Running a Remote MCP Server on Cloudflare Workers for Free: A Practical Guide

·1 views

A Vietnamese developer guide describes moving MCP servers from local stdio setups onto Cloudflare Workers, where they can be reached over HTTP and shared across a team. The author argues that local setups require per-machine installation, scatter secrets across config files, and cannot serve cloud-hosted agents. The remote approach uses the Streamable HTTP transport from the MCP spec, letting clients connect with just a URL and token while secrets stay on the server. The walkthrough covers project setup with wrangler and the agents and MCP SDK packages, configuring Durable Objects and KV bindings, and a sample server exposing note-saving and note-search tools. It also flags a common pitfall: free-plan Durable Objects require the new_sqlite_classes migration rather than the legacy option.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Banks and Publishers Restrict AI Agents as Identity Gaps Emerge

After customers began handing banking credentials to AI assistants, Citigroup and Bank of America moved to bar agents from client accounts, and Schwab began blocking outside AI tools that attempt to move money. Content publishers showed a similar shift, with Cloudflare's one-click AI crawler block adopted by over a million customers and the share of reputable sites blocking AI scrapers rising sharply from 2023 to 2025. Analysis of crawler traffic suggests much of it is training-related rather than live user activity, while robots.txt enforcement remains inconsistent across top domains. The article argues that current agents cannot prove who they are or who authorized them, leaving operators to rely on easily spoofed signals. Proposed remedies include cryptographically signed agent identities under RFC 9421 and Visa's Trusted Agent Protocol for commerce.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AIClaw Adds Opt-In Skill Access Tracking That Excludes Prompt and Tool Content

AIClaw's v3.7.3 release introduced an opt-in OpenTelemetry Logs event, aiclaw.skill_invocation, that records when an agent accesses a skill and how that access was triggered. The event classifies access as explicit, when a user mentions a skill and it loads, or implicit, when a skill loads or its SKILL.md is read without such a mention. Prompt text, skill bodies, and tool payloads are kept out of the exported events, and file paths are resolved locally. The tracker deduplicates repeated loads within a turn, so one turn can produce both an explicit and an implicit event for the same skill. The feature was released October 8, and the latest public version at the time of writing is v3.7.15.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ElevenLabs AI Voice Helps Real Estate Sites Add Narrated Virtual Property Tours

A developer guide explains how AI text-to-speech can add narration to property listings, making virtual tours more immersive and engaging. It describes how to get started with ElevenLabs, a TTS service with a free tier, by generating an API key and listing available voices. The article includes a Python script that converts a property description into an MP3 narration file via the API. It also covers voice cloning as a way to keep a consistent brand voice across listings. The approach is presented as a low-cost alternative to studio recording and hired narrators.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Stripe webhook 401 errors on Supabase Edge Functions by disabling JWT verification

A common cause of Stripe webhooks failing with 401 on a Supabase Edge Function is the platform's built-in JWT check, which rejects requests before the function's code runs. The article explains how to tell this apart from a 401 returned by the developer's own code, by inspecting the response body in Stripe's delivery log. The fix is to disable JWT verification for the webhook function only, either via config.toml or the --no-verify-jwt deploy flag, so that redeploys don't re-enable it. Because the endpoint becomes publicly reachable once this change is made, the author stresses that the Stripe signature must then be verified inside the function, since otherwise anyone who knows the URL could send forged events.

0 comments Read more at DEV Community