Merge pull request #498 from GreenStage/egomes/remote-mcp-cf-access-self-hosted

Author: mattzcarey

demos.json

@@ -107,6 +107,9 @@
 		},
 		"./demos/hello-world": {
 			"package_json_hash": "286f536168d5b046228c88c689758c9eb4ff3fb8"
+		},
+		"./demos/remote-mcp-cf-access-self-hosted": {
+			"package_json_hash": "711087c91bcd285999ba2bba9db991df68220718"
 		}
 	}
 }

demos/remote-mcp-cf-access-self-hosted/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+.wrangler/
+.dev.vars

demos/remote-mcp-cf-access-self-hosted/README.md

@@ -0,0 +1,70 @@
+# MCP Server + Access Self-Hosted App
+
+A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction) server protected by Cloudflare Access as a self-hosted application. Unlike the [Access for SaaS demo](../remote-mcp-cf-access/), this approach requires **no OAuth implementation** — Cloudflare Access handles authentication automatically.
+
+The MCP server demonstrates:
+
+- Validating the Access JWT signature against your team's public keys using [`jose`](https://www.npmjs.com/package/jose)
+- Verifying the JWT issuer and audience claims
+- Reading user identity from the validated JWT
+- Conditionally exposing tools based on user identity
+
+## Getting Started
+
+Clone the repo and install dependencies:
+
+```bash
+npm install
+```
+
+### Create a self-hosted Access application
+
+1. In [Cloudflare One](https://one.dash.cloudflare.com), go to **Access controls** > **Applications** > **Add an application** > **Self-hosted**.
+2. Set the **Application domain** to your Worker URL (e.g., `mcp-access-self-hosted.<your-subdomain>.workers.dev`).
+3. Add an Access policy to control who can connect (e.g., allow emails ending in `@yourcompany.com`).
+
+### Configure environment variables
+
+Update `wrangler.jsonc` with your Access application details:
+
+- `TEAM_DOMAIN`: Your Cloudflare One team domain (e.g., `https://<your-team-name>.cloudflareaccess.com`)
+- `POLICY_AUD`: Your application's [AUD tag](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#get-your-aud-tag) (found under **Access controls** > **Applications** > your app > **Basic information**)
+
+### Deploy
+
+```bash
+wrangler deploy
+```
+
+### Test
+
+Test the remote server using [Inspector](https://modelcontextprotocol.io/docs/tools/inspector):
+
+```bash
+npx @modelcontextprotocol/inspector@latest
+```
+
+Enter `https://mcp-access-self-hosted.<your-subdomain>.workers.dev/mcp` and connect. You will be prompted to log in through your Access identity provider.
+
+### Connect from Claude Desktop
+
+Open Claude Desktop, go to Settings > Developer > Edit Config, and add:
+
+```json
+{
+  "mcpServers": {
+    "access-self-hosted": {
+      "type": "http",
+      "url": "https://mcp-access-self-hosted.<your-subdomain>.workers.dev/mcp"
+    }
+  }
+}
+```
+
+### Local Development
+
+```bash
+wrangler dev
+```
+
+Note: In local development, `Cf-Access-Jwt-Assertion` is not set by Access. You can test by manually setting the header or by using `cloudflared access` to tunnel through Access.