a2a-exposed 0.4.1 → 0.5.0

package/lib/commands.mjs

@@ -101,6 +101,11 @@ export async function token(action, label, o) {
 			const via = r.source === "pairing" ? `\tvia pairing: code ${r.user_code || "?"}${r.client_name ? `, ${JSON.stringify(r.client_name)}` : ""}` : "";
 			console.log(`${r.label}\tcreated=${r.created_at}\t${r.revoked_at ? "REVOKED " + r.revoked_at : "active"}${via}`);
 		}
+		// MCP connectors (Worker 0.5+): their own tokens, listed and revoked by label like peer tokens
+		const m = await ownerTry("GET", "/owner/mcp").catch(() => null);
+		if (m && m.status === 200 && m.data && Array.isArray(m.data.grants))
+			for (const g of m.data.grants)
+				console.log(`${g.label}\tcreated=${g.created_at}\t${g.revoked_at ? "REVOKED " + g.revoked_at : "active"}\tMCP connector: ${JSON.stringify(g.client_name || "?")} -> ${g.redirect_host}${g.last_used_at ? `, last used ${g.last_used_at}` : ""}`);
 		return;
 	}
 	if (!label) die("label required");
@@ -118,6 +123,14 @@ export async function token(action, label, o) {
 			if (o.json) return out({ revoked: true, label });
 			return console.log(`revoked ${label}: its token gets HTTP 401 from now on`);
 		}
+		if (r.status === 404) {
+			// not a peer token: maybe an MCP connector
+			const m = await ownerTry("DELETE", `/owner/mcp/${q(label)}`).catch(() => null);
+			if (m && m.status === 200 && m.data && m.data.revoked === true) {
+				if (o.json) return out({ revoked: true, label, kind: "mcp" });
+				return console.log(`revoked ${label}: that MCP connector gets HTTP 401 from now on (remove it in the client, or reconnect to approve it again)`);
+			}
+		}
 		if (r.status === 404 || (r.status === 200 && r.data && r.data.revoked === false))
 			die((r.data && r.data.error) || `no active token with label ${label} (see: a2a-exposed token list)`);
 		die(`could not revoke ${label}: ${describeHttp(r.status, r.data)}`);
@@ -157,7 +170,35 @@ function resolvePeer(to) {
 	die(`unknown peer alias ${JSON.stringify(to)} (see: a2a-exposed peers list)`);
 }
 
+/** peers sync [alias...]: upload outbound peers (URL + token, encrypted on the Worker with a key derived from the owner
+ *  token) so the MCP connector's send / poll_outbound tools can reach them. peers unsync <alias>: remove one. */
+async function peersRemote(sub, args) {
+	if (sub === "unsync") {
+		if (!args.length) die("usage: peers unsync <alias>...");
+		for (const alias of args) {
+			const r = await ownerTry("DELETE", `/owner/outbound-peers/${q(alias)}`);
+			if (r.status !== 200) die((r.data && r.data.error) || `could not unsync ${alias}: ${describeHttp(r.status, r.data)}`);
+			console.log(`unsynced ${alias}: the connector can no longer send to it`);
+		}
+		return;
+	}
+	const all = C.loadPeers();
+	const list = args.length ? args : Object.keys(all);
+	if (!list.length) die("no peers to sync: add one first (a2a-exposed connect <url> or peers add)");
+	for (const alias of list) {
+		const pe = all[alias];
+		if (!pe) die(`unknown peer alias ${JSON.stringify(alias)} (see: a2a-exposed peers list)`);
+		const tok = peerToken(pe.token_env);
+		const r = await ownerTry("PUT", `/owner/outbound-peers/${q(alias)}`, { url: pe.url.replace(/\/$/, ""), ...(tok ? { token: tok } : {}) });
+		if (r.status === 404) die("this Worker has no MCP support yet: redeploy (a2a-exposed deploy) and try again");
+		if (r.status !== 200) die(`could not sync ${alias}: ${(r.data && r.data.error) || describeHttp(r.status, r.data)}`);
+		console.log(`synced ${alias}\t${pe.url}\t${tok ? "token stored encrypted on the Worker" : "no token"}`);
+	}
+	console.error("# the MCP connector's send tool can now reach these peers; re-run after connect / token changes or an owner-token rotation");
+}
+
 export function peers(sub, args, o) {
+	if (sub === "sync" || sub === "unsync") return peersRemote(sub, args);
 	const all = C.loadPeers();
 	if (sub === "add") {
 		const [alias, url] = args;

package/lib/deploy.mjs

@@ -11,6 +11,19 @@ import { readHidden } from "./pair.mjs";
 import * as WD from "./workersdev.mjs";
 
 const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+/** Each Claude Code routine fire is a new cloud session: a 2xx only means a session started. */
+export const CLAUDE_CODE_NOTE = [
+	"note (claude-code): each fire starts a NEW cloud session, which sees only what the routine provides.",
+	"  Simplest: add this inbox as a connector at claude.ai/settings/connectors (URL: <your Worker URL>/mcp, approve with",
+	"  your approval password) and keep it enabled on the routine; the session then uses its tools, no CLI or token needed.",
+	"  Without the connector (CLI fallback), check that",
+	"  - the repo with the committed skills (.claude/skills/) is a routine source and the skills are on its default branch,",
+	"  - A2A_BASE_URL and A2A_OWNER_TOKEN are set on the routine's cloud environment (not only in this session),",
+	"  - the environment's network access allows this Worker's hostname,",
+	"  - the routine prompt tells Claude to act on the routine-fire-payload block.",
+	"  Then open the new session from the routine's runs and confirm it ran the inbox command without errors.",
+].join("\n");
+
 const PRESETS = ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "generic"];
 // WAKE_ACCESS_*: Cloudflare Access service token for a wake URL behind Access (set by `tunnel create`, or exported
 // by hand for your own Access-protected endpoint)
@@ -27,7 +40,7 @@ const DEPLOY_KEYS = [
 	"A2A_PROVIDER_ORGANIZATION", "A2A_PROVIDER_URL", "A2A_DOCUMENTATION_URL",
 	"WAKE_PRESET", "WAKE_AGENT_ID", "WAKE_KEY_HEADER", "WAKE_KEY_PREFIX", "WAKE_BODY_TEMPLATE", "WAKE_CLI_COMMAND",
 	"WAKE_DEBOUNCE_SECONDS", "WAKE_MAX_PER_HOUR", "A2A_MAX_BODY", "A2A_RATE_PER_MIN", "A2A_ENABLE_CRON",
-	"A2A_WORKERS_DEV_SUBDOMAIN", "A2A_RETIRED_HOSTNAMES", "PAIRING_APPROVAL", "A2A_PBKDF2_ITERATIONS", "A2A_WORKERS_LOGS",
+	"A2A_WORKERS_DEV_SUBDOMAIN", "A2A_RETIRED_HOSTNAMES", "PAIRING_APPROVAL", "A2A_PBKDF2_ITERATIONS", "A2A_WORKERS_LOGS", "A2A_MCP",
 	"A2A_UPSTREAM_URL", "A2A_UPSTREAM_CARD_URL",
 ];
 // init/deploy flag -> config key
@@ -37,7 +50,7 @@ const FLAG_KEYS = {
 	"provider-organization": "A2A_PROVIDER_ORGANIZATION", "provider-url": "A2A_PROVIDER_URL",
 	preset: "WAKE_PRESET", "agent-id": "WAKE_AGENT_ID", "key-header": "WAKE_KEY_HEADER", "key-prefix": "WAKE_KEY_PREFIX",
 	"body-template": "WAKE_BODY_TEMPLATE", "cli-command": "WAKE_CLI_COMMAND", debounce: "WAKE_DEBOUNCE_SECONDS", "max-per-hour": "WAKE_MAX_PER_HOUR",
-	"pairing-approval": "PAIRING_APPROVAL", "pbkdf2-iterations": "A2A_PBKDF2_ITERATIONS", "workers-logs": "A2A_WORKERS_LOGS",
+	"pairing-approval": "PAIRING_APPROVAL", "pbkdf2-iterations": "A2A_PBKDF2_ITERATIONS", "workers-logs": "A2A_WORKERS_LOGS", mcp: "A2A_MCP",
 	upstream: "A2A_UPSTREAM_URL", "upstream-card-url": "A2A_UPSTREAM_CARD_URL",
 };
 export const PAIRING_MODES = ["human", "agent", "off"];
@@ -194,6 +207,10 @@ function applyFlags(o) {
 			die("--pbkdf2-iterations must be an integer from 50000 to 100000 (default 100000, the Workers maximum; lower it only if /device approvals hit Cloudflare error 1102, the CPU limit)");
 		upd.A2A_PBKDF2_ITERATIONS = String(n);
 	}
+	if (upd.A2A_MCP !== undefined) {
+		if (!["on", "off"].includes(upd.A2A_MCP)) die("--mcp must be on or off (the remote MCP server at /mcp that Claude and other MCP clients add as a connector; default on)");
+		upd.A2A_MCP = upd.A2A_MCP === "off" ? "off" : null;
+	}
 	if (upd.A2A_WORKERS_LOGS !== undefined) {
 		if (!["on", "off"].includes(upd.A2A_WORKERS_LOGS)) die("--workers-logs must be on or off (Cloudflare Workers Logs: persisted, searchable Worker logs; query strings redacted)");
 		upd.A2A_WORKERS_LOGS = upd.A2A_WORKERS_LOGS === "on" ? "1" : null;
@@ -556,6 +573,7 @@ export async function wake(sub, o) {
 			die("no wake webhook configured on the Worker: export WAKE_WEBHOOK_URL (and WAKE_WEBHOOK_KEY or WAKE_HMAC_SECRET), then run `a2a-exposed wake set` first (or use polling)");
 		console.log(JSON.stringify(r, null, 2));
 		if (!(r.status >= 200 && r.status < 300)) process.exitCode = 1;
+		else if (C.get("WAKE_PRESET") === "claude-code") console.error(CLAUDE_CODE_NOTE);
 		return;
 	}
 	if (sub === "set") {
@@ -564,7 +582,9 @@ export async function wake(sub, o) {
 		if (!Object.keys(secrets).length && !DEPLOY_FLAGS.some((f) => o[f] !== undefined))
 			die("nothing to set: export WAKE_WEBHOOK_URL / WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET and/or pass --preset etc.");
 		await deploy(o); // wake set = save settings + upload secrets + redeploy, in one step
-		return console.error("wake settings deployed. Next: a2a-exposed wake preview, then a2a-exposed wake test");
+		console.error("wake settings deployed. Next: a2a-exposed wake preview, then a2a-exposed wake test");
+		if (C.get("WAKE_PRESET") === "claude-code") console.error(CLAUDE_CODE_NOTE);
+		return;
 	}
 	if (sub === "unset") {
 		const dir = workerDir(o), name = workerName();

package/lib/main.mjs

@@ -22,7 +22,7 @@ CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
        [--agent-name N] [--agent-description D] [--agent-skills JSON]
        [--provider-organization O --provider-url U] [--preset P] [--worker-name W] [--d1-name D]
        [--account-id ID] [--cf-profile NAME] [--cli-command CMD] [--debounce S] [--max-per-hour N]
-       [--pairing-approval human|agent|off] [--pbkdf2-iterations N] [--workers-logs on|off] [--cron]
+       [--pairing-approval human|agent|off] [--pbkdf2-iterations N] [--workers-logs on|off] [--mcp on|off] [--cron]
        [--upstream URL [--upstream-card-url URL] [--upstream-token-stdin | --no-upstream-token]] [--worker-dir DIR]
                                 deploy the Worker + D1 to your account; wake secrets are read from
                                 env WAKE_WEBHOOK_URL / WAKE_WEBHOOK_KEY / WAKE_HMAC_SECRET (never argv)
@@ -39,6 +39,8 @@ CLOUDFLARE_API_TOKEN instead: setup skill, Troubleshooting)
                                 --pbkdf2-iterations  approval-password hashing cost, 50000-100000 (default 100000,
                                                the Workers maximum; lower only if /device hits error 1102)
                                 --workers-logs on|off  persisted Cloudflare Workers Logs (query strings redacted)
+                                --mcp on|off   remote MCP server at <url>/mcp for Claude and other MCP clients
+                                               (default on; each client needs your approval password once)
                                 --upstream URL  proxy / expose mode: a public façade for an agent that already
                                                speaks A2A (JSON-RPC) on a private network. URL is its endpoint on
                                                a Cloudflare Tunnel hostname behind Access (never a Tailnet/LAN
@@ -133,12 +135,16 @@ Pairing (OAuth 2.0 device flow, RFC 8628: agents connect without pasting tokens
 Inbound peer tokens (one per peer label; paired agents get one too)
   token issue <label>     print a new token once (fails if the label is active); manual fallback to \`connect\`
   token rotate <label>    replace the label's token
-  token list | token revoke <label>        list shows how each token was created (pairing: code + date);
+  token list | token revoke <label>        list shows how each token was created (pairing: code + date)
+                                           and MCP connectors (label mcp-*); revoke works for both;
                                            revoke of an unknown label exits 1
 
 Outbound (agents you call)
   peers add <alias> <url> [--token-env VAR | --token-stdin]
   peers list | peers rm <alias>
+  peers sync [alias...] | peers unsync <alias>
+                          upload peers (URL + token, encrypted on the Worker) so the MCP connector can send to
+                          them; default: all peers. Re-run after connect, token changes or an owner-token rotation
                           a token variable set in the environment overrides config.env; when a peer token
                           differs between the two, connect/send/poll/peers/status warn (values never shown)
   send --to <alias|url> [--text T | stdin] [--context C] [--task T] [--push] [--proto 0.3|1.0]

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "a2a-exposed",
-	"version": "0.4.1",
+	"version": "0.5.0",
 	"description": "Give any AI agent a public A2A (Agent2Agent) endpoint: Cloudflare Worker inbox + wake webhook or scheduled inbox checks",
 	"type": "module",
 	"bin": {

package/worker/cloudflare.config.ts

@@ -39,6 +39,7 @@ const plain: Record<string, string> = {
 	RATE_PER_MIN: v("A2A_RATE_PER_MIN"),
 	RETIRED_HOSTNAMES: v("A2A_RETIRED_HOSTNAMES"), // custom domains this agent moved away from (see movedResponse)
 	PAIRING_APPROVAL: v("PAIRING_APPROVAL") || "human", // device-flow pairing: human (approval password on /device) | agent | off
+	MCP: v("A2A_MCP"), // remote MCP server at /mcp (connector for Claude etc.): on unless "off"; never in proxy mode
 	PBKDF2_ITERATIONS: v("A2A_PBKDF2_ITERATIONS"), // approval password hashing; default 100000 (the Workers maximum), at least 50000
 	// proxy / expose mode: forward A2A to an agent that already speaks it, published through a Tunnel hostname behind
 	// Access (never a Tailnet / LAN URL: the Worker can't reach those, and they never appear in the public card)

package/worker/migrations/0006_mcp.sql

@@ -0,0 +1,43 @@
+-- Remote MCP server (/mcp): OAuth 2.1 clients (dynamic registration), one-time authorization codes, and the grants
+-- (owner-approved, inbox-scoped tokens) that `token list` shows and `token revoke` ends. Peer tokens stay in `peers`
+-- and are never accepted on /mcp; MCP tokens are never accepted on the A2A endpoint or /owner/*.
+CREATE TABLE IF NOT EXISTS oauth_clients (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris_json TEXT NOT NULL,
+	created_ms INTEGER NOT NULL,
+	ip TEXT
+);
+CREATE TABLE IF NOT EXISTS oauth_codes (
+	code_hash TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	redirect_uri TEXT NOT NULL,
+	code_challenge TEXT NOT NULL,
+	scope TEXT NOT NULL,
+	resource TEXT NOT NULL,
+	created_ms INTEGER NOT NULL,
+	expires_ms INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS mcp_grants (
+	label TEXT PRIMARY KEY,
+	client_id TEXT NOT NULL,
+	client_name TEXT,
+	redirect_host TEXT,
+	scope TEXT NOT NULL,
+	access_hash TEXT UNIQUE,
+	access_expires_ms INTEGER,
+	refresh_hash TEXT UNIQUE,
+	refresh_expires_ms INTEGER,
+	created_at TEXT NOT NULL,
+	last_used_at TEXT,
+	revoked_at TEXT
+);
+-- Peers this inbox sends to from the Worker (MCP `send` / `poll_outbound`), uploaded by `peers sync`. The token is
+-- AES-GCM ciphertext under a key derived from the Worker's OWNER_TOKEN secret, so a D1 export alone doesn't reveal it.
+CREATE TABLE IF NOT EXISTS outbound_peers (
+	alias TEXT PRIMARY KEY,
+	url TEXT NOT NULL,
+	token_enc TEXT,
+	created_at TEXT NOT NULL,
+	updated_at TEXT NOT NULL
+);

package/worker/migrations/0007_cimd.sql

@@ -0,0 +1,10 @@
+-- MCP authorization (2026-07-28): OAuth Client ID Metadata Documents. A client_id that is an https URL names a JSON
+-- document the Worker fetches (SSRF-guarded, 5 KB, 5 s) and validates; valid documents are cached here for their
+-- Cache-Control max-age (60 s - 24 h, default 1 h). Errors and invalid documents are never cached.
+CREATE TABLE IF NOT EXISTS oauth_client_metadata (
+	client_id TEXT PRIMARY KEY,
+	client_name TEXT,
+	redirect_uris_json TEXT NOT NULL,
+	fetched_ms INTEGER NOT NULL,
+	expires_ms INTEGER NOT NULL
+);