Deploy & rotate secrets

All commands use the cf CLI from ~/projects/911cpb-mcp, with CLOUDFLARE_ACCOUNT_ID=edc1a364499054f067488201b7646f09 (ApplyLogics).

Build and deploy

The Worker serves both the MCP server and these docs on https://mcp.911cpb.org. npm run build builds the Starlight site (docs/dist) and then the Worker, which ships the docs as static assets.

cd ~/projects/911cpb-mcp
npx tsc --noEmit   # typecheck
npm run build      # docs + Worker
cf deploy

Paths the docs don’t use (/mcp, /api/*, /openapi.json, /authorize, /token, /register, /.well-known/*) fall through to the Worker.

Rotate the auth token

openssl rand -hex 32                     # new token
cf workers secrets update MCP_AUTH_TOKEN # paste it when prompted

Then update .secrets and every client (webapp env var, Claude Code config). Old clients get 401 right away.

Rotate the database password

1. Change the password in Aurora.
2. Update Hyperdrive with the new password. cf cli search "update hyperdrive origin password" finds the command; run --help on it for the flags.
3. Check it with any query call. No redeploy is needed, because the Worker reads the connection from the binding.

Local development

cf dev

To run locally against a different database, set dev.connectionString on the HYPERDRIVE binding in cloudflare.config.ts. Don’t commit a real connection string.