Forward MCP requests of organizations moved to v2

[RhysSullivan]

Organizations that moved to Executor v2 keep using their existing MCP URLs. v1 still authenticates the caller (AuthKit token or user API key, plus the membership check) and keeps serving discovery. For a moved organization, it forwards the request to v2's MCP endpoint instead of the v1 session.

• New table org_moved_to_v2. v2 writes it and v1 only reads it. Only moved with a v2 organization forwards, and a failed read is a retryable 503.
• /mcp, /<org>/mcp and toolkit URLs forward to v2's /mcp. elicitation_mode is kept, and a toolkit becomes v2's ?connection=. mode=passthrough is refused with an explanation.
• The caller's credential is replaced by a short-lived HMAC-signed bearer naming the account and organization (V2_MCP_FORWARD_SECRET). The request goes over a new V2_MCP service binding.
• A 401 from v2 is answered as a retryable 503, so clients are never sent to sign in elsewhere. Open v1 sessions get 404 from v2 and reconnect.
• Nothing changes until an organization's row is moved. Forwarding also needs the V2_MCP_FORWARD_SECRET Worker secret.

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-2287.executor-e2e.workers.dev
MCP	https://executor-preview-pr-2287.executor-e2e.workers.dev/mcp
Deployed commit	ae186ca

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	ae186ca	Commit Preview URL Branch Preview URL	Oct 13 2026, 05:08 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	ae186ca	Oct 13 2026, 05:08 PM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2287

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2287

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2287

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2287

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2287

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2287

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2287

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2287

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2287

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2287

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2287

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2287

executor

npm i https://pkg.pr.new/executor@2287

commit: ae186ca