JA EN
shiichan

Cloudflare Access MCP Server Portals Can Now Connect to Slack and GitHub!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#ai#security

Hi, it's Shiichan! I found a small-but-important MCP update, so let's dig in.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that Access MCP server portals can now connect to upstream MCP servers that require a pre-registered OAuth client. When adding an MCP server, administrators can now enter the client ID and client secret from an OAuth application they registered directly with the upstream provider.

The story so far

Until now, MCP server portals relied on Dynamic Client Registration (DCR) to automatically register an OAuth client with the upstream server. But plenty of OAuth providers don't support DCR, or have it disabled — and that includes the MCP servers for major SaaS platforms like Slack and GitHub. That meant portals simply couldn't connect to some of the most commonly requested upstream servers.

What changes

Administrators can now manually configure the client ID and client secret from an OAuth app pre-registered with the upstream provider, so portal connections no longer depend on DCR. That unlocks portal connections to providers like Slack and GitHub, whose MCP servers don't support DCR yet. Users still authenticate to the upstream server with their own accounts when connecting through the portal — that part hasn't changed.

Dive Deep

The manual OAuth credential setup supports:

  • Client ID and client secret from the OAuth app registered with the upstream provider
  • Custom OAuth endpoints
  • Custom scopes
  • Token endpoint authentication methods: client_secret_post and client_secret_basic

Cloudflare stores the client secret encrypted. For the full setup steps, check the "Configure manual OAuth credentials" documentation.

Wrap-up

  • MCP server portals can now connect to upstream servers that require pre-registered OAuth clients
  • This removes the DCR blocker for Slack and GitHub MCP servers
  • Admins can set the client ID, secret, custom endpoints, scopes, and auth method by hand
  • Client secrets are stored encrypted; users still authenticate with their own accounts as before

If you're an admin trying to roll out Slack or GitHub MCP servers to your team through Cloudflare Access, this update is for you!

Related posts