cloudflare/mcp-server-cloudflare dns-analytics@0.3.0

dns-analytics@0.3.0

Repository: cloudflare/mcp-server-cloudflare

Tag: dns-analytics@0.3.0

Published: 2026-10-22T15:22:08Z

Prerelease: no

Release notes:

Minor Changes

• dfd49e5: Retire the /sse URL and upgrade to @cloudflare/workers-oauth-provider 1.2.4.

• Every request to /sse now returns 410 Gone with an application/problem+json body naming the server's /mcp URL, before any authentication. /sse used to serve Streamable HTTP as an alias of /mcp; clients configured with it must switch to /mcp. MCP SDK v1 and v2 clients show the message in their connection error. It is not a redirect, because OAuth clients that follow one reject the /mcp protected resource metadata with an error that never mentions /mcp.
• The OAuth protected resource is now /mcp, and every token is bound to it. Grants bound to /mcp keep working. Grants bound to /sse, or to the bare origin that 0.x advertised at the root metadata URL, fail their next refresh with invalid_grant (workers-oauth-provider 1.2.4), and the client signs in again at /mcp.
• The consent page uses the provider's consent helpers. The authorization request stays server-side and the page posts only a single-use handle bound to the browser. Cancel now sends access_denied back to the MCP client. The page shows the redirect URI, the publishing domain of a Client ID Metadata Document client, and a warning when the tokens go to a local app.
• Cloudflare sign-in uses beginUpstream() / finishUpstream() in place of the hand-rolled KV state and session cookie. Two tabs can authorize at once, and declining at Cloudflare sends access_denied back to the MCP client.
• Remembered consent uses isConsentRemembered(). Approvals made before this change aren't carried over, so each browser sees the consent page once more.
• Direct Cloudflare API tokens are validated for the /mcp resource.

Patch Changes

• 0702829: A direct Cloudflare credential that Cloudflare rejects as expired or unknown (403 9109: Invalid access token) now gets 401 invalid_token, as the MCP authorization spec requires for invalid or expired tokens. Before, it got 403 insufficient_scope, which sends clients through a scope step-up instead of re-authenticating. A valid token that lacks access still gets 403 insufficient_scope.
• Updated dependencies [0702829]
• Updated dependencies [dfd49e5]
• @repo/mcp-common@0.21.0