Pluts MCP

An OAuth-protected MCP server for Pluts on Cloudflare Workers.

Each tool takes a short ledgerKey, such as personal or business. The Worker hashes that key together with the verified Cloudflare Access subject, so the same key for two people always reaches different Durable Objects.

Setup

1. Create a Cloudflare KV namespace and replace OAUTH_KV.id in wrangler.jsonc with its ID.
2. Create a Cloudflare Access application for only /authorize. Configure its Application Audience (AUD) and team domain in ACCESS_AUD and ACCESS_TEAM_DOMAIN. Do not protect /mcp with Access: MCP clients must reach it first to begin its OAuth flow.
3. Use a real custom domain before production. The __Host- consent cookie requires HTTPS.
4. Run npm run cf-typegen, npm test, and npm run deploy.

The MCP endpoint is /mcp. It supports OAuth scopes ledger.read and ledger.write. The authorization endpoint verifies the Cloudflare Access JWT, then the OAuth provider issues a separate opaque token to the MCP client.

Never use the placeholder KV ID or Access variables from wrangler.jsonc in a deployment.