Cloudflare Workers MCP服务器与OAuth
用于Claude.ai自定义集成的模型上下文协议（MCP）服务器，在Cloudflare Workers上运行，具有GitHub OAuth身份验证。
演示（幻灯片）
特性
- ✅ Claude.ai自定义集成支持
- ✅ 完全符合MCP身份验证规范
- ✅ OAuth 2.0授权流（GitHub）
- ✅ OAuth客户端的动态客户端注册（DCR）
- ✅ OAuth 2.0受保护资源元数据（RFC 9728）
- ✅ KV存储的会话管理
- ✅ 基于权限的访问控制
- ✅ 用于用户信息、计算和GitHub存储库访问的MCP工具
建筑
graph TB
subgraph "Claude.ai Platform"
User[User]
Claude[Claude.ai]
MCP[MCP Client]
end
subgraph "Cloudflare Workers"
Worker[MCP OAuth Server]
KV[(KV Storage)]
subgraph "OAuth Endpoints"
Auth["/auth"]
Token["/token"]
Register["/register"]
Callback["/callback"]
end
subgraph "Well-Known Endpoints"
AuthMeta["/.well-known/oauth-authorization-server"]
ResourceMeta["/.well-known/oauth-protected-resource"]
end
subgraph "MCP Endpoints"
MCPHttp["/mcp"]
SSE["/sse"]
end
end
subgraph "External Services"
GitHub[GitHub OAuth API]
GitHubAPI[GitHub API]
end
User --> Claude
Claude --> MCP
MCP --> Worker
Worker --> Auth
Worker --> Token
Worker --> Register
Worker --> Callback
Worker --> AuthMeta
Worker --> ResourceMeta
Worker --> MCPHttp
Worker --> SSE
Worker --> KV
Worker --> GitHub
Worker --> GitHubAPI
Auth --> GitHub
Callback --> GitHub
GitHub --> Callback身份验证流序列
sequenceDiagram
participant User
participant Claude as Claude.ai
participant MCP as MCP Client
participant Worker as Cloudflare Worker
participant KV as KV Storage
participant GitHub as GitHub OAuth
User->>Claude: Start conversation with integration
Claude->>MCP: Initialize MCP connection
MCP->>Worker: GET /.well-known/oauth-protected-resource
Worker-->>MCP: Return resource metadata (RFC 9728)
MCP->>Worker: POST /register (Dynamic Client Registration)
Worker->>KV: Store client credentials
Worker-->>MCP: Return client_id & client_secret
Note over MCP: Generate PKCE code_verifier & code_challenge
MCP->>User: Request authorization
User->>Worker: GET /auth?client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256
Worker->>KV: Store state, redirect_uri & code_challenge
Worker->>User: Redirect to GitHub OAuth
User->>GitHub: Authorize application
GitHub->>Worker: GET /callback?code=...&state=...
Worker->>KV: Verify state
Worker->>GitHub: Exchange code for access token
GitHub-->>Worker: Return access token
Worker->>KV: Store session with auth context
Worker->>KV: Store authorization code with PKCE data
Worker->>User: Redirect with auth code
MCP->>Worker: POST /token (Exchange auth code + code_verifier)
Worker->>KV: Validate auth code & client
Worker->>Worker: Verify PKCE: SHA256(code_verifier) == code_challenge
Worker->>KV: Create MCP access token
Worker-->>MCP: Return access token
MCP->>Worker: POST /mcp (with Bearer token)
Worker->>KV: Validate access token
Worker->>KV: Get auth context
Worker-->>MCP: Return MCP response
MCP->>Claude: Provide tool results
Claude->>User: Display results设置
1.先决条件
- Cloudflare帐户
- GitHub账号
- Node.js 18+
- 牧马人CLI
2.设置Cloudflare Worker
登录Cloudflare（如果尚未登录）
npx wrangler auth login更新中的工作者姓名 wrangler.toml 如果需要的话
name = "your-mcp-server-name"3.创建GitHub OAuth应用程序
- 首选
- 创建新的OAuth应用程序：
- 应用程序名称: MCP Auth Demo - 你的家园: https://your-worker.workers.dev - 授权回调URL: https://your-worker.workers.dev/callback
- 保存客户端ID和客户端密码
4.创建Cloudflare KV命名空间
npx wrangler kv namespace create "OAUTH_KV"更新 wrangler.toml 使用生成的ID：
[[kv_namespaces]]
binding = "OAUTH_KV"
id = "your-kv-namespace-id"5.配置环境变量
使用Wrangler CLI设置以下机密：
# Set GitHub OAuth credentials
wrangler secret put GITHUB_CLIENT_ID
wrangler secret put GITHUB_CLIENT_SECRET
# Set cookie encryption key (generate a random string)
wrangler secret put COOKIE_ENCRYPTION_KEY
# Optional: Restrict access to specific GitHub usernames (comma-separated)
wrangler secret put ALLOWED_USERNAMES6.部署
# Install dependencies
npm install
# Deploy to Cloudflare Workers
npm run deployclaude.ai配置
添加自定义集成
- 登录Claude.ai（需要团队/企业计划）
- 前往“设置”>“集成”
- 点击“添加自定义集成”
- 输入以下信息：
- 名字：MCP认证演示 - MCP服务器URL: https://your-worker.workers.dev/mcp - OAuth授权URL: https://your-worker.workers.dev/auth - OAuth令牌URL: https://your-worker.workers.dev/token - 客户端注册URL: https://your-worker.workers.dev/register
用法
- 在Claude中开始新的对话
- 启用集成
- 出现提示时，向GitHub进行身份验证
- MCP工具可用
可用工具
1. get_user_info
检索经过身份验证的用户信息。
User: Show my user info
Claude: Using get_user_info tool...2. calculate
执行基本的算术计算。
User: Calculate 7 to the power of 8
Claude: Using calculate tool...3. get_github_repos
列出用户的GitHub存储库。
User: Show my GitHub repositories
Claude: Using get_github_repos tool...OAuth端点
众所周知的终点
/.well-known/oauth-authorization-server-OAuth 2.0授权服务器元数据/.well-known/oauth-protected-resource-OAuth 2.0受保护资源元数据（RFC 9728）
OAuth流端点
/auth-授权端点/callback-OAuth回调端点/token-令牌交换端点/register-动态客户端注册端点
MCP端点
/mcp-MCP请求的HTTP POST端点/sse-用于流式传输的服务器发送事件端点
发展
地方发展
# Start development server
npm run dev
# Generate TypeScript types
npm run cf-typegen测试
您可以使用Claude代码检查器测试MCP服务器：
- 启动检查器:
npx @modelcontextprotocol/inspector https://your-worker.workers.dev/mcp- 测试OAuth 2.0元数据端点:
- 访问 https://your-worker.workers.dev/.well-known/oauth-authorization-server - 访问 https://your-worker.workers.dev/.well-known/oauth-protected-resource - 验证RFC 9728合规性
- 测试动态客户端注册:
curl -X POST https://your-worker.workers.dev/register \
-H "Content-Type: application/json" \
-d '{
"client_name": "Test MCP Client",
"redirect_uris": ["urn:ietf:wg:oauth:2.0:oob"]
}'- 测试OAuth流 （使用检查器）：
- 检查器将自动处理OAuth流 - 按照GitHub身份验证提示进行操作 - 验证令牌交换是否成功
- 测试MCP工具:
经过身份验证后，在Inspector中测试可用工具：
- get_user_info -检索经过身份验证的用户信息 - calculate -执行算术运算 - get_github_repos -列出GitHub存储库
- 验证服务器运行状况:
curl https://your-worker.workers.dev/healthInspector为使用OAuth身份验证测试MCP服务器提供了一个全面的界面，可以轻松验证所有功能是否正常工作。
资源
许可证
MIT许可证