@kya-os/mcp-i-cloudflare 1.5.8-canary.3 → 1.5.8-canary.30

package/dist/adapter.js

@@ -13,6 +13,7 @@ import { WELL_KNOWN_CORS_HEADERS, MCP_CORS_HEADERS, PREFLIGHT_CORS_HEADERS, } fr
 import { KVProofArchive } from "./storage/kv-proof-archive";
 import { STORAGE_KEYS } from "./constants/storage-keys";
 import { DEFAULT_SESSION_CACHE_TTL } from "./constants";
+import { normalizeCloudflareEnv } from "./helpers/env-mapper";
 const INITIALIZE_CONTEXT_TTL_MS = 60_000;
 /**
  * Lightweight MCP protocol implementation for Cloudflare Workers
@@ -77,81 +78,204 @@ class CloudflareMCPServer {
             }
             // Call tool with identity/proof wrapping
             if (method === "tools/call") {
+                // Entry point logging for debugging
+                console.log("🔵 [CloudflareMCPServer] handleRequest: tools/call", {
+                    toolName: params.name,
+                    hasParams: !!params,
+                    paramsKeys: params ? Object.keys(params) : [],
+                });
                 const toolName = params.name;
                 const tool = this.tools.get(toolName);
                 if (!tool) {
                     throw new Error(`Tool not found: ${toolName}`);
                 }
                 // Get current session if available (stateful environments like Node.js)
-                let session = await this.runtime.getCurrentSession();
+                // Wrap in try-catch to catch any exceptions
+                let session = null;
+                try {
+                    session = await this.runtime.getCurrentSession();
+                    console.log("[CloudflareMCPServer] Session check:", {
+                        hasSession: !!session,
+                        sessionId: session?.id?.slice(0, 20) + "..." || "none",
+                        hasDelegationToken: !!session?.delegationToken,
+                        hasDelegationStorage: !!this.delegationStorage,
+                        method: "tools/call",
+                        toolName,
+                    });
+                }
+                catch (error) {
+                    console.error("[CloudflareMCPServer] Error in getCurrentSession:", error);
+                    // Continue with null session (will create ephemeral)
+                }
                 // For stateless environments (Cloudflare Workers), create ephemeral session
                 if (!session) {
+                    // Extract session_id from params if available (from consent flow)
+                    // This allows us to retrieve delegation tokens stored with the original session_id
+                    const providedSessionId = params.session_id || params.sessionId;
                     const timestamp = Date.now();
                     const randomSuffix = Math.random().toString(36).substring(2, 10);
                     const agentDid = (await this.runtime.getIdentity()).did;
-                    const sessionId = `ephemeral-${timestamp}-${randomSuffix}`;
+                    // Use provided session_id if available, otherwise create ephemeral
+                    const sessionId = providedSessionId || `ephemeral-${timestamp}-${randomSuffix}`;
+                    console.log("[CloudflareMCPServer] Creating session:", {
+                        sessionId: sessionId.slice(0, 20) + "...",
+                        isProvided: !!providedSessionId,
+                        isEphemeral: !providedSessionId,
+                    });
                     // Check KV storage for stored delegation token if not provided in params
                     let delegationToken = params.delegationToken;
                     if (!delegationToken && this.delegationStorage) {
                         try {
-                            // Get userDID from params or session if available
-                            // TODO: Properly map credentials to userDID for multi-user scenarios
-                            // Currently, we use agent-scoped keys which can cause conflicts when multiple
-                            // users delegate to the same agent. The ideal key structure should be:
-                            // - `user:${userDid}:agent:${agentDid}:delegation` (user+agent scoped - most specific)
-                            // - `agent:${agentDid}:delegation` (agent-scoped fallback for single-user agents)
-                            //
-                            // To implement this properly:
-                            // 1. Capture userDID in consent approval flow (from OAuth or session)
-                            // 2. Store tokens with userDID in the key: `user:${userDid}:agent:${agentDid}:delegation`
-                            // 3. Retrieve tokens by userDID + agentDID combination
-                            // 4. Fall back to agent-scoped key for backward compatibility
-                            const userDid = params.clientDid || params.userDid; // Try to get userDID from request
-                            // Try session-scoped token first (if session ID was persisted)
-                            // Note: Sessions are ephemeral in Cloudflare Workers, so this is mainly
-                            // useful for caching tokens within a single request chain
-                            if (sessionId) {
-                                const sessionToken = await this.delegationStorage.get(`session:${sessionId}`);
-                                if (sessionToken) {
-                                    delegationToken = sessionToken;
+                            // Get userDID from params first
+                            let userDid = params.clientDid || params.userDid;
+                            // ✅ FIX: If userDid not in params, try to retrieve from session cache
+                            if (!userDid && sessionId) {
+                                try {
+                                    const sessionKey = STORAGE_KEYS.session(sessionId);
+                                    const sessionData = (await this.delegationStorage.get(sessionKey, "json"));
+                                    if (sessionData?.userDid) {
+                                        userDid = sessionData.userDid;
+                                        console.log("[CloudflareMCPServer] ✅ Retrieved userDid from session cache:", {
+                                            userDid: userDid.slice(0, 20) + "...",
+                                            sessionId: sessionId.slice(0, 20) + "...",
+                                        });
+                                    }
+                                }
+                                catch (error) {
+                                    console.warn("[CloudflareMCPServer] Failed to get userDid from session:", error);
+                                    // Non-fatal - continue without userDid
                                 }
                             }
-                            // Try user+agent scoped token (if userDID is available)
+                            console.log("[CloudflareMCPServer] 🔍 Starting delegation token lookup from KV:", {
+                                agentDid: agentDid.slice(0, 20) + "...",
+                                userDid: userDid?.slice(0, 20) + "..." || "none",
+                                sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                hasDelegationStorage: !!this.delegationStorage,
+                            });
+                            // PRIORITY 1: Try agent-scoped token FIRST (stable across sessions)
+                            // This is the most reliable lookup since sessions are ephemeral in Cloudflare Workers
+                            // The consent service stores tokens with this key format
+                            const agentKey = STORAGE_KEYS.legacyDelegation(agentDid);
+                            console.log("[CloudflareMCPServer] 🔍 PRIORITY 1: Checking agent-scoped key:", {
+                                key: agentKey,
+                                agentDid: agentDid.slice(0, 20) + "...",
+                            });
+                            const agentToken = await this.delegationStorage.get(agentKey, "text");
+                            console.log("[CloudflareMCPServer] 🔍 PRIORITY 1: Agent-scoped lookup result:", {
+                                key: agentKey,
+                                found: !!agentToken,
+                                tokenLength: agentToken?.length || 0,
+                                tokenPreview: agentToken ? agentToken.substring(0, 20) + "..." : null,
+                            });
+                            if (agentToken) {
+                                delegationToken = agentToken;
+                                console.log("[CloudflareMCPServer] ✅ Delegation token retrieved from agent-scoped key:", {
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                    key: agentKey,
+                                    tokenLength: agentToken.length,
+                                });
+                                // Cache it for this session for faster future lookups
+                                // Store full session data object to match consent service format
+                                if (sessionId) {
+                                    const sessionKey = STORAGE_KEYS.session(sessionId);
+                                    // Read existing session data to preserve userDid and other fields
+                                    const existingSession = (await this.delegationStorage.get(sessionKey, "json"));
+                                    await this.delegationStorage.put(sessionKey, JSON.stringify({
+                                        ...existingSession,
+                                        userDid,
+                                        agentDid,
+                                        delegationToken: agentToken,
+                                        cachedAt: Date.now(),
+                                    }), {
+                                        expirationTtl: 1800, // 30 minutes
+                                    });
+                                }
+                            }
+                            // PRIORITY 2: Try user+agent scoped token (if userDID is available)
                             // This is the preferred approach for multi-user scenarios
                             if (!delegationToken && userDid) {
-                                const userAgentKey = `user:${userDid}:agent:${agentDid}:delegation`;
-                                const userAgentToken = await this.delegationStorage.get(userAgentKey);
+                                const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 2: Checking user+agent scoped key:", {
+                                    key: userAgentKey,
+                                    userDid: userDid.slice(0, 20) + "...",
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                });
+                                const userAgentToken = await this.delegationStorage.get(userAgentKey, "text");
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 2: User+agent scoped lookup result:", {
+                                    key: userAgentKey,
+                                    found: !!userAgentToken,
+                                    tokenLength: userAgentToken?.length || 0,
+                                    tokenPreview: userAgentToken ? userAgentToken.substring(0, 20) + "..." : null,
+                                });
                                 if (userAgentToken) {
                                     delegationToken = userAgentToken;
+                                    console.log("[CloudflareMCPServer] ✅ Delegation token retrieved from user+agent scoped key:", {
+                                        userDid: userDid.slice(0, 20) + "...",
+                                        agentDid: agentDid.slice(0, 20) + "...",
+                                        key: userAgentKey,
+                                        tokenLength: userAgentToken.length,
+                                    });
                                     // Cache it for this session for faster future lookups
+                                    // Store full session data object to match consent service format
                                     if (sessionId) {
-                                        await this.delegationStorage.put(`session:${sessionId}`, userAgentToken, {
+                                        const sessionKey = STORAGE_KEYS.session(sessionId);
+                                        // Read existing session data to preserve userDid and other fields
+                                        const existingSession = (await this.delegationStorage.get(sessionKey, "json"));
+                                        await this.delegationStorage.put(sessionKey, JSON.stringify({
+                                            ...existingSession,
+                                            userDid,
+                                            agentDid,
+                                            delegationToken: userAgentToken,
+                                            cachedAt: Date.now(),
+                                        }), {
                                             expirationTtl: 1800, // 30 minutes
                                         });
                                     }
                                 }
                             }
-                            // Fallback to agent-scoped token (stable across sessions, but shared across users)
-                            // WARNING: This can cause conflicts when multiple users delegate to the same agent.
-                            // Each user's delegation will overwrite the previous one. This is acceptable for
-                            // single-user agents, but multi-user agents should use user+agent scoped keys above.
-                            if (!delegationToken) {
-                                const agentKey = `agent:${agentDid}:delegation`;
-                                const agentToken = await this.delegationStorage.get(agentKey);
-                                if (agentToken) {
-                                    delegationToken = agentToken;
-                                    // Cache it for this session for faster future lookups
-                                    if (sessionId) {
-                                        await this.delegationStorage.put(`session:${sessionId}`, agentToken, {
-                                            expirationTtl: 1800, // 30 minutes
-                                        });
-                                    }
+                            // PRIORITY 3: Try session-scoped token (if session ID was persisted)
+                            // Note: Sessions are ephemeral in Cloudflare Workers, so this is mainly
+                            // useful for caching tokens within a single request chain
+                            if (!delegationToken && sessionId) {
+                                const sessionKey = STORAGE_KEYS.session(sessionId);
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 3: Checking session-scoped key:", {
+                                    key: sessionKey,
+                                    sessionId: sessionId.slice(0, 20) + "...",
+                                });
+                                const sessionData = (await this.delegationStorage.get(sessionKey, "json"));
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 3: Session-scoped lookup result:", {
+                                    key: sessionKey,
+                                    found: !!sessionData,
+                                    hasDelegationToken: !!sessionData?.delegationToken,
+                                    tokenLength: sessionData?.delegationToken?.length || 0,
+                                    tokenPreview: sessionData?.delegationToken ? sessionData.delegationToken.substring(0, 20) + "..." : null,
+                                });
+                                if (sessionData?.delegationToken) {
+                                    delegationToken = sessionData.delegationToken;
+                                    console.log("[CloudflareMCPServer] ✅ Delegation token retrieved from session cache:", {
+                                        sessionId: sessionId.slice(0, 20) + "...",
+                                        tokenLength: delegationToken.length,
+                                    });
                                 }
                             }
+                            if (!delegationToken) {
+                                console.log("[CloudflareMCPServer] ⚠️ No delegation token found in KV storage:", {
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                    userDid: userDid?.slice(0, 20) + "..." || "none",
+                                    sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                    checkedKeys: [
+                                        agentKey,
+                                        userDid
+                                            ? STORAGE_KEYS.delegation(userDid, agentDid)
+                                            : null,
+                                        sessionId ? STORAGE_KEYS.session(sessionId) : null,
+                                    ].filter(Boolean),
+                                });
+                            }
                         }
                         catch (error) {
                             // Log but don't fail - delegation lookup is best-effort
-                            console.warn("[CloudflareMCPServer] Failed to retrieve delegation token from KV:", error);
+                            console.error("[CloudflareMCPServer] Failed to retrieve delegation token from KV:", error);
                         }
                     }
                     session = {
@@ -168,9 +292,207 @@ class CloudflareMCPServer {
                         serverOrigin: this.requestOrigin,
                         // These fields are for ephemeral sessions - won't persist
                     };
+                    // ✅ CRITICAL: Log delegation token status before processToolCall
+                    console.log("[CloudflareMCPServer] ✅ Session created with delegation token status:", {
+                        sessionId: sessionId.slice(0, 20) + "...",
+                        hasDelegationToken: !!delegationToken,
+                        delegationTokenLength: delegationToken?.length || 0,
+                        delegationTokenSource: params.delegationToken ? "params" : (delegationToken ? "kv-storage" : "none"),
+                        agentDid: agentDid.slice(0, 20) + "...",
+                    });
                 }
                 else {
-                    // For existing sessions, update delegation fields if provided
+                    // For existing sessions, check KV storage for delegation token if not already set
+                    // This ensures newly created delegations are found even for existing sessions
+                    console.log("[CloudflareMCPServer] Existing session detected, checking KV storage:", {
+                        hasSession: !!session,
+                        hasDelegationToken: !!session?.delegationToken,
+                        hasDelegationStorage: !!this.delegationStorage,
+                        sessionId: session?.id?.slice(0, 20) + "...",
+                        sessionKeys: Object.keys(session || {}),
+                    });
+                    if (!session.delegationToken && this.delegationStorage) {
+                        console.log("[CloudflareMCPServer] ⚠️ Session has no delegationToken, attempting KV lookup...");
+                        try {
+                            const agentDid = (await this.runtime.getIdentity()).did;
+                            const userDid = params.clientDid || params.userDid || session.clientDid;
+                            const sessionId = session.id;
+                            console.log("[CloudflareMCPServer] 🔍 Looking up delegation token for existing session:", {
+                                sessionId: sessionId?.slice(0, 20) + "...",
+                                userDid: userDid?.slice(0, 20) + "...",
+                                agentDid: agentDid?.slice(0, 20) + "...",
+                            });
+                            // PRIORITY 1: Try agent-scoped token FIRST (stable across sessions)
+                            const agentKey = STORAGE_KEYS.legacyDelegation(agentDid);
+                            console.log("[CloudflareMCPServer] 🔍 PRIORITY 1: Checking agent-scoped key:", {
+                                key: agentKey,
+                                agentDid: agentDid.slice(0, 20) + "...",
+                            });
+                            let delegationToken = await this.delegationStorage.get(agentKey, "text");
+                            console.log("[CloudflareMCPServer] 🔍 PRIORITY 1: Agent-scoped lookup result:", {
+                                key: agentKey,
+                                found: !!delegationToken,
+                                tokenLength: delegationToken?.length || 0,
+                            });
+                            // PRIORITY 2: Try user+agent scoped token (if userDID is available)
+                            if (!delegationToken && userDid) {
+                                const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 2: Checking user+agent scoped key:", {
+                                    key: userAgentKey,
+                                    userDid: userDid.slice(0, 20) + "...",
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                });
+                                const userAgentToken = await this.delegationStorage.get(userAgentKey, "text");
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 2: User+agent scoped lookup result:", {
+                                    key: userAgentKey,
+                                    found: !!userAgentToken,
+                                    tokenLength: userAgentToken?.length || 0,
+                                });
+                                if (userAgentToken) {
+                                    delegationToken = userAgentToken;
+                                }
+                            }
+                            // PRIORITY 3: Try session-scoped token (if session ID was persisted)
+                            if (!delegationToken && sessionId) {
+                                const sessionKey = STORAGE_KEYS.session(sessionId);
+                                console.log("[CloudflareMCPServer] 🔍 PRIORITY 3: Looking up session key:", {
+                                    sessionKey,
+                                    sessionId: sessionId.slice(0, 20) + "...",
+                                });
+                                try {
+                                    const sessionData = (await this.delegationStorage.get(sessionKey, "json"));
+                                    console.log("[CloudflareMCPServer] 🔍 PRIORITY 3: Session-scoped lookup result:", {
+                                        key: sessionKey,
+                                        found: !!sessionData,
+                                        hasDelegationToken: !!sessionData?.delegationToken,
+                                        tokenLength: sessionData?.delegationToken?.length || 0,
+                                    });
+                                    if (sessionData?.delegationToken) {
+                                        delegationToken = sessionData.delegationToken;
+                                    }
+                                }
+                                catch (error) {
+                                    console.error("[CloudflareMCPServer] Error retrieving session data:", error);
+                                }
+                            }
+                            // ✅ CRITICAL: Set delegation token on session if found
+                            if (delegationToken) {
+                                session = {
+                                    ...session,
+                                    delegationToken,
+                                };
+                                console.log("[CloudflareMCPServer] ✅ Delegation token set on existing session:", {
+                                    sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                    tokenLength: delegationToken.length,
+                                    sessionHasToken: !!session.delegationToken,
+                                    source: "kv-storage",
+                                });
+                            }
+                            else {
+                                console.log("[CloudflareMCPServer] ⚠️ No delegation token found in KV storage for existing session:", {
+                                    sessionId: sessionId?.slice(0, 20) + "..." || "none",
+                                    checkedKeys: [
+                                        agentKey,
+                                        userDid ? STORAGE_KEYS.delegation(userDid, agentDid) : null,
+                                        sessionId ? STORAGE_KEYS.session(sessionId) : null,
+                                    ].filter(Boolean),
+                                });
+                            }
+                            // PRIORITY 2: Try user+agent scoped token (if userDID is available)
+                            if (!session.delegationToken && userDid) {
+                                const userAgentKey = STORAGE_KEYS.delegation(userDid, agentDid);
+                                console.log("[CloudflareMCPServer] PRIORITY 2: Looking up user+agent key:", {
+                                    userAgentKey,
+                                    userDid: userDid.slice(0, 20) + "...",
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                });
+                                try {
+                                    const userAgentToken = await this.delegationStorage.get(userAgentKey);
+                                    if (userAgentToken) {
+                                        session = {
+                                            ...session,
+                                            delegationToken: userAgentToken,
+                                        };
+                                        console.log("[CloudflareMCPServer] ✅ Delegation token retrieved from user+agent scoped key (existing session):", {
+                                            userDid: userDid.slice(0, 20) + "...",
+                                            agentDid: agentDid.slice(0, 20) + "...",
+                                            key: userAgentKey,
+                                            tokenLength: userAgentToken.length,
+                                        });
+                                    }
+                                    else {
+                                        console.log("[CloudflareMCPServer] ⚠️ No token found at user+agent key");
+                                    }
+                                }
+                                catch (error) {
+                                    console.error("[CloudflareMCPServer] Error retrieving user+agent token:", error);
+                                }
+                            }
+                            else {
+                                console.log("[CloudflareMCPServer] ⚠️ Skipping PRIORITY 2:", {
+                                    hasToken: !!session.delegationToken,
+                                    hasUserDid: !!userDid,
+                                });
+                            }
+                            // PRIORITY 3: Try agent-scoped token (fallback)
+                            if (!session.delegationToken) {
+                                const agentKey = STORAGE_KEYS.legacyDelegation(agentDid);
+                                console.log("[CloudflareMCPServer] PRIORITY 3: Looking up agent key:", {
+                                    agentKey,
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                });
+                                try {
+                                    const agentToken = await this.delegationStorage.get(agentKey);
+                                    if (agentToken) {
+                                        session = {
+                                            ...session,
+                                            delegationToken: agentToken,
+                                        };
+                                        console.log("[CloudflareMCPServer] ✅ Delegation token retrieved from agent-scoped key (existing session):", {
+                                            agentDid: agentDid.slice(0, 20) + "...",
+                                            key: agentKey,
+                                            tokenLength: agentToken.length,
+                                        });
+                                    }
+                                    else {
+                                        console.log("[CloudflareMCPServer] ⚠️ No token found at agent key");
+                                    }
+                                }
+                                catch (error) {
+                                    console.error("[CloudflareMCPServer] Error retrieving agent token:", error);
+                                }
+                            }
+                            else {
+                                console.log("[CloudflareMCPServer] ✅ Already have token, skipping PRIORITY 3");
+                            }
+                            // Final check - log if we still don't have a token
+                            if (!session.delegationToken) {
+                                console.log("[CloudflareMCPServer] ❌ FINAL CHECK: Still no delegation token after all KV lookups:", {
+                                    sessionId: session?.id?.slice(0, 20) + "..." || "none",
+                                    userDid: userDid?.slice(0, 20) + "..." || "none",
+                                    agentDid: agentDid.slice(0, 20) + "...",
+                                    checkedKeys: [
+                                        sessionId ? STORAGE_KEYS.session(sessionId) : null,
+                                        userDid
+                                            ? STORAGE_KEYS.delegation(userDid, agentDid)
+                                            : null,
+                                        STORAGE_KEYS.legacyDelegation(agentDid),
+                                    ].filter(Boolean),
+                                });
+                            }
+                            else {
+                                console.log("[CloudflareMCPServer] ✅ FINAL CHECK: Delegation token found:", {
+                                    tokenLength: session.delegationToken.length,
+                                    sessionHasToken: !!session.delegationToken,
+                                });
+                            }
+                        }
+                        catch (error) {
+                            // Log but don't fail - delegation lookup is best-effort
+                            console.error("[CloudflareMCPServer] Failed to retrieve delegation token from KV (existing session):", error);
+                        }
+                    }
+                    // Update delegation fields if provided in params (takes precedence)
                     if (params.delegationToken) {
                         session.delegationToken = params.delegationToken;
                     }
@@ -202,6 +524,34 @@ class CloudflareMCPServer {
                 session.toolName = toolName;
                 session.toolParams = params.arguments || {};
                 session.scopeId = scopeId; // ✅ ADDED: Pass scopeId for tool auto-discovery
+                // ✅ CRITICAL: Verify delegation token is set on session before processToolCall
+                // Also do a final KV lookup if token is still missing (defensive check)
+                if (!session?.delegationToken && this.delegationStorage) {
+                    try {
+                        const agentDid = (await this.runtime.getIdentity()).did;
+                        const agentKey = STORAGE_KEYS.legacyDelegation(agentDid);
+                        const finalToken = await this.delegationStorage.get(agentKey, "text");
+                        if (finalToken) {
+                            session.delegationToken = finalToken;
+                            console.log("[CloudflareMCPServer] ✅ Final KV lookup succeeded, token set on session:", {
+                                toolName,
+                                agentDid: agentDid.slice(0, 20) + "...",
+                                tokenLength: finalToken.length,
+                            });
+                        }
+                    }
+                    catch (error) {
+                        console.error("[CloudflareMCPServer] Final KV lookup failed:", error);
+                    }
+                }
+                console.log("[CloudflareMCPServer] ✅ About to call processToolCall with session:", {
+                    toolName,
+                    sessionId: session?.id?.slice(0, 20) + "..." || "none",
+                    hasDelegationToken: !!session?.delegationToken,
+                    delegationTokenLength: session?.delegationToken?.length || 0,
+                    hasConsentProof: !!session?.consentProof,
+                    agentDid: session?.agentDid?.slice(0, 20) + "..." || "none",
+                });
                 // ✅ Use processToolCall which handles delegation checks AND proof generation
                 // This ensures delegation is checked BEFORE tool execution
                 // If delegation is required but not provided, this will throw DelegationRequiredError
@@ -441,8 +791,7 @@ class CloudflareMCPServer {
         const name = typeof nameValue === "string" && nameValue.trim().length > 0
             ? nameValue.trim()
             : "unknown";
-        const clientId = handshakeClientId ||
-            crypto.randomUUID();
+        const clientId = handshakeClientId || crypto.randomUUID();
         const capabilities = this.isRecord(request.clientCapabilities)
             ? request.clientCapabilities
             : initializeContext?.capabilities;
@@ -557,25 +906,33 @@ function buildRequestMeta(request) {
  *
  * Supports SSE (Server-Sent Events) and HTTP JSON-RPC transports for compatibility
  * with Claude Desktop, Cursor, MCP Inspector, and other MCP clients.
+ *
+ * Automatically handles prefixed KV bindings via `envPrefix` parameter or auto-detection.
  */
 export function createMCPICloudflareAdapter(config) {
-    // Create the runtime with Cloudflare providers
-    const runtime = createCloudflareRuntime(config);
+    // Normalize environment to handle prefixed KV bindings
+    // This ensures consistent KV access regardless of prefix usage
+    const mappedEnv = normalizeCloudflareEnv(config.env, config.envPrefix);
+    // Create the runtime with normalized environment
+    const runtime = createCloudflareRuntime({
+        ...config,
+        env: mappedEnv,
+    });
     // Server info
     const serverInfo = config.serverInfo || {
         name: "MCP-I Cloudflare Server",
         version: "1.0.0",
     };
     // Initialize proof archive if PROOF_ARCHIVE KV is available
-    const env = config.env;
-    const proofArchive = env.PROOF_ARCHIVE
-        ? new KVProofArchive(env.PROOF_ARCHIVE)
+    const proofArchive = mappedEnv.PROOF_ARCHIVE
+        ? new KVProofArchive(mappedEnv.PROOF_ARCHIVE)
         : undefined;
-    // Get delegation storage from env if available
-    const delegationStorage = env.DELEGATION_STORAGE;
+    // Get delegation storage from normalized env if available
+    const delegationStorage = mappedEnv.DELEGATION_STORAGE;
     // Create lightweight MCP server
     const server = new CloudflareMCPServer(runtime, serverInfo, config.tools || [], proofArchive, delegationStorage);
     // Return fetch handler
+    // Note: mappedEnv is captured in closure for admin endpoints
     return {
         server,
         runtime,
@@ -766,15 +1123,16 @@ export function createMCPICloudflareAdapter(config) {
                         headers: { "Content-Type": "application/json" },
                     });
                 }
-                const env = config.env;
+                // Use normalized environment (handles prefixed KV bindings)
+                // mappedEnv is already normalized in createMCPICloudflareAdapter
                 // GET /admin/nonces - List active nonces
                 if (url.pathname === "/admin/nonces") {
                     try {
                         // Use KV list to get nonce keys
-                        const noncesList = await env.NONCE_CACHE.list({ prefix: "nonce:" });
+                        const noncesList = await mappedEnv.NONCE_CACHE.list({ prefix: "nonce:" });
                         const nonces = [];
                         for (const key of noncesList.keys) {
-                            const value = await env.NONCE_CACHE.get(key.name);
+                            const value = await mappedEnv.NONCE_CACHE.get(key.name);
                             if (value) {
                                 nonces.push({
                                     nonce: key.name.replace("nonce:", ""),
@@ -800,8 +1158,8 @@ export function createMCPICloudflareAdapter(config) {
                     }
                 }
                 // Initialize proof archive if available
-                const proofArchive = env.PROOF_ARCHIVE
-                    ? new KVProofArchive(env.PROOF_ARCHIVE)
+                const proofArchive = mappedEnv.PROOF_ARCHIVE
+                    ? new KVProofArchive(mappedEnv.PROOF_ARCHIVE)
                     : null;
                 if (!proofArchive) {
                     return new Response(JSON.stringify({
@@ -874,7 +1232,7 @@ export function createMCPICloudflareAdapter(config) {
                 if (url.pathname === "/admin/stats") {
                     try {
                         const [noncesList, proofStats] = await Promise.all([
-                            env.NONCE_CACHE.list({ prefix: "nonce:" }),
+                            mappedEnv.NONCE_CACHE.list({ prefix: "nonce:" }),
                             proofArchive.getStats(),
                         ]);
                         return new Response(JSON.stringify({