Configuration

The project lives in ~/projects/911cpb-mcp and deploys as the Worker 911cpb-mcp on the custom domain mcp.911cpb.org. The docs are in docs/ and are served from the same Worker. Worker config is cloudflare.config.ts (the cf CLI format, not wrangler.toml).

Bindings

Name	Type	Value
HYPERDRIVE	Hyperdrive	911cpb-mcp (3c36ffaf23d548219b7be25f348a830e) → Aurora reader endpoint, database crmdb, sslmode=require
MCP_AUTH_TOKEN	Secret	Access key: works as a bearer token / X-API-Key, and approves OAuth clients
OAUTH_KV	KV	911cpb-mcp-oauth (83cbd56e72ca4cd59078c63bfa7eaa1d): OAuth clients, grants and tokens

The Worker uses the nodejs_compat compatibility flag (needed by the postgres driver).

Constants in src/index.ts

Constant	Default	Purpose
MAX_ROWS	500	Rows returned per query call
EXCLUDED_TABLES	["AuditEvent"]	Tables hidden from all tools
ALLOWED_START	select|with|explain|show|values|table	Allowed first keyword

The statement timeout (15s) is set in readOnly().

OAuth endpoints

Endpoint	Purpose
/.well-known/oauth-protected-resource/mcp	Protected resource metadata (RFC 9728)
/.well-known/oauth-authorization-server	Authorization server metadata
/register	Dynamic client registration
/authorize	Sign-in and approval page
/token	Code and refresh-token exchange

The OAuth resource is exactly https://mcp.911cpb.org/mcp. OAuth sign-in only works on that domain; the old workers.dev address supports the access key only. Access tokens last 3600 seconds.

Excluded tables

public."AuditEvent" (about 400 GB) is excluded. It doesn’t show up in list_tables, and describe_table and query refuse it. To exclude more tables, add them to EXCLUDED_TABLES and redeploy.

Note

The exclusion matches the table name in the SQL text. It’s a guard rail, not a permission. For a hard guarantee, connect as a database role that has no SELECT on the table.

Caching

Hyperdrive caching is on. Identical read queries can return results up to about 60 seconds old. To turn it off, update the Hyperdrive config with caching disabled.