Skip to content

Forward MCP requests of organizations moved to v2 - #2287

Draft
RhysSullivan wants to merge 2 commits into
mainfrom
rhys/v1-mcp-forward
Draft

RhysSullivan wants to merge 2 commits into
mainfrom
rhys/v1-mcp-forward

Conversation

@RhysSullivan

Copy link
Copy Markdown
Collaborator

Organizations that moved to Executor v2 keep using their existing MCP URLs. v1 still authenticates the caller (AuthKit token or user API key, plus the membership check) and keeps serving discovery. For a moved organization, it forwards the request to v2's MCP endpoint instead of the v1 session.

  • New table org_moved_to_v2. v2 writes it and v1 only reads it. Only moved with a v2 organization forwards, and a failed read is a retryable 503.
  • /mcp, /<org>/mcp and toolkit URLs forward to v2's /mcp. elicitation_mode is kept, and a toolkit becomes v2's ?connection=. mode=passthrough is refused with an explanation.
  • The caller's credential is replaced by a short-lived HMAC-signed bearer naming the account and organization (V2_MCP_FORWARD_SECRET). The request goes over a new V2_MCP service binding.
  • A 401 from v2 is answered as a retryable 503, so clients are never sent to sign in elsewhere. Open v1 sessions get 404 from v2 and reconnect.
  • Nothing changes until an organization's row is moved. Forwarding also needs the V2_MCP_FORWARD_SECRET Worker secret.

@github-actions

Copy link
Copy Markdown
Contributor

Cloudflare preview

Console https://executor-preview-pr-2287.executor-e2e.workers.dev
MCP https://executor-preview-pr-2287.executor-e2e.workers.dev/mcp
Deployed commit ae186ca

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
executor-marketing ae186ca Commit Preview URL

Branch Preview URL
Oct 13 2026, 05:08 PM

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs
executor-cloud ae186ca Oct 13 2026, 05:08 PM

@pkg-pr-new

pkg-pr-new Bot commented Oct 13, 2026

Copy link
Copy Markdown

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@2287

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@2287

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@2287

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@2287

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@2287

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@2287

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@2287

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@2287

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@2287

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@2287

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@2287

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@2287

executor

npm i https://pkg.pr.new/executor@2287

commit: ae186ca

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant