Connect a Client¶

The MCP endpoint is https://365-mcp.example.com/sse and authentication is via the two service-token headers: CF-Access-Client-Id and CF-Access-Client-Secret.

Claude Code (CLI)¶

claude mcp add --transport http 365-mcp https://365-mcp.example.com/sse \
  --header "CF-Access-Client-Id: <client-id>.access" \
  --header "CF-Access-Client-Secret: <client-secret>" \
  -s user

Or add directly to ~/.claude.json under mcpServers:

"365-mcp": {
  "type": "http",
  "url": "https://365-mcp.example.com/sse",
  "headers": {
    "CF-Access-Client-Id": "<client-id>.access",
    "CF-Access-Client-Secret": "<client-secret>"
  }
}

Restart Claude Code; run /mcp to confirm it's connected.

Claude Desktop¶

Desktop's connector UI only does OAuth, so inject the headers via mcp-remote in claude_desktop_config.json:

{
  "mcpServers": {
    "365-mcp": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://365-mcp.example.com/sse",
        "--header", "CF-Access-Client-Id:${CF_ID}",
        "--header", "CF-Access-Client-Secret:${CF_SECRET}"
      ],
      "env": {
        "CF_ID": "<client-id>.access",
        "CF_SECRET": "<client-secret>"
      }
    }
  }
}

The ${CF_ID} indirection avoids an mcp-remote bug that mangles header values containing spaces.

Verification¶

CFID="<client-id>.access"; CFSEC="<client-secret>"

# Should return an MCP initialize result (HTTP 200)
curl -s -X POST https://365-mcp.example.com/sse \
  -H "CF-Access-Client-Id: $CFID" -H "CF-Access-Client-Secret: $CFSEC" \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"c","version":"1"}}}'

# No / wrong credentials should be rejected (HTTP 403)
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://365-mcp.example.com/sse \
  -H 'Content-Type: application/json' -d '{}'

# Origin log shows successful validation:
docker logs 365-mcp | grep "Access OK"