M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
C

Cloudflare Workers Next.js SaaS Template

Community
A complete Next.js SaaS template for Cloudflare Workers, featuring authentication, subscription billing, and an AI agent platform (including MCP)
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #327 of 438
Stars
★ 786 Very popular
Transport
Streamable HTTP
Runtime
Node.js · Hosted (no local runtime)
Credentials
API key / credential required
License
MIT
Last commit
Tools
1
43FMRS · D

This template is feature-rich but complex, suitable for experienced developers. Its MCP server integration is well-designed, with tools auto-derived from OpenAPI and support for multiple client connection methods.

Strongest · Documentation 12/20 Weakest · Reliability 5/20

Reliability
5/20
Security and permissions
8/20
Maintenance
10/20
Documentation
12/20
Setup experience
8/20
Why each score
Reliability 5/20
Only the README and repository metadata were supplied; no executable source, CI config, or test files were provided. The README claims an /mcp Streamable HTTP endpoint, tools derived from the OpenAPI document, and unit/integration/E2E tests, but with no source files the init/tool-list handshake and tool behavior are entirely unverifiable. No internal contradictions were found and the happy path seems plausible; per the static calibration, without verifiable execution evidence reliability cannot exceed 12. Deductions: no source-level verification, no committed tests to confirm behavior, and the MCP server is only a small part of a large experimental (Vinext) application.
Security and permissions 8/20
No red-line issue is evident from the supplied material: no real tokens or secrets in examples, no covert exfiltration or malicious behavior described. The README describes a fairly least-privilege-conscious design: API keys stored hashed with one-time secret display, scope-based tool filtering, per-credential rate limits, an OAuth consent screen, self-service revocation, and admin verification for dynamically registered OAuth apps. However, the template exposes a large attack surface (public API, OAuth 2.1 authorization server, dynamic client registration, Stripe subscription webhook, admin dashboard) and the implementation cannot be audited from the supplied files; confirmation mechanisms for side-effect operations such as deploy and payment are not documented in the provided material. Deductions: no source to audit, broad attack surface, least-privilege implementation unverifiable.
Maintenance 10/20
Metadata shows the repository is not archived, has an MIT license, and only 1 open issue; the README is detailed and includes a CI badge, and it documents recently added features (i18n, AI-agent platform, yearly billing), indicating an active and evolving project. However, the supplied material contains no commit history, release records, or dependency-update evidence; stars are only a discovery signal and add no points. Deductions: release cadence, issue responsiveness, and security-reporting channel are unverifiable.
Documentation 12/20
The README is layered documentation covering local setup, Stripe billing, the public API/OAuth/MCP surface, a command reference, a production deployment skill, extension guides, and connection examples for Claude Code, claude.ai, ChatGPT, Cursor, VS Code, Codex, Antigravity, and Grok CLI, while disclosing Vinext's experimental status and database migration preflight checks. However, the README is untrusted evidence and no in-source docs were available to cross-check; troubleshooting for the MCP endpoint itself is thin. Deductions: doc-to-implementation correspondence unverifiable, no dedicated MCP troubleshooting guidance.
Setup experience 8/20
The README provides a clear from-scratch command sequence (pnpm install, wrangler login, copying .env, database migrations, seed, dev), and the MCP connection path is clear: paste the remote MCP URL and approve OAuth consent, or send a Bearer API key, with ready-made snippets for mainstream clients. But a full setup depends on a Cloudflare account plus D1/KV/R2, Turnstile, Email, Stripe, and other external services, and it runs on the experimental Vinext/Vite toolchain — manual and fragile; no verifiable CI/execution evidence exists in the supplied files, so per the static calibration this cannot exceed 15. Deductions: many steps, heavy external dependencies, experimental runtime.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account dataConnects to a database

Best for

  • Developers who want to rapidly bootstrap a SaaS product with a built-in AI platform and MCP functionality
  • Teams that need comprehensive authentication and authorization for AI agents (OAuth, API keys)

Not for

  • Simple projects that do not need AI agent features or an MCP server
  • Deployments that require a Node.js server instead of Cloudflare Workers

Required permissions

  • Requires a Cloudflare account and relevant Worker bindings (D1, KV, R2, AI, etc.)
  • Requires a Stripe account and API keys to enable billing features
  • Requires configuring Turnstile keys for CAPTCHA

Risks and side effects

  • The template is experimental; Vinext and Cloudflare's MCP components may change
  • The MCP server allows AI agents to access your public API's power; if API keys or OAuth credentials leak, it could lead to unauthorized access
  • Deployment configuration is complex and requires careful setting of environment variables and bindings

Setup

Before you start

Runtime：Node.js · Hosted (no local runtime)

STRIPE_SECRET_KEY optionalsecret Stripe secret key (sk_test_...) from the Stripe dashboard; required to enable billing.
STRIPE_WEBHOOK_SECRET optionalsecret Stripe webhook signing secret (whsec_...) from stripe listen or a Dashboard webhook endpoint.
Other optional settings (6)
OAUTH_OPEN_DCR_ENABLED optional Toggles OAuth dynamic client registration; when on, unverified clients are clamped to DCR_ALLOWED_SCOPES.
DCR_ALLOWED_SCOPES optional Ceiling of scopes allowed for self-registered OAuth clients, set server-side.
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY optional Stripe publishable key (pk_test_...) from the Stripe dashboard.
STRIPE_PRICE_PRO optional Price ID for the Pro plan, auto-written to .env by pnpm stripe:setup.
STRIPE_PRICE_ENTERPRISE optional Price ID for the Enterprise plan, auto-written to .env by pnpm stripe:setup.
STRIPE_PORTAL_CONFIG_ID optional Stripe Customer Portal configuration ID, auto-written to .env by pnpm stripe:setup.

This template requires self-deployment. After deployment, the MCP server endpoint is at /mcp. To connect, point an MCP client to that URL. For CLI and editor clients, you can use an Authorization: Bearer header (with an API key) or the OAuth flow.

Check that it works

Add the MCP URL (the service's /mcp endpoint, Streamable HTTP) to a client such as Claude Code or Cursor; after completing the OAuth consent flow or providing an API key, the client's tool list should show tools derived from the OpenAPI document filtered by your scopes.

Troubleshooting

  1. Ensure Cloudflare bindings (such as `OAUTH_KV`) in `wrangler.jsonc` are configured correctly
  2. Run `pnpm run typecheck` and `pnpm run lint` to check for code errors
  3. Use `pnpm run test:e2e` to test end-to-end flows
  4. Check API key prefixes in `src/constants.ts` to ensure they are rebranded for your project

Things to try

Once connected, you can ask your AI assistant things like:

  • Connect to my MCP server at /mcp and list the tools my credential is allowed to call
  • Use my API key as a Bearer token to connect to this MCP endpoint and call a read-only API tool
  • Call one of the tools derived from the OpenAPI document and show me the response

Tools 1

mcp_server
Exposes tools derived from the OpenAPI document, allowing AI agents to interact with the SaaS platform's public API.

Use cases

Provide AI agent integrations for your SaaS app, allowing them to perform API actions (like managing resources)
Use the MCP server as a remote MCP endpoint for clients like Claude Code, ChatGPT, Cursor, etc.

Supported clients

Claude Code
Claude.ai
ChatGPT
Cursor
VS Code
Codex
Antigravity
Grok CLI

Listed from the project's documentation, not tested by this site.

Overview

This is an open-source SaaS template for running a Next.js app on Cloudflare Workers. It uses Vinext (Cloudflare's experimental Vite-based implementation of Next.js) as the build and dev toolchain, supporting App Router, React Server Components, and more. The template integrates user authentication (Lucia Auth), database (Drizzle + D1), email service, team subscription billing (Stripe), content management system, admin dashboard, and an AI agent platform including a public REST API, OAuth 2.1, and a remote MCP server. The MCP server derives its tools from an OpenAPI document and supports authentication via OAuth or API keys.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 8e0dbbfc7d22 Data synced 2026-10-12 Read the FMRS scoring method