← Back to directory
M

MCP Boilerplate

Community
Archived
Framework / SDK
A remote Cloudflare MCP server boilerplate with user authentication and Stripe for paid tools.

This is a framework for building MCP servers or agents, not a server you connect a client to.

Category
Dev Tools #280 of 438
Stars
★ 1.0k Popular
Transport
SSE
Runtime
Node.js
Credentials
API key / credential required
License
MIT
Last commit
⚠
Tools
4
48FMRS · D

A comprehensive MCP server boilerplate particularly suited for deploying remote MCP servers on Cloudflare with paid features, but requires some familiarity with Cloudflare and Stripe.

Strongest · Documentation 14/20 Weakest · Maintenance 7/20

Reliability
8/20
Security and permissions
8/20
Maintenance
7/20
Documentation
14/20
Setup experience
11/20
Why each score
Reliability 8/20
The README describes a coherent Cloudflare Workers MCP server (SSE endpoint, Google/GitHub OAuth, KV-backed session storage, and free/paid tool registration via the Stripe agent toolkit); the happy path looks plausible and the project appears to be a real, polished boilerplate. However, this is a static review and the evidence contains no server manifest, no committed tests, and no CI workflow, so the init/tool-list handshake and the claimed tools cannot be verified against actual behavior. The README itself notes breakage with the latest MCP Inspector, and switching to GitHub auth requires manual source edits. Deducted for missing execution evidence and opaque edge cases/error handling.
Security and permissions 8/20
Credential handling is reasonable on paper: secrets live in .dev.vars locally and in Cloudflare secrets in production, all README examples use placeholders (no real tokens), OAuth uses official redirect URIs, and cookies are encrypted with a required 32+ character key. Payments require the user to complete Stripe's hosted checkout, so there is no auto-charge without confirmation; no red-line issue is triggered. Deducted because the actual implementation cannot be reviewed from the supplied evidence, the README instructs swapping auth handlers with `as any` casts, the Stripe integration is explicitly experimental, and there is no discussion of least privilege, data boundaries, rate limiting, or a security-response policy.
Maintenance 7/20
The repository is not archived and has an MIT license; the README references current versions (MCP Inspector 0.12.0 and the Stripe agent toolkit) and the maintainer's identity is clear. However, the provided material contains no verifiable commit/release history, changelog, dependency-update evidence, or security-response channel; stars and issue counts are discovery signals only and add no points. Deducted for the absence of observable governance and versioning evidence.
Documentation 14/20
The README is unusually thorough and layered for a boilerplate: prerequisites, step-by-step Cloudflare KV/OAuth/Stripe setup, local and production deployment, client configuration examples (Claude Desktop, MCP Inspector, Cloudflare AI Playground), templates for free/subscription/metered/one-time tools, and a specific troubleshooting note for the Stripe billing portal, with known limitations disclosed (e.g., the latest MCP Inspector does not work). Deducted because the documentation is README-only — there is no built-in tool parameter reference, API/error/limits documentation, architecture overview, or dedicated troubleshooting section, and some assumptions are hidden.
Setup experience 11/20
The README provides a complete, ordered path from clone to a running connection: dependency install, KV namespace creation, environment file setup, OAuth credentials, Stripe products, `wrangler dev`, and concrete client connection examples with commands and file snippets. Deducted because the path is inherently manual and fragile — several external accounts (Cloudflare, Google/GitHub, Stripe) must be configured, GitHub auth requires editing source code, and the README itself warns that the latest MCP Inspector cannot be used; no CI or committed tests provide verifiable execution evidence, so the score stays below the static calibration cap of 15.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

  • Developers needing a remote MCP server on Cloudflare quickly
  • Developers wanting to monetize MCP tools
  • Projects requiring user authentication

Not for

  • Local MCP servers
  • Developers preferring non-Cloudflare platforms
  • Simple projects without auth or payments

Required permissions

  • Cloudflare account access
  • Google or GitHub OAuth credentials
  • Stripe API keys

Risks and side effects

  • API keys and encryption keys must be kept secure
  • Incorrect Stripe configuration can cause payment issues
  • Cloudflare deployment may incur costs

Setup

Before you start

Runtime:Node.js

BASE_URL required Base URL of the server; http://localhost:8787 locally or your workers.dev URL in production.
COOKIE_ENCRYPTION_KEY requiredsecret Random key for encrypting login cookies; generate with openssl rand -hex 32.
GOOGLE_CLIENT_ID required OAuth client ID from Google Cloud Console, used for Google login.
GOOGLE_CLIENT_SECRET requiredsecret OAuth client secret from Google Cloud Console, used for Google login.
GITHUB_CLIENT_SECRET optionalsecret GitHub OAuth App Client Secret (optional, if using GitHub login).
STRIPE_SECRET_KEY requiredsecret Secret key (sk_test_...) from Stripe Dashboard > Developers > API keys.
STRIPE_SUBSCRIPTION_PRICE_ID required Stripe Price ID (price_...) of a recurring product, used for subscription paid tools.
STRIPE_METERED_PRICE_ID required Stripe Price ID of a metered product, used for usage-based paid tools.
STRIPE_WEBHOOK_SECRET optionalsecret Stripe webhook signing secret (whsec_..., optional, only needed if setting up webhooks).
Other optional settings (2)
GITHUB_CLIENT_ID optional GitHub OAuth App Client ID (optional, if using GitHub login).
STRIPE_ONE_TIME_PRICE_ID optional Stripe Price ID of a one-time payment product (optional, for one-time paid tools).

Clone the repository, npm install, create KV namespace OAUTH_KV, configure Google/GitHub OAuth, set up Stripe keys, fill in .dev.vars, run npx wrangler dev, then deploy.

Check that it works

After running npx wrangler dev, connect a client to http://localhost:8787/sse (e.g., Cloudflare AI Playground or Claude Desktop) and log in; the tools add, subscriptionAdd, meteredAdd, and onetimeAdd should appear, and calling add with two numbers should return their sum.

Troubleshooting

  1. Ensure the OAUTH_KV namespace name is correct
  2. Check that all secrets in .dev.vars are complete
  3. Verify Stripe price IDs are correct
  4. Confirm the Cloudflare Worker URL is properly configured

Things to try

Once connected, you can ask your AI assistant things like:

  • Use the add tool to compute 2 plus 3
  • Add 10 and 20 using the subscriptionAdd tool
  • Call the meteredAdd tool to calculate 7 plus 8
  • Use the onetimeAdd tool to sum 100 and 250

Tools 4

add read-only
Free tool example: adds two numbers.
subscriptionAdd read-only
Paid tool example: addition tool requiring a subscription.
meteredAdd read-only
Paid tool example: addition tool billed by usage.
onetimeAdd read-only
Paid tool example: addition tool with a one-time payment.

Use cases

Host a remote MCP server on Cloudflare
Add user authentication to MCP tools
Implement paid MCP tools via Stripe
Quickly prototype an MCP server

Supported clients

Claude Desktop
Cursor
Cloudflare AI Playground
MCP Inspector

Listed from the project's documentation, not tested by this site.

Overview

MCP Boilerplate is an open-source project to create your own remote MCP server on Cloudflare with user login (Google or GitHub) and Stripe payments (subscription, metered, or one-time). It provides a simple step-by-step setup guide making it accessible to non-experts.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →

Source revision e248a9fd5df7 Data synced 2026-10-12 Read the FMRS scoring method