Cloudflare Workers

• [email protected] Latest Oct 22, 2026

  ### Minor Changes
  
  - dfd49e5: Retire the `/sse` URL and upgrade to `@cloudflare/workers-oauth-provider` 1.2.4.
  
    - Every request to `/sse` now returns `410 Gone` with an `application/problem+json` body naming the server's `/mcp` URL, before any authentication. `/sse` used to serve Streamable HTTP as an alias of `/mcp`; clients configured with it must switch to `/mcp`. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the `/mcp` protected resource metadata with an error that never mentions `/mcp`.
    - The OAuth protected resource is now `<origin>/mcp`, and every token is bound to it. Grants bound to `/mcp` keep working. Grants bound to `/sse`, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with `invalid_grant` (workers-oauth-provider 1.2.4), and the client signs in again at `/mcp`.
    - The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends `access_denied` back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
    - Cloudflare sign-in uses `beginUpstream()` / `finishUpstream()` in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends `access_denied` back to the MCP client.
    - Remembered consent uses `isConsentRemembered()`. Approvals made before this change aren't carried over, so each browser sees the consent page once more.
    - Direct Cloudflare API tokens are validated for the `/mcp` resource.
  
  ### Patch Changes
  
  - 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (`403 9109: Invalid access token`) now gets `401 invalid_token`, as the MCP authorization spec requires for invalid or expired tokens. Before, it got `403 insufficient_scope`, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets `403 insufficient_scope`.
  - Updated dependencies [0702829]
  - Updated dependencies [dfd49e5]
    - @repo/[email protected]

  View on GitHub ↗
• [email protected] Oct 22, 2026

  ### Minor Changes
  
  - dfd49e5: Retire the `/sse` URL and upgrade to `@cloudflare/workers-oauth-provider` 1.2.4.
  
    - Every request to `/sse` now returns `410 Gone` with an `application/problem+json` body naming the server's `/mcp` URL, before any authentication. `/sse` used to serve Streamable HTTP as an alias of `/mcp`; clients configured with it must switch to `/mcp`. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the `/mcp` protected resource metadata with an error that never mentions `/mcp`.
    - The OAuth protected resource is now `<origin>/mcp`, and every token is bound to it. Grants bound to `/mcp` keep working. Grants bound to `/sse`, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with `invalid_grant` (workers-oauth-provider 1.2.4), and the client signs in again at `/mcp`.
    - The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends `access_denied` back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
    - Cloudflare sign-in uses `beginUpstream()` / `finishUpstream()` in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends `access_denied` back to the MCP client.
    - Remembered consent uses `isConsentRemembered()`. Approvals made before this change aren't carried over, so each browser sees the consent page once more.
    - Direct Cloudflare API tokens are validated for the `/mcp` resource.
  
  ### Patch Changes
  
  - 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (`403 9109: Invalid access token`) now gets `401 invalid_token`, as the MCP authorization spec requires for invalid or expired tokens. Before, it got `403 insufficient_scope`, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets `403 insufficient_scope`.
  - Updated dependencies [0702829]
  - Updated dependencies [dfd49e5]
    - @repo/[email protected]

  View on GitHub ↗
• [email protected] Oct 22, 2026

  ### Minor Changes
  
  - dfd49e5: Retire the `/sse` URL and upgrade to `@cloudflare/workers-oauth-provider` 1.2.4.
  
    - Every request to `/sse` now returns `410 Gone` with an `application/problem+json` body naming the server's `/mcp` URL, before any authentication. `/sse` used to serve Streamable HTTP as an alias of `/mcp`; clients configured with it must switch to `/mcp`. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the `/mcp` protected resource metadata with an error that never mentions `/mcp`.
    - The OAuth protected resource is now `<origin>/mcp`, and every token is bound to it. Grants bound to `/mcp` keep working. Grants bound to `/sse`, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with `invalid_grant` (workers-oauth-provider 1.2.4), and the client signs in again at `/mcp`.
    - The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends `access_denied` back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
    - Cloudflare sign-in uses `beginUpstream()` / `finishUpstream()` in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends `access_denied` back to the MCP client.
    - Remembered consent uses `isConsentRemembered()`. Approvals made before this change aren't carried over, so each browser sees the consent page once more.
    - Direct Cloudflare API tokens are validated for the `/mcp` resource.
  
  ### Patch Changes
  
  - 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (`403 9109: Invalid access token`) now gets `401 invalid_token`, as the MCP authorization spec requires for invalid or expired tokens. Before, it got `403 insufficient_scope`, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets `403 insufficient_scope`.
  - Updated dependencies [0702829]
  - Updated dependencies [dfd49e5]
    - @repo/[email protected]

  View on GitHub ↗
• [email protected] Oct 22, 2026

  ### Minor Changes
  
  - dfd49e5: Retire the `/sse` URL and upgrade to `@cloudflare/workers-oauth-provider` 1.2.4.
  
    - Every request to `/sse` now returns `410 Gone` with an `application/problem+json` body naming the server's `/mcp` URL, before any authentication. `/sse` used to serve Streamable HTTP as an alias of `/mcp`; clients configured with it must switch to `/mcp`. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the `/mcp` protected resource metadata with an error that never mentions `/mcp`.
    - The OAuth protected resource is now `<origin>/mcp`, and every token is bound to it. Grants bound to `/mcp` keep working. Grants bound to `/sse`, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with `invalid_grant` (workers-oauth-provider 1.2.4), and the client signs in again at `/mcp`.
    - The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends `access_denied` back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
    - Cloudflare sign-in uses `beginUpstream()` / `finishUpstream()` in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends `access_denied` back to the MCP client.
    - Remembered consent uses `isConsentRemembered()`. Approvals made before this change aren't carried over, so each browser sees the consent page once more.
    - Direct Cloudflare API tokens are validated for the `/mcp` resource.
  
  ### Patch Changes
  
  - 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (`403 9109: Invalid access token`) now gets `401 invalid_token`, as the MCP authorization spec requires for invalid or expired tokens. Before, it got `403 insufficient_scope`, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets `403 insufficient_scope`.
  - Updated dependencies [0702829]
  - Updated dependencies [dfd49e5]
    - @repo/[email protected]

  View on GitHub ↗
• [email protected] Oct 22, 2026

  ### Minor Changes
  
  - dfd49e5: Retire the `/sse` URL and upgrade to `@cloudflare/workers-oauth-provider` 1.2.4.
  
    - Every request to `/sse` now returns `410 Gone` with an `application/problem+json` body naming the server's `/mcp` URL, before any authentication. `/sse` used to serve Streamable HTTP as an alias of `/mcp`; clients configured with it must switch to `/mcp`. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the `/mcp` protected resource metadata with an error that never mentions `/mcp`.
    - The OAuth protected resource is now `<origin>/mcp`, and every token is bound to it. Grants bound to `/mcp` keep working. Grants bound to `/sse`, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with `invalid_grant` (workers-oauth-provider 1.2.4), and the client signs in again at `/mcp`.
    - The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends `access_denied` back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
    - Cloudflare sign-in uses `beginUpstream()` / `finishUpstream()` in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends `access_denied` back to the MCP client.
    - Remembered consent uses `isConsentRemembered()`. Approvals made before this change aren't carried over, so each browser sees the consent page once more.
    - Direct Cloudflare API tokens are validated for the `/mcp` resource.
  
  ### Patch Changes
  
  - 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (`403 9109: Invalid access token`) now gets `401 invalid_token`, as the MCP authorization spec requires for invalid or expired tokens. Before, it got `403 insufficient_scope`, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets `403 insufficient_scope`.
  - Updated dependencies [0702829]
  - Updated dependencies [dfd49e5]
    - @repo/[email protected]

  View on GitHub ↗

No comments yet. Sign in to start the discussion.

More Dev tools servers

• GitHub

  Browse repositories, read code, search issues, create PRs, and manage workflows via the GitHub API.

• GitLab

  Read repositories, manage merge requests, and trigger pipelines via the GitLab API.

• Sentry

  Read Sentry issue details + stack traces so the model can debug errors with full context.