>"
   }
   ],

5. You can now deploy the Worker to Cloudflare's global network:

   npxwranglerdeploy

The Worker will be deployed to your*.workers.dev subdomain atmcp-server-cf-access.<YOUR_SUBDOMAIN>.workers.dev.

Your MCP server needs to perform an OAuth 2.0 authorization flow to get anaccess_token from the SaaS app created inStep 1. When setting up the OAuth client on your MCP server, you will need to paste in the OAuth endpoints and credentials from the SaaS app.

To add OAuth endpoints and credentials to ourexample MCP server:

1. Create the followingWorkers secrets:

   wranglersecretputACCESS_CLIENT_ID
   wranglersecretputACCESS_CLIENT_SECRET
   wranglersecretputACCESS_TOKEN_URL
   wranglersecretputACCESS_AUTHORIZATION_URL
   wranglersecretputACCESS_JWKS_URL

2. When prompted to enter a secret value, paste the corresponding values from your SaaS app:

   Workers secret	SaaS app field
   ACCESS_CLIENT_ID	Client ID
   ACCESS_CLIENT_SECRET	Client secret
   ACCESS_TOKEN_URL	Token endpoint
   ACCESS_AUTHORIZATION_URL	Authorization endpoint
   ACCESS_JWKS_URL	Key endpoint

3. Configure a cookie encryption key:

   a. Generate a random string:

   opensslrand-hex32

   b. Store the string in a Workers secret:

   wranglersecretputCOOKIE_ENCRYPTION_KEY

You should now be able to connect to your MCP server usingWorkers AI Playground ↗,MCP inspector ↗, orother MCP clients that support remote MCP servers. The demo MCP serversupports connections ↗ via eitherhttps://mcp-server-cf-access.<YOUR_SUBDOMAIN>.workers.dev/mcp orhttps://mcp-server-cf-access.<YOUR_SUBDOMAIN>.workers.dev/sse.

To test in Workers AI Playground:

1. Go toWorkers AI Playground ↗.

2. UnderMCP Servers, enterhttps://mcp-server-cf-access.<YOUR_SUBDOMAIN>.workers.dev/mcp for the MCP server URL.

3. SelectConnect.

4. A popup window will appear requesting access to the MCP server. SelectApprove.

5. Follow the prompts to log in to your identity provider.

Workers AI Playground will show aConnected status. The MCP server should successfully obtain anaccess_token from Cloudflare Access.