[mattzcarey]

createMcpHandler now works with @cloudflare/workers-oauth-provider 1.x: tool callbacks get context.http.authInfo (token, client ID, scopes, expiry, resource) behind both OAuthProvider and OAuthResourceServer. The authenticated MCP example moves to 1.2.4, and the security doc explains the library's consent and sign-in APIs.

• ctx.auth. The handler only read a verified-context.v1 symbol, which no provider release ever set, so authInfo was always empty and only getMcpAuthContext().props worked. Provider 1.x puts the verified token on the execution context as ctx.auth. src/mcp/server/auth-context.ts now maps that to SDK v2 AuthInfo when the symbol is absent. A ctx.auth without a client ID, or in the wrong shape, is ignored, and props still flow as before.

• examples/mcp-worker-authenticated. Bumped to ^1.2.4 and kept the single-Worker OAuthProvider. 1.x requires resourceMetadata.resource, the URL every token is bound to, so the example reads it from an MCP_RESOURCE var, as cloudflare-mcp does. The default is the vite dev URL.

• Docs. securing-mcp-servers.md replaces the hand-rolled CSRF, state and approved-client cookie code with the library's describeConsent / beginConsent / approveConsent / denyConsent / isConsentRemembered and beginUpstream / finishUpstream helpers, plus insufficientScope() for step-up. mcp-servers.md adds resourceMetadata to its OAuthProvider snippet.

• New tests in handler-stateless.test.ts cover ctx.auth mapping and the no-client-ID fallback. Workers MCP tests ran.

• Ran the example with vite dev: /mcp returns 401 pointing at http://localhost:5173/.well-known/oauth-protected-resource/mcp, which reports the configured resource.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: b0ea890

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
agents	Patch
@cloudflare/agent-think	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[agent-think]

✅ agents import sizes: no significant changes (15e9b625 → b0ea890e, workflow run)

[pkg-pr-new]

Open in StackBlitz

agents

npm i https://pkg.pr.new/agents@2680

@cloudflare/ai-chat

npm i https://pkg.pr.new/@cloudflare/ai-chat@2680

@cloudflare/codemode

npm i https://pkg.pr.new/@cloudflare/codemode@2680

hono-agents

npm i https://pkg.pr.new/hono-agents@2680

@cloudflare/shell

npm i https://pkg.pr.new/@cloudflare/shell@2680

@cloudflare/think

npm i https://pkg.pr.new/@cloudflare/think@2680

@cloudflare/voice

npm i https://pkg.pr.new/@cloudflare/voice@2680

@cloudflare/worker-bundler

npm i https://pkg.pr.new/@cloudflare/worker-bundler@2680

commit: b0ea890