What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The secure pattern is to separate identity from browser execution: run your remote MCP server on Cloudflare Workers, protect its /mcp endpoint with Cloudflare’s OAuth Provider Library, use Auth0 for user login and upstream authorization, and connect browser tools through Cloudflare Browser Run’s CDP endpoint. The MCP client receives its own access token after the Auth0 exchange; it never needs your Auth0 client secret or Cloudflare API token.
Target architecture
There are two independent trust boundaries:
- Identity and MCP authorization: Auth0 authenticates the person, applies consent and scopes, and returns an authorization result to your Worker. Cloudflare’s
@cloudflare/workers-oauth-providervalidates the OAuth flow and issues the MCP client an access token. - Browser execution: an MCP-compatible client starts
chrome-devtools-mcpand connects to Cloudflare Browser Run over its CDP WebSocket. The connection is authorized with a Cloudflare API token that has only Browser Rendering – Edit.
A typical request path is:
- The client calls your Worker’s
/mcpendpoint. - The Worker returns
401with OAuth metadata. - The client creates a PKCE verifier and challenge, then opens the authorization URL.
- Your authorization handler sends the user to Auth0 for login and consent.
- Auth0 redirects back with a code. Your handler exchanges it and the Worker returns the MCP authorization result.
- The client exchanges that result at
/token, stores access and refresh tokens, and retries the MCP call. - Browser tools use the separate Browser Run CDP connection.
Cloudflare describes MCP authorization as a subset of OAuth 2.1. Keep the provider token and browser token separate even when the same user starts both operations.
Prerequisites and decisions
- Node.js 18 or newer.
- An Auth0 tenant with administrative access.
- A Cloudflare account with Workers and Browser Rendering enabled.
- An MCP client such as Claude Desktop, Cursor or Windsurf.
- A deployed Worker URL using HTTPS in production.
Decide which tools the agent actually needs before writing the registry. A screenshot and navigation workflow should not automatically expose account-management operations, arbitrary network access or unrestricted downloads.
Build the protected MCP Worker
Expose explicit OAuth routes
Use stable route names and register exactly these URLs with your client and Auth0:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Route | Purpose |
|---|---|
/authorize |
Starts the Auth0 login and consent flow. |
/token |
Exchanges the authorization result for the MCP client’s access and refresh tokens. |
/register |
Handles dynamic client registration when your MCP client requires it. |
/mcp |
Receives authenticated MCP requests and dispatches only approved tools. |
Worker entry point
The provider’s constructor names can vary by package release. The following is the deployment shape: pin the package version you install and match its documented handler signatures rather than copying an unpinned example.
import { OAuthProvider } from "@cloudflare/workers-oauth-provider";
import { handleAuthorize, handleToken, handleRegister } from "./auth0-handlers";
import { handleMcp } from "./mcp-handler";
export interface Env {
AUTH0_DOMAIN: string;
AUTH0_CLIENT_ID: string;
AUTH0_CLIENT_SECRET: string;
AUTH0_AUDIENCE: string;
OAUTH_STATE: KVNamespace;
}
const provider = new OAuthProvider({
apiRoute: "/mcp",
apiHandler: handleMcp,
authorizeEndpoint: "/authorize",
tokenEndpoint: "/token",
clientRegistrationEndpoint: "/register",
authorizeHandler: handleAuthorize,
tokenHandler: handleToken,
registrationHandler: handleRegister
});
export default {
fetch(request: Request, env: Env, ctx: ExecutionContext) {
return provider.fetch(request, env, ctx);
}
};Your MCP handler should validate the provider-issued token before dispatching a tool. Do not accept a raw Auth0 access token as a substitute for the MCP token; the Worker is the boundary that decides which tools are available.
Auth0 authorization handler responsibilities
- Generate and persist an OAuth state value tied to the requesting client and redirect URI.
- Redirect to your Auth0 tenant’s
/authorizeendpoint with the registered client ID, exact callback URI, response typecode, the minimum API scopes, state and the client’s PKCE challenge. - On callback, verify state and the PKCE verifier before exchanging the code at Auth0’s token endpoint.
- Validate issuer, audience, expiry and granted scopes in the returned tokens.
- Mint the MCP client’s access and refresh tokens through the OAuth Provider Library, not by exposing Auth0 credentials to the client.
Store the Auth0 client secret, signing configuration, state records and token-encryption material in Worker secrets or a protected binding. Never commit them to source control or send them in a browser URL.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Configure Auth0 correctly
Register the callback
In Auth0, create an application for this integration and add the Worker’s exact callback URL. The scheme, host, path and trailing slash must match what the MCP client uses. Register the MCP server’s client details and allow only the redirect URIs you operate.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRequest narrow scopes
Create or select an Auth0 API representing the operations your MCP tools call. Request only the scopes needed for those operations. A browser screenshot tool generally needs far less authority than an administrative API client. Reject unexpected scopes in the authorization handler instead of silently granting them.
Plan refresh-token behavior
Long-running MCP sessions need refresh handling. Cloudflare’s Auth0 example refreshes access tokens during continued interaction. Keep refresh tokens server-side where possible, rotate them according to your Auth0 policy, and revoke them when a user or agent is deprovisioned.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Connect Cloudflare Browser Run to the MCP client
Configure the client to launch the Chrome DevTools MCP package and point it at the Browser Run CDP endpoint. Replace the account ID and token with values from your account:
npx chrome-devtools-mcp@latest
--wsEndpoint=wss://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/browser-run/devtools/browser?keep_alive=600000
--wsHeaders='{"Authorization":"Bearer <API_TOKEN>"}'Use a Cloudflare API token with Browser Rendering – Edit permission. Keep the token in the MCP client’s secret store or environment, not in a checked-in project file. Cloudflare’s Browser Rendering changelog dated April 10, 2026 documents CDP and MCP client support; use the current endpoint shown in your account documentation if it changes.
First-connection flow and validation
- Start the Worker and the MCP client.
- Call
/mcp. Confirm that the unauthenticated response is401, not a tool result. - Allow the client to open the Auth0 authorization page. Complete login and consent.
- Confirm the callback returns to the exact registered URI and that the client obtains access and refresh tokens.
- Retry the MCP request and verify that only the intended tools appear.
- Run
npx @modelcontextprotocol/inspector@latest, enter the deployed MCP URL, choose OAuth Settings and Quick OAuth Flow, connect, and use List Tools. - Exercise navigation, screenshot, download and failure paths with a test account before production.
Security controls that matter in production
- PKCE and state: require both, bind state to the client and redirect URI, and expire stored state quickly.
- Redirect allowlisting: reject callback destinations that are not pre-registered.
- Least privilege: minimize Auth0 scopes and grant the Cloudflare token only Browser Rendering – Edit.
- Tool allowlisting: register browser actions individually; do not expose arbitrary network, account or filesystem operations by default.
- SSRF protection: restrict navigation targets to approved hosts when the browser can reach private or internal resources.
- Secret handling: use environment variables, Worker secrets or an equivalent secret manager. Never log bearer tokens, authorization codes, cookies or full authorization headers.
- Audit events: record authentication failures, refreshes, navigation targets, downloads and screenshots with a request identifier and user identity, while redacting secrets.
- Rotation and revocation: rotate Cloudflare API tokens and Auth0 credentials, and revoke refresh tokens when access is removed.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Auth0 shows an invalid callback error | The callback differs by scheme, path, host or trailing slash. | Copy the deployed callback URL exactly into Auth0 and the MCP client configuration. |
| The client loops after login | State or PKCE verification fails, or the callback is not persisted. | Persist state in a protected store, bind it to the original request, and verify the same PKCE challenge and verifier. |
401 after a successful login |
The Worker expects its MCP token but received an Auth0 token, or the token audience/issuer is wrong. | Complete the provider token exchange and validate the MCP token at /mcp. |
403 from Browser Run |
The Cloudflare token lacks Browser Rendering – Edit or belongs to another account. | Create a token with that permission for the target account and update the secret. |
| WebSocket connection closes immediately | Malformed JSON in --wsHeaders, an expired token or an outdated endpoint. |
Check quoting, issue a fresh token, and use the current Browser Run CDP URL. |
| Tools appear that should be hidden | The registry exposes more handlers than intended. | Apply an explicit allowlist and test the result with MCP Inspector’s List Tools. |
| Long sessions stop working | The Auth0 access token expired and refresh was not performed. | Implement refresh handling in the authorization layer and revoke failed refresh tokens. |
Latency, reliability and cost considerations
The flow adds an initial browser-based login and token exchange; subsequent MCP calls use the issued token until it expires. Browser navigation time depends on the target site, page resources and Cloudflare account conditions. The cited first-party material does not publish a universal latency, reliability, adoption or success-rate benchmark, so measure navigation, screenshot and refresh timings in your own account and region.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep browser sessions short, set bounded waits, and handle timeouts as recoverable errors. Cache only data that is safe to reuse, and never cache personalized pages across users. Treat failed authentication, blocked navigation and download errors as separate metrics so an operational alert identifies the failing boundary.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
If your goal is a clean website screenshot rather than an interactive, authenticated browser session, ScreenshotNeo provides a single HTTP request. It removes cookie-consent banners, newsletter popups and chat widgets before capture; bot checks, blank pages, failed loads, timeouts and cache hits are not billed; and its MCP server lets Claude, Cursor or another MCP client call screenshot tools directly.
See the ScreenshotNeo API documentation for all options. Basic cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpThe equivalent Python request is:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Every response reports whether it was a clean capture and whether it was billed through X-Page-Verdict and X-Billed headers. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000. Create a free ScreenshotNeo account.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
FAQ
Can Cloudflare Access replace Auth0 here?
It can be a different identity design, but this pattern specifically uses Auth0 as the external OAuth provider. Compare identity ownership, token boundaries, client support and operational controls before switching.
Should the browser token be an Auth0 token?
No. Browser Run uses a Cloudflare API token with Browser Rendering – Edit. Keep that credential separate from Auth0 and the MCP provider token.
Is a universal performance number available?
No. Measure in the target account with representative pages, waits, screenshots and refresh cycles; first-party material does not publish a universal benchmark.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchFrequently Asked Questions
Can I use a local MCP client with a remote Worker?
Yes, provided the client supports OAuth discovery or the registered authorization, token and registration endpoints and can reach the Worker over HTTPS.
What should be tested before granting production access?
Test callback validation, PKCE failures, expired and revoked refresh tokens, Browser Run permission failures, SSRF restrictions and the exact tool allowlist.
Where should credentials be stored?
Use Worker secrets, environment variables or the MCP client’s protected secret store; never commit client secrets, API tokens, cookies or bearer headers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
