Deploy to a web-standard runtime

The v2 handler accepts a web-standard Request and returns a Response. That fits Cloudflare Workers, Bun, Deno, and other fetch-based runtimes without a Node HTTP adapter.

For a Cloudflare Worker, point Wrangler at src/worker.ts. Keep the compatibility date current and do not add a secret to the public practice-data version.

The deployment boundary must provide more than routing:

• one HTTPS /mcp endpoint
• allowed host and origin validation
• request and response size limits
• timeouts and rate limits
• authentication before handler.fetch() for private data
• protected logs without request bodies or tokens

Start locally:

npx wrangler dev

Use npx @modelcontextprotocol/inspector --help to confirm the current remote-transport flags, then connect the Inspector to the printed /mcp URL. Test discovery, both tools, the resource, and the prompt.

Check the endpoint’s negative behavior too. A different path should return 404. A disallowed origin or host should be rejected by your HTTP boundary. A malformed request must not produce a stack trace.

Deploy only after local HTTP tests pass:

npx wrangler deploy

Record the public endpoint, deployment version, SDK version, protocol revision, and test date in TESTING.md. Repeat the same matrix from a separate client session.

If you replace practice data with private notes, deploy authentication and authorization first. An unadvertised endpoint is still public when anyone can reach its URL.