Labsco
MCP SERVER

MCP Server with Google OAuth & Analytics

by bighadj22 ↗

A deployable remote MCP server: users sign in with Google, and every tool call is tracked with timing, parameters, results and errors.

Summary
A template, and honest that Google is just the example.

What you are adopting is the shape: a Worker that is an OAuth server downstream and an OAuth client upstream, with tokens held in KV and analytics attached automatically. Swap Google for another provider and the structure holds. The analytics are the part you would otherwise build badly — parameters and results are sanitized before they are recorded, so the tracking does not become the leak. Expect to replace the demo tool with your own; it exists to prove the flow works.

What it is

A reference implementation you deploy to your own Cloudflare account. It runs on Cloudflare Workers and plays both sides of OAuth — an OAuth server to your MCP clients, and an OAuth client to Google — while recording usage through the mcp-analytics SDK. The point is the pattern, which you then build your own tools on.

What you get
  • A remote MCP server with Google sign-in, so users authenticate with their own accounts rather than a shared key
  • Automatic analytics on every call: execution time, success or failure, input parameters with sensitive data redacted, sanitized tool results, full error detail, user identity from the OAuth props, and session grouping
  • Domain restriction, so access can be limited to one Google Workspace domain rather than every Google account
  • Persistent state through Durable Objects, with authentication context available to tools and the option to vary which tools a user sees based on identity
  • A working example tool to prove the loop end to end before you replace it with your own
Requirements

A Cloudflare account and a Google Cloud OAuth app whose homepage and callback URLs match your Worker subdomain. Secrets set through Wrangler: `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `COOKIE_ENCRYPTION_KEY` (any random string), `MCP_ANALYTICS_API_KEY` from mcpanalytics.dev, and optionally `HOSTED_DOMAIN` to restrict which Google domain may sign in. A KV namespace named `OAUTH_KV` created with Wrangler and wired into the config. Then `npm install` and `wrangler deploy`. Local development needs a second OAuth app pointing at http://localhost:8788 and a `.dev.vars` file. Clients connect at the /sse endpoint; Claude Desktop reaches it through `mcp-remote`.

Setup effort

One command plus a key — npm install, then supply credentials