userInfoLABSCO SUMMARY
The interesting part is what the user cannot see.
Most auth samples stop at logging the user in. This one carries roles from Asgardeo into tool listing, so a user without the manager role never sees the reportees tool at all — a cleaner failure mode than an authorised call that returns an error. Two setup steps catch people out: the callback URL has to be added to the Asgardeo application twice, once for http://localhost:8788/callback and again for the deployed Worker URL, and Cursor needs mcp-remote in front because it does not do MCP authentication itself.
What it is
A working sample of an authenticated remote MCP server. It runs on Cloudflare Workers and sits between two OAuth roles at once: an OAuth server to your MCP clients, and an OAuth/OIDC client to your Asgardeo organization.
What you get
- Login before tool use: connecting a client redirects the user to Asgardeo and back
- Role-scoped tool visibility — every authenticated user gets
userInfo, whilegetDirectReporteesappears only for users holding themanagerrole, and stays invisible to everyone else - A deployable path end to end:
npm run devlocally onhttp://localhost:8788, thennpx wrangler@latest deployto a workers.dev URL - SSE transport, testable from the MCP Inspector or the Cloudflare Workers AI LLM Playground
Requirements
An Asgardeo account and a Cloudflare account, plus Node.js version 18.x or higher. In Asgardeo, register a Traditional Web Application over OpenID Connect and note the client id, the client secret and your organization name. Locally these go in a .dev.vars file as ASGARDEO_CLIENT_ID, ASGARDEO_CLIENT_SECRET, ASGARDEO_BASE_URL and ASGARDEO_SCOPE; for deployment they are set as Wrangler secrets along with a COOKIE_ENCRYPTION_KEY. You also create a KV namespace bound as OAUTH_KV and paste its id into wrangler.jsonc.
Setup effort
Build from source
USE CASES
01
Putting a login in front of a remote MCP server
Have clients authenticate with your identity provider before any tool is callable.
02
Showing different tools to different people
Gate a tool behind a role so it never appears for users who should not have it.
03
Starting your own authenticated Worker
Clone a deployment that already wires OAuth, KV storage and secrets together, and replace the tools.
2 tools
Listed in project docs. Your client may show a different list.
getDirectReporteesBEFORE YOU INSTALL
What to know first
Tools you get
2 tools named in the project's documentation.
Requires
- Node.js 18.x or higher
- An Asgardeo account
- A Cloudflare account
INSTALLATION
Connect your client
Server setup
In the Asgardeo console open Applications > New Application, choose Traditional Web Application over OpenID Connect, name it CloudflareMCPServer and set the authorized redirect URL to http://localhost:8788/callback; note the client-id and client-secret from the Protocol tab, and your Asgardeo organization name
Clone the repository and install dependencies: git clone https://github.com/sagara-gunathunga/cloudflare-mcp-asgardeo && cd cloudflare-mcp-asgardeo/demo-mcp-server && npm install
Create the KV namespace:
TERMINAL
npx wrangler kv namespace create OAUTH_KVPut the id that command prints into the OAUTH_KV entry under kv_namespaces in wrangler.jsonc
Set the Worker secrets — the client-id and client-secret from Asgardeo, ASGARDEO_BASE_URL as https://api.asgardeo.io/t/ followed by your organization name, ASGARDEO_SCOPE as openid profile email roles, and any random string for COOKIE_ENCRYPTION_KEY: npx wrangler@latest secret put ASGARDEO_CLIENT_ID && npx wrangler@latest secret put ASGARDEO_CLIENT_SECRET && npx wrangler@latest secret put ASGARDEO_BASE_URL && npx wrangler@latest secret put ASGARDEO_SCOPE && npx wrangler@latest secret put COOKIE_ENCRYPTION_KEY
Deploy the Worker and note the URL it prints:
TERMINAL
npx wrangler@latest deployIn the Asgardeo console add https://remote-mcp-asgardeo.<YOUR_SUBDOMAIN>.workers.dev/callback to the application's Authorized redirect URLs (Protocol tab)
Add the server to your client with the connection URL https://remote-mcp-asgardeo.<YOUR_SUBDOMAIN>.workers.dev/sse; a browser window opens for the Asgardeo login
MCP Clients
Claude Desktop, Windsurf
JSON
{
"mcpServers": {
"asgardeo": {
"command": "npx",
"args": [
"mcp-remote",
"https://remote-mcp-asgardeo.<YOUR_SUBDOMAIN>.workers.dev/sse"
]
}
}
}
