docs(host-cloudflare): document MCP client auth for Access-gated /mcp

[amondnet]

Summary

Documents how to connect an MCP client to the Access-gated /mcp endpoint on the Cloudflare host, and explains the confusing failure mode users hit first.

Connecting a client to /mcp without an Access credential returns the Cloudflare Access HTML login page, which the streamable-HTTP client rejects with:

Streamable HTTP error: Unexpected content type: text/html

That is the Access login page, not a Worker response. A browser passes Access interactively, but an MCP client cannot follow that redirect, so it must authenticate another way.

Changes

Rewrites the "Connect an agent" section of apps/docs/hosted/cloudflare.mdx to cover two auth paths:

• Managed OAuth (recommended) for interactive clients: enable Managed OAuth on the Access application so Access runs the OAuth flow on the Worker's behalf. No Worker code or redeploy needed (the Worker still only validates Cf-Access-Jwt-Assertion).
• Service token for headless clients (CI, background agents): authenticate machine-to-machine with CF-Access-Client-Id / CF-Access-Client-Secret headers.

Also moves the MCP Proxy reference to the end of the section (a post-connection next step) and fixes prose to comply with the repo's no-em-dash rule.

Notes

Docs-only change. Technical claims were verified against the implementation (wrangler.jsonc run_worker_first, cloudflare-access.ts common_name handling, mcp/auth.ts JWT-only validation); no contradictions found.

[greptile-apps]

Greptile Summary

This PR updates the Cloudflare hosting guide for Access-gated MCP connections. The main changes are:

• Explains why unauthenticated MCP clients see the Access HTML login page.
• Documents Managed OAuth for interactive MCP clients.
• Documents service-token headers for headless MCP clients.
• Keeps the MCP Proxy link as a post-connection next step.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/docs/hosted/cloudflare.mdx	Rewrites the MCP connection section with Managed OAuth and service-token setup paths for Cloudflare Access.

_{Reviews (3): Last reviewed commit: "docs(cloudflare): add service-token fall..." | Re-trigger Greptile}