MCP OAuth Cloudflare
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes dependencies from trusted organizations, including Cloudflare (@cloudflare/workers-oauth-provider, agents) and Anthropic (@modelcontextprotocol/sdk).- [SAFE]: Implements robust security patterns including CSRF protection via HttpOnly/SameSite cookies, one-time-use state validation in Workers KV, and SHA-256 session binding to prevent token theft.- [SAFE]: Sensitive credentials like Client Secrets and encryption keys are managed through standard platform secret storage (Cloudflare Secrets) rather than hardcoded values.- [SAFE]: Provides explicit documentation on known upstream vulnerabilities (e.g., RFC 8707 audience bugs) and provides specific implementation workarounds to ensure secure operation.- [SAFE]: Includes input sanitization utilities for text and URLs used in the authorization approval dialog to prevent cross-site scripting (XSS) and redirect attacks.
Audit Metadata