The value is not the two demo tools — it is that OAuth, per-user tool gating and call-level analytics are already wired together on a platform that costs nothing to start. What you replace is the tool bodies; what you keep is the part that is tedious to build twice.
A starting point for running your own remote MCP server rather than a server with a domain of its own. It ships GitHub OAuth on Cloudflare Workers, an allowlist that decides which signed-in users see which tools, and automatic tracking of tool calls, execution times, failures and user sessions through MCP Analytics.
- `add` — a math tool available to every signed-in user, there to prove the connection and the auth flow work end to end
- `generateImage` — image generation with Cloudflare's Flux model, taking a `prompt` and a `steps` quality setting, and restricted to the GitHub usernames you list
- A GitHub OAuth 2.1 flow with state stored in Cloudflare KV, so users connect by signing in rather than by pasting a key
- Automatic analytics on every call: which tool, how long, whether it succeeded, which user, and full error context
Your own Cloudflare account and a GitHub OAuth app. Set `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET` and a `COOKIE_ENCRYPTION_KEY` as Wrangler secrets, plus `MCP_ANALYTICS_API_KEY` from an mcpanalytics.dev project, and create an `OAUTH_KV` namespace. Access control is a code change: edit `ALLOWED_USERNAMES` before deploying. `wrangler deploy` publishes it; clients connect through `mcp-remote` to your Worker's SSE URL, and `wrangler dev` serves the same thing locally on port 8788.
One command plus a key — npx mcp-remote https://your-worker-name.your-subdomain.workers.dev/sse, then supply credentials