[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

cloudflare-ai-gateway-mcp-server@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

auditlogs@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

cloudflare-autorag-mcp-server@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

cloudflare-browser-mcp-server@0.5.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

cloudflare-blog@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

cloudflare-casb-mcp-server@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

demo-day@0.2.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

dex-analysis@0.6.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

dns-analytics@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

docs-ai-search@0.5.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

graphql-mcp-server@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

logpush@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

cloudflare-radar-mcp-server@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

containers-mcp@0.4.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

stack-mcp@0.2.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

workers-bindings@0.6.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

workers-builds@0.3.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

workers-observability@0.6.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
  • @repo/mcp-common@0.21.0

@repo/mcp-common@0.21.0

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

  • Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
  • The OAuth protected resource is now <origin>/mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
  • The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
  • Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
  • Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
  • Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.