Rewards Flights Public MCP

Deploy a remote, authentication-free MCP server on Cloudflare Workers to search for rewards flights.

An experimental Model Context Protocol server that exposes read-only award-flight search tools backed by the Seats.aero Partner API. It runs on Cloudflare Workers and uses the Streamable HTTP transport at/mcp.

This repository is a security-hardened prototype, not a finished multi-tenant platform. It has a shared bearer-token boundary, an origin allowlist, and Cloudflare Worker rate limiting. A production deployment should replace the shared token with MCP OAuth/Cloudflare Access, issue per-user scopes, add audit events and alerts, and complete a threat model and load test.

- Every/mcprequest requiresAuthorization: Bearer <token>.
- Credentials are compared using SHA-256 digests and Cloudflare's timing-safe comparison API.
- Browser requests are accepted only fromMCP_ALLOWED_ORIGINS; native MCP clients may omitOrigin.
- Authenticated and unauthenticated requests are rate limited without storing raw credentials in the rate-limit key.
- The Seats.aero key and MCP bearer token are Wrangler secrets. No credential belongs in source,.dev.vars, logs, commits, issues, or pull requests.
- The old HTTP+SSE routes are intentionally not exposed.

Report a vulnerability privately using GitHub'sSecurity → Report a vulnerabilityflow. Do not open a public issue containing secrets.

npm ci cp .dev.vars.example .dev.vars npm run dev

Create.dev.varslocally with new, non-production values:

SEATS_AERO_API_KEY=replace-with-a-rotated-key MCP_AUTH_TOKEN=replace-with-a-long-random-token MCP_ALLOWED_ORIGINS=https://your-client.example

.dev.varsis ignored by Git. Never reuse the credential removed from the previous repository history.

Authenticate Wrangler, configure newly rotated secrets, then deploy:

npx wrangler login npx wrangler secret put SEATS_AERO_API_KEY npx wrangler secret put MCP_AUTH_TOKEN npx wrangler secret put MCP_ALLOWED_ORIGINS npm run deploy

The Worker keeps the legacy Cloudflare service name inwrangler.jsoncso deploying updates the existing endpoint instead of leaving an authless service behind. Connect clients tohttps://<worker>.<account>.workers.dev/mcpand supply the bearer token through the client's secure credential mechanism.

npm run type-check npm run lint npm test

GitHub Actions runs these checks on pushes and pull requests.

A server for Google search and webpage content extraction, built on Cloudflare Workers with OAuth support.

Integrates with the Amazon Product Advertising API to search for products.

An MCP server for accessing and searching AWS documentation, with support for different partitions.

Access, search, and get recommendations from public AWS documentation.

A self-hostable MCP server for deployment on Cloudflare Workers using Durable Objects.

Deploy a remote, authentication-free MCP server on Cloudflare Workers.

Deploy a remote, authentication-free MCP server on Cloudflare Workers.

A remote MCP server deployable on Cloudflare Workers without authentication.

A remote MCP server deployable on Cloudflare Workers or runnable locally, requiring no authentication or external data files.

An example for deploying a remote, authentication-free MCP server on Cloudflare Workers.