Update cloudflare oauth handler (#243)

Maximo-Guk · web-flow · commit 847fc1f9de91 · 2025-10-31T19:45:31.000-05:00
* Adding recommended security features

* Add workers-oauth-utils

* Add MCP_COOKIE_ENCRYPTION_KEY to Env context

* Update cloudflare-oauth-handler
diff --git a/.changeset/public-dragons-fry.md b/.changeset/public-dragons-fry.md
@@ -0,0 +1,24 @@
+---
+'workers-observability': patch
+'@repo/mcp-observability': patch
+'cloudflare-casb-mcp-server': patch
+'cloudflare-browser-mcp-server': patch
+'containers-mcp': patch
+'workers-bindings': patch
+'docs-vectorize': patch
+'workers-builds': patch
+'@repo/eval-tools': patch
+'@repo/mcp-common': patch
+'dns-analytics': patch
+'dex-analysis': patch
+'docs-autorag': patch
+'cloudflare-ai-gateway-mcp-server': patch
+'auditlogs': patch
+'demo-day': patch
+'cloudflare-autorag-mcp-server': patch
+'graphql-mcp-server': patch
+'logpush': patch
+'cloudflare-radar-mcp-server': patch
+---
+
+Update cloudflare-oauth-handler
diff --git a/apps/ai-gateway/package.json b/apps/ai-gateway/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/ai-gateway/src/ai-gateway.context.ts b/apps/ai-gateway/src/ai-gateway.context.ts
@@ -3,6 +3,7 @@ import type { AIGatewayMCP } from './ai-gateway.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/auditlogs/package.json b/apps/auditlogs/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/auditlogs/src/auditlogs.context.ts b/apps/auditlogs/src/auditlogs.context.ts
@@ -3,6 +3,7 @@ import type { AuditlogMCP } from './auditlogs.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/autorag/package.json b/apps/autorag/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/autorag/src/autorag.context.ts b/apps/autorag/src/autorag.context.ts
@@ -3,6 +3,7 @@ import type { AutoRAGMCP } from './autorag.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/browser-rendering/package.json b/apps/browser-rendering/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/browser-rendering/src/browser.context.ts b/apps/browser-rendering/src/browser.context.ts
@@ -3,6 +3,7 @@ import type { BrowserMCP } from './browser.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/cloudflare-one-casb/package.json b/apps/cloudflare-one-casb/package.json
@@ -12,11 +12,11 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/demo-day/package.json b/apps/demo-day/package.json
@@ -11,10 +11,10 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"zod": "3.24.2"
 	},
 	"devDependencies": {
diff --git a/apps/dex-analysis/package.json b/apps/dex-analysis/package.json
@@ -13,12 +13,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"jszip": "3.10.1",
diff --git a/apps/dex-analysis/src/dex-analysis.context.ts b/apps/dex-analysis/src/dex-analysis.context.ts
@@ -4,6 +4,7 @@ import type { WarpDiagReader } from './warp_diag_reader'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/dns-analytics/package.json b/apps/dns-analytics/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/dns-analytics/src/dns-analytics.context.ts b/apps/dns-analytics/src/dns-analytics.context.ts
@@ -3,6 +3,7 @@ import type { DNSAnalyticsMCP } from './dns-analytics.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/docs-autorag/package.json b/apps/docs-autorag/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"mime": "4.0.6",
diff --git a/apps/docs-vectorize/package.json b/apps/docs-vectorize/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"mime": "4.0.6",
diff --git a/apps/graphql/package.json b/apps/graphql/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2",
diff --git a/apps/graphql/src/graphql.context.ts b/apps/graphql/src/graphql.context.ts
@@ -2,6 +2,7 @@ import type { GraphQLMCP, UserDetails } from './graphql.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/logpush/package.json b/apps/logpush/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/logpush/src/logpush.context.ts b/apps/logpush/src/logpush.context.ts
@@ -3,6 +3,7 @@ import type { LogsMCP } from './logpush.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/radar/package.json b/apps/radar/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/radar/src/radar.context.ts b/apps/radar/src/radar.context.ts
@@ -2,6 +2,7 @@ import type { RadarMCP, UserDetails } from './radar.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/sandbox-container/package.json b/apps/sandbox-container/package.json
@@ -19,15 +19,15 @@
 		"eval:ci": "start-server-and-test --expect 404 eval:server http://localhost:8976 'vitest run --testTimeout=60000 --config vitest.config.evals.ts'"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/node-server": "1.13.8",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@n8n/json-schema-to-zod": "1.1.0",
 		"@repo/eval-tools": "workspace:*",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cron-schedule": "5.0.4",
 		"esbuild": "0.25.1",
 		"hono": "4.7.6",
diff --git a/apps/sandbox-container/server/sandbox.server.context.ts b/apps/sandbox-container/server/sandbox.server.context.ts
@@ -2,6 +2,7 @@ import type { ContainerManager, ContainerMcpAgent, UserContainer } from './sandb
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	CLOUDFLARE_CLIENT_ID: string
 	CLOUDFLARE_CLIENT_SECRET: string
 	ENVIRONMENT: 'dev'
diff --git a/apps/workers-bindings/package.json b/apps/workers-bindings/package.json
@@ -25,13 +25,13 @@
 		"wrangler": "4.10.0"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@n8n/json-schema-to-zod": "1.1.0",
 		"@repo/eval-tools": "workspace:*",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"ai": "4.3.10",
 		"concurrently": "9.1.2",
 		"hono": "4.7.6",
diff --git a/apps/workers-bindings/src/bindings.context.ts b/apps/workers-bindings/src/bindings.context.ts
@@ -3,6 +3,7 @@ import type { WorkersBindingsMCP } from './bindings.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production' | 'test'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/workers-builds/package.json b/apps/workers-builds/package.json
@@ -12,12 +12,12 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"zod": "3.24.2"
diff --git a/apps/workers-builds/src/workers-builds.context.ts b/apps/workers-builds/src/workers-builds.context.ts
@@ -3,6 +3,7 @@ import type { BuildsMCP } from './workers-builds.app'
 
 export interface Env {
 	OAUTH_KV: KVNamespace
+	MCP_COOKIE_ENCRYPTION_KEY: string
 	ENVIRONMENT: 'development' | 'staging' | 'production'
 	MCP_SERVER_NAME: string
 	MCP_SERVER_VERSION: string
diff --git a/apps/workers-observability/package.json b/apps/workers-observability/package.json
@@ -12,13 +12,13 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@cloudflare/workers-oauth-provider": "0.0.5",
+		"@cloudflare/workers-oauth-provider": "0.0.13",
 		"@fast-csv/format": "5.0.2",
 		"@hono/zod-validator": "0.4.3",
-		"@modelcontextprotocol/sdk": "1.18.2",
+		"@modelcontextprotocol/sdk": "1.20.2",
 		"@repo/mcp-common": "workspace:*",
 		"@repo/mcp-observability": "workspace:*",
-		"agents": "0.2.7",
+		"agents": "0.2.19",
 		"cloudflare": "4.2.0",
 		"hono": "4.7.6",
 		"workers-tagged-logger": "0.13.5",
diff --git a/apps/workers-observability/src/workers-observability.context.ts b/apps/workers-observability/src/workers-observability.context.ts
diff --git a/packages/eval-tools/package.json b/packages/eval-tools/package.json
diff --git a/packages/mcp-common/package.json b/packages/mcp-common/package.json
diff --git a/packages/mcp-common/src/cloudflare-oauth-handler.ts b/packages/mcp-common/src/cloudflare-oauth-handler.ts
diff --git a/packages/mcp-common/src/workers-oauth-utils.ts b/packages/mcp-common/src/workers-oauth-utils.ts
diff --git a/packages/mcp-observability/package.json b/packages/mcp-observability/package.json
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
