我的书签
添加书签
移除书签Build a Remote MCP server·续
For a step-by-step deployment guide, refer to Secure MCP servers with Access for SaaS.
Third-party OAuth
You can connect your MCP server with any OAuth provider that supports the OAuth 2.0 specification, including GitHub, Google, Slack, Stytch, Auth0, WorkOS, and more.
The following example demonstrates how to use GitHub as an OAuth provider.
Step 1 — Create a new MCP server
Run the following command to create a new MCP server with GitHub OAuth:
npmyarnpnpm
npm create cloudflare@latest -- my-mcp-server-github-auth --template=cloudflare/ai/demos/remote-mcp-github-oauth
yarn create cloudflare my-mcp-server-github-auth --template=cloudflare/ai/demos/remote-mcp-github-oauth
pnpm create cloudflare@latest my-mcp-server-github-auth --template=cloudflare/ai/demos/remote-mcp-github-oauth
Now, you have the MCP server setup, with dependencies installed. Move into that project folder:
cd my-mcp-server-github-auth
You'll notice that in the example MCP server, if you open src/index.ts, the primary difference is that the defaultHandler is set to the GitHubHandler:
import GitHubHandler from "./github-handler";
export default new OAuthProvider({
apiRoute: "/mcp",
apiHandler: MyMCP.serve("/mcp"),
defaultHandler: GitHubHandler,
authorizeEndpoint: "/authorize",
tokenEndpoint: "/token",
clientRegistrationEndpoint: "/register",
});
This ensures that your users are redirected to GitHub to authenticate. To get this working though, you need to create OAuth client apps in the steps below.
Step 2 — Create an OAuth App
You'll need to create two GitHub OAuth Apps ↗︎ to use GitHub as an authentication provider for your MCP server — one for local development, and one for production.
Step 2.1 — Create a new OAuth App for local development
- Navigate to github.com/settings/developers ↗︎ to create a new OAuth App with the following settings:
- Application name:
My MCP Server (local) - Homepage URL:
http://localhost:8788 - Authorization callback URL:
http://localhost:8788/callback - For the OAuth app you just created, add the client ID of the OAuth app as
GITHUB_CLIENT_IDand generate a client secret, adding it asGITHUB_CLIENT_SECRETto a.envfile in the root of your project, which will be used to set secrets in local development.
touch .env
echo 'GITHUB_CLIENT_ID="your-client-id"' >> .env
echo 'GITHUB_CLIENT_SECRET="your-client-secret"' >> .env
cat .env
```
3. Run the following command to start the development server:
```sh
npm start
```
Your MCP server is now running on `http://localhost:8788/mcp`.
4. In a new terminal, run the [MCP inspector ↗︎](https://github.com/modelcontextprotocol/inspector). The MCP inspector is an interactive MCP client that allows you to connect to your MCP server and invoke tools from a web browser.
```sh
npx @modelcontextprotocol/inspector@latest
```
5. Open the MCP inspector in your web browser:
```sh
open http://localhost:5173
```
6. In the inspector, enter the URL of your MCP server, `http://localhost:8788/mcp`
7. In the main panel on the right, click the **OAuth Settings** button and then click **Quick OAuth Flow**.
You should be redirected to a GitHub login or authorization page. After authorizing the MCP Client (the inspector) access to your GitHub account, you will be redirected back to the inspector.
8. Click **Connect** in the sidebar and you should see the "List Tools" button, which will list the tools that your MCP server exposes.
#### Step 2.2 — Create a new OAuth App for production
You'll need to repeat [Step 2.1](#step-21--create-a-new-oauth-app-for-local-development) to create a new OAuth App for production.
1. Navigate to [github.com/settings/developers ↗︎](https://github.com/settings/developers) to create a new OAuth App with the following settings:
- **Application name**: `My MCP Server (production)`
- **Homepage URL**: Enter the workers.dev URL of your deployed MCP server (ex: `worker-name.account-name.workers.dev`)
- **Authorization callback URL**: Enter the `/callback` path of the workers.dev URL of your deployed MCP server (ex: `worker-name.account-name.workers.dev/callback`)
2. For the OAuth app you just created, add the client ID and client secret, using Wrangler CLI:
```sh
npx wrangler secret put GITHUB_CLIENT_ID
npx wrangler secret put GITHUB_CLIENT_SECRET
npx wrangler secret put COOKIE_ENCRYPTION_KEY
Use any random string for COOKIE_ENCRYPTION_KEY, for example the output of openssl rand -hex 32.
Caution
When you create the first secret, Wrangler will ask if you want to create a new Worker. Submit "Y" to create a new Worker and save the secret.
- Set up a KV namespace
a. Create the KV namespace:
npx wrangler kv namespace create "OAUTH_KV"
```
b. Update the `wrangler.jsonc` file with the resulting KV ID:
```json
{
"kvNamespaces": [
{
"binding": "OAUTH_KV",
"id": "<YOUR_KV_NAMESPACE_ID>"
}
]
}
```
4. Deploy the MCP server to your Cloudflare `workers.dev` domain:
```bash
npm run deploy
```
5. Connect to your server running at `worker-name.account-name.workers.dev/mcp` using the [AI Playground ↗︎](https://playground.ai.cloudflare.com/), MCP Inspector, or [other MCP clients](https://developers.cloudflare.com/agents/model-context-protocol/guides/test-remote-mcp-server/), and authenticate with GitHub.
## Next steps
### [MCP Tools](https://developers.cloudflare.com/agents/model-context-protocol/protocol/tools/)
Add tools to your MCP server.
### [Authorization](https://developers.cloudflare.com/agents/model-context-protocol/protocol/authorization/)
Customize authentication and authorization.
Was this helpful?
YesNo
## On this page
[Docs](https://developers.cloudflare.com/)
```json
{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/#page","headline":"Build a Remote MCP server","description":"Deploy a remote MCP server on Cloudflare with optional authentication using Streamable HTTP transport.","url":"https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/","inLanguage":"en","image":"https://developers.cloudflare.com/agents/model-context-protocol/guides/remote-mcp-server/og.png?v=ef0a334079cbdee6","dateModified":"2026-10-22","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["MCP"]}
description: Secure your MCP servers with OAuth 2.1, token validation, and scope-based access control on Cloudflare. title: Securing MCP servers image: https://developers.cloudflare.com/agents/model-context-protocol/guides/securing-mcp-server/og.png?v=7c3d8ab0b42c246c
Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/agents/llms.txt
Use this file to discover all available pages before exploring further.
