Cloudflare has taken the library most remote MCP servers use for authorization to a 1.0, and changed its shape on the way. In The best way to do MCP auth just got better, the changelog describes a split API for the Workers OAuth Provider: “One Worker acts as the authorization server: it signs users in and issues tokens. Your MCP server acts as the resource server, and can run in another Worker. It validates each token with the authorization server over a Service Binding, without crossing the public Internet.” It implements the MCP 2026-07-28 authorization specification, including Client ID Metadata Documents and issuer identification, while still accepting older clients that use Dynamic Client Registration.
There are no figures in a changelog, and the design choices carry the post. One authorization server can issue tokens for many MCP servers. The resource server publishes the RFC 9728 protected resource metadata that clients use to find the authorization server, answers tokenless requests with a 401 that points to it, and “rejects tokens issued for any other resource.” A one-line insufficientScope() gives step-up authorization. Consent page and upstream sign-in helpers “implement the MCP confused deputy protections,” refresh tokens get a sliding expiry, and the two Workers can sit behind different WAF and rate limiting rules. The migration is honest about cost: for most 0.x deployments “the only required change is to add resourceMetadata,” and a migration skill ships inside the npm package “so a coding agent can perform the upgrade.”
The catalog can hold the release against the largest record it has. The Cloudflare provider page lists 650 API pages, and the surface this ships on is the Cloudflare Workers API, with the per-Worker rules the post describes living in the Cloudflare WAF API and the multi-tenant case in the Cloudflare Workers for Platforms API. The agentic access profile maps 3,118 operations, 1,576 of them acting, with 52 human-in-the-loop. On the Agent Readiness score, sixteen dimensions are lit, including protected resource metadata, dynamic client registration, delegated identity, the agent card, dry-run mode and reversibility.
The Kin Score is 81.3, exemplar band, carried by developer ergonomics at 95.7, access clarity at 84.2 and discoverability at 73.3, with contract governance at 43.6. The Agent Readiness score is 74.8, agent-native, the highest this series has recorded. Three dimensions are unlit: a well-known catalog, agentic commerce, and consent identity. That last one is the interesting gap. The package Cloudflare ships gives its customers consent page helpers and confused-deputy protections for their servers. The dimension measures whether Cloudflare’s own API surface describes consent for an agent acting on a user’s behalf, and the catalog has not found that it does. Cloudflare has made the right way to do MCP auth a library. The record shows the company’s own door already built with it, missing the one sign the library now helps everyone else hang.