feat(mcp): CNAMEs and wildcard Access app for per-backend MCP endpoints

[xnoto]

What

Adds edge prerequisites for per-backend MCP endpoints behind the existing cluster-apps tunnel:

• cf-tunnels.tf: 9 new CNAMEs under mcp.makeitwork.cloud — apify, argocd-makeitwork, aws-docs, context7, github, grafana-makeitwork, kubernetes, parallel-search, terraform-docs. The aggregate VirtualMCPServer stays at the bare mcp hostname.
• cf-access-mcp.tf: new Access application mcp_gateway_backends covering *.mcp.makeitwork.cloud, reusing the existing mcp-gateway service token (non_identity policy) plus the admins group policy.

Why: MCP clients get one config entry per integration with natural tool names, instead of one aggregate entry with gateway-prefixed tools.

Ordering constraint (per AGENTS.md)

This must apply before the matching TunnelBinding subjects merge in kustomize-cluster (commit ready, held locally). If cloudflare-operator creates the DNS records first, this apply fails with 81053 and records would need importing.

After merge

Verify CNAMEs exist → push kustomize-cluster TunnelBinding → push client config repos.

Verified: terraform fmt clean, terraform validate passing, terraform-docs README updated by hook.

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:
# cloudflare_dns_record.cluster_apps["alertmanager"] will be updated in-place
~ resource "cloudflare_dns_record" "cluster_apps" {
- comment = "Managed by cloudflare-operator" -> null
- comment_modified_on = "2026-08-26T09:10:52Z" -> null
id = "92132bbb5cd95e2ee6a44a491cb188f5"
~ modified_on = "2026-08-26T09:10:52Z" -> (known after apply)
name = "alertmanager.makeitwork.cloud"
tags = []
# (9 unchanged attributes hidden)
}
# cloudflare_dns_record.cluster_apps["apify.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "apify.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["argocd-makeitwork.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "argocd-makeitwork.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["aws-docs.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "aws-docs.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["context7.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "context7.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["github.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "github.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["grafana-makeitwork.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "grafana-makeitwork.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["kubernetes.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "kubernetes.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["parallel-search.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "parallel-search.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_dns_record.cluster_apps["terraform-docs.mcp"] will be created
+ resource "cloudflare_dns_record" "cluster_apps" {
+ content = "7a3b548e-734f-427c-bd37-b360199f5433.cfargotunnel.com"
+ created_on = (known after apply)
+ id = (known after apply)
+ meta = (known after apply)
+ modified_on = (known after apply)
+ name = "terraform-docs.mcp"
+ proxiable = (known after apply)
+ proxied = true
+ settings = (known after apply)
+ tags = (known after apply)
+ tags_modified_on = (known after apply)
+ ttl = 1
+ type = "CNAME"
+ zone_id = (sensitive value)
}
# cloudflare_zero_trust_access_application.mcp_gateway_backends will be created
+ resource "cloudflare_zero_trust_access_application" "mcp_gateway_backends" {
+ account_id = (sensitive value)
+ allowed_idps = [
+ "e584ea47-1251-4939-95f4-4daf4a58cd31",
]
+ app_launcher_visible = true
+ aud = (known after apply)
+ destinations = (known after apply)
+ domain = "*.mcp.makeitwork.cloud"
+ http_only_cookie_attribute = true
+ id = (known after apply)
+ name = "MCP Gateway Backends"
+ policies = [
+ {
+ decision = "non_identity"
+ include = [
+ {
+ service_token = {
+ token_id = "96ab3739-d013-45f8-9ee5-f7e2ae003495"
}
},
]
+ name = "mcp-gateway-clients"
+ precedence = 1
},
+ {
+ decision = "allow"
+ include = [
+ {
+ group = {
+ id = "e0d9e873-31d7-4536-9234-3dad8a99d84d"
}
},
]
+ name = "makeitworkcloud-admins"
+ precedence = 2
},
]
+ self_hosted_domains = (known after apply)
+ session_duration = "24h"
+ type = "self_hosted"
}
Plan: 10 to add, 1 to change, 0 to destroy.