addLABSCO SUMMARY
A template, and honest that Google is just the example.
What you are adopting is the shape: a Worker that is an OAuth server downstream and an OAuth client upstream, with tokens held in KV and analytics attached automatically. Swap Google for another provider and the structure holds. The analytics are the part you would otherwise build badly — parameters and results are sanitized before they are recorded, so the tracking does not become the leak. Expect to replace the demo tool with your own; it exists to prove the flow works.
What it is
A reference implementation you deploy to your own Cloudflare account. It runs on Cloudflare Workers and plays both sides of OAuth — an OAuth server to your MCP clients, and an OAuth client to Google — while recording usage through the mcp-analytics SDK. The point is the pattern, which you then build your own tools on.
What you get
- A remote MCP server with Google sign-in, so users authenticate with their own accounts rather than a shared key
- Automatic analytics on every call: execution time, success or failure, input parameters with sensitive data redacted, sanitized tool results, full error detail, user identity from the OAuth props, and session grouping
- Domain restriction, so access can be limited to one Google Workspace domain rather than every Google account
- Persistent state through Durable Objects, with authentication context available to tools and the option to vary which tools a user sees based on identity
- A working example tool to prove the loop end to end before you replace it with your own
Requirements
A Cloudflare account and a Google Cloud OAuth app whose homepage and callback URLs match your Worker subdomain. Secrets set through Wrangler: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, COOKIE_ENCRYPTION_KEY (any random string), MCP_ANALYTICS_API_KEY from mcpanalytics.dev, and optionally HOSTED_DOMAIN to restrict which Google domain may sign in. A KV namespace named OAUTH_KV created with Wrangler and wired into the config. Then npm install and wrangler deploy. Local development needs a second OAuth app pointing at http://localhost:8788 and a .dev.vars file. Clients connect at the /sse endpoint; Claude Desktop reaches it through mcp-remote.
Setup effort
Build from source — git clone https://github.com/bighadj22/cloudflare-mcp-google-oauth-analytics.git
USE CASES
01
Standing up a remote MCP server your team signs into
Deploy the Worker with your Google OAuth app so each user authenticates as themselves instead of sharing a key.
02
Restricting access to your organisation
Set the hosted-domain secret so only Google accounts on that domain can complete the sign-in.
03
Finding out which tools actually get used
Read the dashboard for execution times, success rates and per-user session patterns rather than guessing.
04
Using it as the base for your own server
Keep the OAuth and analytics wiring, replace the example tool with the ones you need, and redeploy.
1 tool
Listed in project docs. Your client may show a different list.
BEFORE YOU INSTALL
What to know first
Tools you get
1 tool named in the project's documentation.
Requires
- A Cloudflare account and Wrangler: you deploy this Worker yourself with wrangler deploy
- GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from your own Google Cloud OAuth app (callback https://mcp-analytics-google-oauth.<your-subdomain>.workers.dev/callback), set on the Worker with wrangler secret put
- MCP_ANALYTICS_API_KEY, your API key from mcpanalytics.dev, set with wrangler secret put
- COOKIE_ENCRYPTION_KEY: any random string (e.g. openssl rand -hex 32), set with wrangler secret put
- A KV namespace named OAUTH_KV (wrangler kv namespace create OAUTH_KV), its ID added to the Wrangler file
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
Clone the repository and install dependencies:
TERMINAL
git clone https://github.com/bighadj22/cloudflare-mcp-google-oauth-analytics.git
cd cloudflare-mcp-google-oauth-analytics
npm installCreate a Google Cloud OAuth app. Its Homepage URL is your Worker address, https://mcp-analytics-google-oauth.<YOUR_SUBDOMAIN>.workers.dev (the Worker is named mcp-analytics-google-oauth in wrangler.jsonc), and its Authorization callback URL is the same address followed by /callback. Note the Client ID and generate a Client secret.
Set the Worker secrets with Wrangler (COOKIE_ENCRYPTION_KEY is any random string, e.g. from openssl rand -hex 32; HOSTED_DOMAIN is optional and restricts sign-in to one Google Workspace domain; MCP_ANALYTICS_API_KEY comes from mcpanalytics.dev):
TERMINAL
npx wrangler secret put GOOGLE_CLIENT_ID
npx wrangler secret put GOOGLE_CLIENT_SECRET
npx wrangler secret put COOKIE_ENCRYPTION_KEY
npx wrangler secret put MCP_ANALYTICS_API_KEYCreate the KV namespace; the "id" of the OAUTH_KV entry under kv_namespaces in wrangler.jsonc is the ID it returns:
TERMINAL
npx wrangler kv namespace create OAUTH_KVDeploy the Worker:
TERMINAL
npx wrangler deployAdd the configuration from the client tabs, using the /sse address of your deployed Worker, and restart the client. A browser window opens the Google sign-in; complete it to grant access.
MCP Clients
Claude Desktop, Windsurf
JSON
{
"mcpServers": {
"math": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp-analytics-google-oauth.<YOUR_SUBDOMAIN>.workers.dev/sse"
]
}
}
}These are secrets for the Worker you deploy, not client settings: the README sets them with wrangler secret put GOOGLE_CLIENT_ID, wrangler secret put GOOGLE_CLIENT_SECRET and wrangler secret put MCP_ANALYTICS_API_KEY (with COOKIE_ENCRYPTION_KEY) before wrangler deploy. For local development they go in a .dev.vars file in the project root.
MCP Playground
MCP PLAYGROUND · URL
https://mcp-analytics-google-oauth.<YOUR_SUBDOMAIN>.workers.dev/sseThese are secrets for the Worker you deploy, not client settings: the README sets them with wrangler secret put GOOGLE_CLIENT_ID, wrangler secret put GOOGLE_CLIENT_SECRET and wrangler secret put MCP_ANALYTICS_API_KEY (with COOKIE_ENCRYPTION_KEY) before wrangler deploy. For local development they go in a .dev.vars file in the project root.
