MCP deployment guide: zero-ops edge publishing with Cloudflare Pages
Git-driven MCP deployment in practice: commit to build, atomic publish to every edge node.
Quick answer
Can MCP stdio and HTTP transports be mixed?
No — one Server picks one transport. Remote endpoints must use Bearer auth with the scope minimized to read-only, or you are effectively shipping your source naked.
Machine-readable page data: /data/mcp-deployment-guide.json
In-depth analysis
MCP (Model Context Protocol) is an open standard released in 2024 that lets large language models connect to tools and data sources through one uniform protocol. Write a Server once and any MCP-compatible agent (Claude Desktop, Cursor) discovers and calls it. At deploy time hand the built artifact to the edge platform and lean on static fallback plus security headers to hold the line on stability.
// mcp-server.ts — @modelcontextprotocol/sdk ^1.0 stdio read-only Server
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
const server = new McpServer({ name: 'docs-readonly', version: '1.0.0' });
server.tool('read_doc', { path: schema.string() }, async ({ path }) => {
// scope is minimized to read-only — never expose write or full filesystem access
return { content: [{ type: 'text', text: readAllowed(path) }] };
});
const transport = new StdioServerTransport();
await server.connect(transport);
// Client registration in claude_desktop_config.json:
// "mcpServers": { "docs": { "command": "node", "args": ["mcp-server.ts"] } }MCP Deployment Guide · Key takeaways
- astro.config has a single source-of-truth site value
- public/_headers declares nosniff and HSTS
- 404 returns a real 404
- Preview passes all 8 edge drills
FAQ & pitfalls
How do I authenticate an MCP Server deployed at the edge?
Remote MCP uses Bearer-authenticated SSE or HTTP, with scope limited to read-only tools. Local stdio stays off the network — never expose it to avoid privilege escalation.
Explore the hub
See all 5 guides in AI AgentsSame category as this article, sorted across the codebase.
AEO architecture: layered patterns for high-concurrency edge apps
The edge-delivery view of AEO's layering and data flow.
AEO best practices: engineering conventions for production
Field-tested AEO practices from production, avoiding the common anti-patterns.
AEO deployment guide: zero-ops edge publishing with Cloudflare Pages
Git-driven AEO deployment in practice: commit to build, atomic publish to every edge node.
AEO engineering practice: a full guide from architecture to production
Production architecture and core pain points for AEO.
Share & save
What readers are asking
Questions that keep coming back in reader feedback, already answered.
- 01
Can one MCP server speak both stdio and HTTP?
No — a server picks a single transport. A remote endpoint must carry Bearer auth and scope its tools to read-only, otherwise you are exposing source execution to the public internet.
See the full guide → - 02
How should auth work when an MCP server runs at the edge?
Remote MCP goes over SSE or HTTP with a Bearer token, and tools get read-only scope; local stdio is never network-exposed. Do not put both transports behind the same server.
See the full guide → - 03
Why is my Astro component's interactivity not working?
Components ship as zero-JS HTML by default, so an interactive one needs a client:* directive (client:load, client:visible, …). Without it the script is never bundled into the page.
See the full guide →