feat(mcp): gate mcp.makeitwork.cloud behind Cloudflare Access

[xnoto]

Summary

Edge authentication for the new cluster MCP gateway (paired with makeitworkcloud/kustomize-cluster#62).

• cf-tunnels.tf — adds mcp to the cluster-apps CNAME list. This must be applied before the TunnelBinding lands in kustomize-cluster (documented DNS race, error 81053); the TunnelBinding PR follows this apply.
• cf-access-mcp.tf — dedicated mcp-gateway Access service token (duration = "forever", rotate via client_secret_version) + self_hosted application on mcp.makeitwork.cloud: non_identity service-token policy for headless agent clients (opencode, Claude Code, etc. send CF-Access-Client-* headers) and an admins GitHub-SSO policy for interactive debug.
• outputs.tf — exposes the service-token client_id and client_secret (sensitive) so agent clients can be configured after apply.

Scope change during review: the cf-access-opencode.tf gate was dropped — #25 deliberately removed the opencode Access gate because it breaks opencode attach; opencode web stays on the SOPS-managed server password. Re-gating needs an attach-compatible design first.

Validation

• tofu fmt ✅, tofu init -backend=false + tofu validate ✅
• make test ✅ (canonical pre-commit: validate, tflint, checkov, fmt, terraform-docs README regenerated)

Not run

• tofu plan / tofu apply — CI posts the plan here and applies on merge per the shared workflow.

Post-apply

1. tofu output mcp_gateway_service_token_client_id / tofu output -raw mcp_gateway_service_token_client_secret → local agent sessions as CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET (keyring/env only).
2. Then the follow-up TunnelBinding PR in kustomize-cluster is safe to merge.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# cloudflare_dns_record.cluster_apps["mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_zero_trust_access_application.mcp_gateway will be created
+ resource "cloudflare_zero_trust_access_application" "mcp_gateway" {
+ account_id = (sensitive value)
+ allowed_idps = [
+ "e584ea47-1251-4939-95f4-4daf4a58cd31",
]
+ app_launcher_visible = true
+ aud = (known after apply)
+ destinations = (known after apply)
+ domain = "mcp.makeitwork.cloud"
+ http_only_cookie_attribute = true
+ id = (known after apply)
+ name = "MCP Gateway"
+ policies = [
+ {
+ decision = "non_identity"
+ include = [
+ {
+ service_token = {
+ token_id = (known after apply)
}
},
]
+ name = "mcp-gateway-clients"
+ precedence = 1
},
+ {
+ decision = "allow"
+ include = [
+ {
+ group = {
+ id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
}
},
]
+ name = "makeitworkcloud-admins"
+ precedence = 2
},
]
+ self_hosted_domains = (known after apply)
+ session_duration = "24h"
+ type = "self_hosted"
}
# cloudflare_zero_trust_access_service_token.mcp_gateway will be created
+ resource "cloudflare_zero_trust_access_service_token" "mcp_gateway" {
+ account_id = (sensitive value)
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ client_secret_version = 1
+ duration = "forever"
+ enabled = (known after apply)
+ expires_at = (known after apply)
+ id = (known after apply)
+ name = "mcp-gateway"
}
Plan: 3 to add, 0 to change, 0 to destroy.
Changes to Outputs:
+ mcp_gateway_service_token_client_id = (known after apply)
+ mcp_gateway_service_token_client_secret = (sensitive value)