addLABSCO SUMMARY
The plumbing for a multi-user MCP server, already assembled.
The value is not the two demo tools — it is that OAuth, per-user tool gating and call-level analytics are already wired together on a platform that costs nothing to start. What you replace is the tool bodies; what you keep is the part that is tedious to build twice.
What it is
A starting point for running your own remote MCP server rather than a server with a domain of its own. It ships GitHub OAuth on Cloudflare Workers, an allowlist that decides which signed-in users see which tools, and automatic tracking of tool calls, execution times, failures and user sessions through MCP Analytics.
What you get
add— a math tool available to every signed-in user, there to prove the connection and the auth flow work end to endgenerateImage— image generation with Cloudflare's Flux model, taking apromptand astepsquality setting, and restricted to the GitHub usernames you list- A GitHub OAuth 2.1 flow with state stored in Cloudflare KV, so users connect by signing in rather than by pasting a key
- Automatic analytics on every call: which tool, how long, whether it succeeded, which user, and full error context
Requirements
Your own Cloudflare account and a GitHub OAuth app. Set GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET and a COOKIE_ENCRYPTION_KEY as Wrangler secrets, plus MCP_ANALYTICS_API_KEY from an mcpanalytics.dev project, and create an OAUTH_KV namespace. Access control is a code change: edit ALLOWED_USERNAMES before deploying. wrangler deploy publishes it; clients connect through mcp-remote to your Worker's SSE URL, and wrangler dev serves the same thing locally on port 8788.
Setup effort
Build from source — git clone https://github.com/bighadj22/mcp-analytics-github-oauth.git
USE CASES
01
Standing up a server your team signs into
Deploy to your own Worker and let colleagues connect with their GitHub accounts instead of sharing a key.
02
Restricting an expensive tool to a few people
Keep the costly call behind a username allowlist while everyone else still gets the open tools.
03
Finding out which of your tools is actually used
Read the tracked call counts, durations and failure rates per tool rather than guessing from anecdotes.
2 tools
Listed in project docs. Your client may show a different list.
generateImageBEFORE YOU INSTALL
What to know first
Tools you get
2 tools named in the project's documentation.
Requires
- A Cloudflare account and Wrangler: you deploy this Worker yourself with wrangler deploy
- npx on PATH
- GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET from your own GitHub OAuth App (callback https://your-worker-name.your-subdomain.workers.dev/callback), set on the Worker with wrangler secret put
- MCP_ANALYTICS_API_KEY: sign up at mcpanalytics.dev, create a project and copy its API key, then set it with wrangler secret put
- COOKIE_ENCRYPTION_KEY: a random string (openssl rand -hex 32), set with wrangler secret put
- A KV namespace named OAUTH_KV (npx wrangler kv namespace create OAUTH_KV), its ID replacing "add-id-here" under kv_namespaces in wrangler.jsonc
- Your GitHub username in ALLOWED_USERNAMES in the source, or nobody can use generateImage
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
Clone the repository and install dependencies:
TERMINAL
git clone https://github.com/bighadj22/mcp-analytics-github-oauth.git
cd mcp-analytics-github-oauth
npm installSign up at mcpanalytics.dev, create a project and copy its API key.
Create a GitHub OAuth App. Its Homepage URL is your Worker address, https://mcp-analytics-github-oauth.<YOUR_SUBDOMAIN>.workers.dev (the Worker is named mcp-analytics-github-oauth in wrangler.jsonc), and its Authorization callback URL is the same address followed by /callback. Note the Client ID and generate a Client secret.
Set the Worker secrets with Wrangler (COOKIE_ENCRYPTION_KEY is a random string, e.g. from openssl rand -hex 32):
TERMINAL
npx wrangler secret put MCP_ANALYTICS_API_KEY
npx wrangler secret put GITHUB_CLIENT_ID
npx wrangler secret put GITHUB_CLIENT_SECRET
npx wrangler secret put COOKIE_ENCRYPTION_KEYCreate the KV namespace; the "id" of the OAUTH_KV entry under kv_namespaces in wrangler.jsonc is the ID it returns:
TERMINAL
npx wrangler kv namespace create OAUTH_KVAdd the GitHub usernames allowed to use generateImage to ALLOWED_USERNAMES in src/index.ts (it ships empty, so nobody gets that tool until you do).
Deploy the Worker:
TERMINAL
npx wrangler deployAdd the configuration from the client tabs — the address is your Worker URL followed by /sse — restart the client and complete the GitHub sign-in.
MCP Clients
Claude Desktop, Windsurf
JSON
{
"mcpServers": {
"github-mcp": {
"command": "npx",
"args": [
"mcp-remote",
"https://<YOUR_WORKER_NAME>.<YOUR_SUBDOMAIN>.workers.dev/sse"
]
}
}
}These are secrets for the Worker you deploy, not client settings: the README sets MCP_ANALYTICS_API_KEY, GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET (with COOKIE_ENCRYPTION_KEY) with wrangler secret put before wrangler deploy. For local development they go in a .dev.vars file.
