Naitei MCP — a private application board as an agent data surface

Naitei is a remote Model Context Protocol server for a single-user job-search board. It keeps application facts, stage history, raw context, and interview prep documents in Cloudflare D1 while leaving summarization and decision-making to the connected agent.

This repository is a sanitized, buildable portfolio snapshot. It contains no deployed hostname, Cloudflare account ID, D1/KV resource ID, OAuth key, database contents, or production route. The checked-in Wrangler identifiers are visibly inert placeholders.

What to inspect

• src/index.ts: OAuth-protected MCP routing with a pinned resource origin.
• src/auth.ts: validated dynamic-client metadata, hardened consent HTML, rate-limited owner authentication, constant-time secret comparison, and safe OAuth error redirects.
• src/mcp.ts: a fresh MCP server per request, actionable tool errors, one agent-facing resource, and ten typed tools.
• src/tools.ts: Zod input contracts, parameterized D1 access, explicit stage-history writes, and destructive-operation guards.
• migrations: relational constraints and cascades for applications, history, context, and prep documents.
• test: Workers-runtime integration tests for MCP, schema, CRUD tools, resources, and token revocation.

Architecture

MCP client
    │ OAuth 2.1
    ▼
Cloudflare OAuthProvider ── KV (grants and tokens)
    │ authenticated /mcp
    ▼
MCP tool/resource layer ─── D1 (application board)

The board is intentionally a data surface, not an autonomous recruiter: clients read APPLICATION_BOARD_GUIDE.md, preserve source text, and decide what to do in their own interaction with the user.

Verify locally

Requires Node.js 22+.

npm ci
npm run typecheck
npm test
npm run build

The integration suite supplies an isolated test owner key and local D1/KV bindings. This snapshot intentionally pins OAuth metadata to a non-routable example origin, so it does not offer a copy-paste interactive deployment path.

Deployment boundary

Do not deploy this repository as-is. A real deployment must privately replace the placeholder origin and bindings, create D1/KV resources, store OWNER_KEY with wrangler secret put, and generate fresh binding types. Production configuration belongs outside this public snapshot.

Use

The source is published for portfolio review. It is not an open-source grant; see LICENSE.