Web Engineering •
Configure Optional OAuth Scopes for MCP Servers and Agents
Configure optional OAuth scopes so users can narrow agent permissions at consent. The API call, the UX, and handling partial grants.
6 min read
Read more →Topic Hub
MCP
The Model Context Protocol turns a website from something agents scrape into something they can call. These articles cover building an MCP server, deploying it on Cloudflare Workers, OAuth scopes, and write-tool permissions — from a server that actually ships on this site.
MCPJSON-RPCCloudflare WorkersOAuth
Articles 9
AI Security •
Gemini agent hooks fail open: how to block a tool call anyway
Gemini agent hooks fail open on every error path, and never fire for MCP or function tools. The deny contract, the coverage gap, and what to gate instead.
9 min read
Read more →
Web Engineering •
How to Make Your Site Agent-Readable: 4 Layers, One Worker
Make your site agent-readable in four layers — readable, discoverable, callable, payable. Three are build-time files; only /mcp needs a Worker.
10 min read
Read more →
AI Coding Agents & DX •
Fix your agent tool instructions: GitHub's 20% review-cost cut
Agent tool instructions decide what your agent costs. GitHub kept the same grep/glob/view toolset, rewrote the guidance, and cut review cost by ~20%.
9 min read
Read more →
AI Security •
MCP Write Controls: Lessons from Cloudflare WriteGuard
MCP write controls decide what your agents can break. Cloudflare's WriteGuard shows the pattern: per-tool risk tiers, agent attribution, central audit.
13 min read
Read more →
AI Security •
How to Secure MCP Write Tools: Cloudflare's WriteGuard Lesson
How to secure MCP write tools: the spec puts confirmation on the client — the one layer you don't control. Cloudflare's WriteGuard moves the gate server-side.
11 min read
Read more →
AI Engineering •
ChatGPT Apps SDK and the Super App Reform: How Apps in ChatGPT Work (2026)
The ChatGPT Apps SDK explained: how apps in ChatGPT work, why it's built on MCP, who the launch partners are, and how developers build and submit apps.
7 min read
Read more →
AI Engineering •
Deploy an MCP Server on Cloudflare Workers (Free, at the Edge)
Deploy an MCP server on Cloudflare Workers: wrangler.toml, the run_worker_first model, routing /mcp, local testing, and going live on the free tier.
7 min read
Read more →
AI Engineering •
How to Build an MCP Server: A Step-by-Step Guide (2026)
How to build an MCP server, step by step: JSON-RPC 2.0, the Streamable HTTP transport, typed tools, and agent discovery — from a real one I shipped.
9 min read
Read more →Frequently Asked Questions
What is the Model Context Protocol (MCP)?
MCP is an open protocol that lets AI agents call typed tools over JSON-RPC instead of scraping web pages. A server exposes tools/list and tools/call; a client (Claude, Cursor, ChatGPT) discovers those tools and invokes them. The usual transport is Streamable HTTP — one POST /mcp endpoint.
How do I build an MCP server?
You need four JSON-RPC methods: initialize, tools/list, tools/call, and ping. A stateless Cloudflare Worker that returns plain JSON is fully spec-compliant. Back the tools with data you already publish (a JSON feed, Markdown pages) so there is one source of truth. Full walkthrough: https://umesh-malik.com/blog/how-to-build-mcp-server.
Do MCP servers need authentication?
Public read-only tools can stay anonymous. Write tools and private data need OAuth (or a similar token). Optional OAuth scopes let the user narrow permissions at consent time so an agent does not get a broader grant than the task needs.
Where should I host an MCP server?
Anywhere that can serve HTTPS JSON. Cloudflare Workers is a common fit: one file, a free tier, and you can pin the Worker to /mcp so the rest of a static site stays on the asset worker. Guide: https://umesh-malik.com/blog/deploy-mcp-server-cloudflare-workers.
Google Search · Preferred sources
Prefer this site on Google
If you already read this writing, add umesh-malik.com as a Preferred Source. Google can then highlight it with a preferred badge in Top Stories, AI Overviews, and AI Mode — for you, not as a site-wide ranking boost.