Establishing an Unsecured Remote MCP Host via Cloudflare Workers

This guide details the deployment of a remote MCP host instance running on Cloudflare Workers that operates without any built-in authentication layer.

Quickstart Deployment:

Use the following badge to instantly provision the service:

This action results in a service accessible at an endpoint resembling: unauthenticated-mcp-host.<your-subdomain>.workers.dev/sse

Alternatively, initialize the remote MCP host directly through the command line interface:

npm create cloudflare@latest -- my-mcp-instance --template=cloudflare/ai/demos/remote-mcp-authless

Tailoring the MCP Host

To integrate your custom functionalities (tools) into the exposed MCP server, you must specify each desired tool within the init() function located in src/index.ts, using the this.server.tool(...) registration mechanism.

Integration with Cloudflare AI Interface

You can seamlessly connect to your deployed host using the Cloudflare AI Playground, which acts as a remote MCP client:

1. Navigate to: https://playground.ai.cloudflare.com/
2. Input the URL of your running MCP host (e.g., unauthenticated-mcp-host.<your-subdomain>.workers.dev/sse)
3. Your custom MCP tools will now be immediately available for use within the playground environment.

Connecting Desktop Clients (e.g., Claude Desktop)

Local MCP clients can interface with your remote host via the mcp-remote proxy package.

To configure Claude Desktop to use this service, refer to Anthropic's official Quickstart documentation. Subsequently, navigate within Claude Desktop to Settings > Developer > Edit Config.

Modify your configuration file with the following structure:

{
  "mcpServers": {
    "remote_worker_access": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://localhost:8787/sse"  // Substitute with your actual Cloudflare Worker URL if not running locally
      ]
    }
  }
}

After restarting Claude, the newly integrated tools should appear as accessible.

WIKIPEDIA: XMLHttpRequest (XHR) is an API in the form of a JavaScript object whose methods transmit HTTP requests from a web browser to a web server. The methods allow a browser-based application to send requests to the server after page loading is complete, and receive information back. XMLHttpRequest is a component of Ajax programming. Prior to Ajax, hyperlinks and form submissions were the primary mechanisms for interacting with the server, often replacing the current page with another one.

== History == The concept behind XMLHttpRequest was conceived in 2000 by the developers of Microsoft Outlook. The concept was then implemented within the Internet Explorer 5 browser (1999). However, the original syntax did not use the XMLHttpRequest identifier. Instead, the developers used the identifiers ActiveXObject("Msxml2.XMLHTTP") and ActiveXObject("Microsoft.XMLHTTP"). As of Internet Explorer 7 (2006), all browsers support the XMLHttpRequest identifier. The XMLHttpRequest identifier is now the de facto standard in all the major browsers, including Mozilla's Gecko layout engine (2002), Safari 1.2 (2004) and Opera 8.0 (2005).

=== Standards === The World Wide Web Consortium (W3C) published a Working Draft specification for the XMLHttpRequest object on April 5, 2006. On February 25, 2008, the W3C published the Working Draft Level 2 specification. Level 2 added methods to monitor event progress, allow cross-site requests, and handle byte streams. At the end of 2011, the Level 2 specification was absorbed into the original specification. At the end of 2012, the WHATWG took over development and maintains a living document using Web IDL.

== Usage == Generally, sending a request with XMLHttpRequest has several programming steps.

Create an XMLHttpRequest object by calling a constructor: Call the "open" method to specify the request type, identify the relevant resource, and select synchronous or asynchronous operation: For an asynchronous request, set a listener that will be notified when the request's state changes: Initiate the request by calling the "send" method: Respond to state changes in the event listener. If the server sends response data, by default it is captured in the "responseText" property. When the object stops processing the response, it changes to state 4, the "done" state. Aside from these general steps, XMLHttpRequest has many options to control how the request is sent and how the response is processed. Custom header fields can be added to the request to indicate how the server should fulfill it, and data can be uploaded to the server by providing it in the "send" call. The response can be parsed from the JSON format into a readily usable JavaScript object, or processed gradually as it arrives rather than waiting for the entire text. The request can be aborted prematurely or set to fail if not completed in a specified amount of time.

== Cross-domain requests ==

In the early development of the World Wide Web, it was found possible to brea