# Company Cloudflare Publisher MCP

> URL-plus-one-time-code installation and safe-operation guide for two authenticated Streamable HTTP MCP servers.

Canonical install URL: https://company-cloudflare-agent-mcp-guide.pages.dev/#install
Machine install contract: https://company-cloudflare-agent-mcp-guide.pages.dev/.well-known/mcp-install.json
JSON Schema: https://company-cloudflare-agent-mcp-guide.pages.dev/agent-bootstrap.schema.json
Agent instructions: https://company-cloudflare-agent-mcp-guide.pages.dev/agent-instructions.md
Intent contract: https://company-cloudflare-agent-mcp-guide.pages.dev/agent-trigger.json

A base guide URL is documentation only. An explicit install URL uses the exact #install fragment with no parameters. Fetch the same-origin schema-4.0.0/contract-7.0.0 manifest without forwarding the fragment and require exactly one role-preserving trust.endpointPolicy.allowedEndpointPairs entry before using a code, changing config, or initializing MCP. On the canonical HTTPS Guide, both trust.endpointPolicy.productionPairId and the configured pair id must be exactly production; a different id stops before code use. Other well-formed ids are for explicitly trusted HTTP loopback development only. The user separately supplies exactly one access code matching ccpc_ plus 32 lowercase hexadecimal characters. It expires after 30 minutes, is one-use, is never an MCP bearer, and must never be sent to the Guide or placed in a URL, command argument, output, log, config, or backup.

After selecting one supported client, derive the claim URL only from the trusted Deployer endpoint origin plus /agent/claim; there is no third configurable origin. POST once with redirects rejected and the exact JSON keys code, client_id, contract_version="7.0.0", and endpoint_pair_id. Accept only a no-store 200 response whose exact JSON object contains an opaque install_id matching ^[a-f0-9]{32}$, validator_access_token matching ^ccpv_[a-f0-9]{48}$, and deployer_access_token matching ^ccpd_[a-f0-9]{48}$. Reject malformed or role-swapped values before rendering config. The two credentials are 90-day, role-scoped, revocable, and distinct by their role prefixes. Persist each only in its matching named entry of one owner-private client configuration protected as 0600 on POSIX or user-only equivalent. Current custom-claim templates use static headers because the supported clients do not expose one common custom-token import into their native OAuth stores. Never give the Agent operator break-glass credentials and never downgrade to a shared bearer; migration requires re-onboarding. An ambiguous exchange consumes the code and requires a new one. An unexpectedly used code requires revocation of any identifiable associated install and operator escalation. Installation may call only get_site_requirements and get_deployment_requirements and never authorizes publishing.

Publishing uses out-of-band credentials: call create_credential_input({projectName}), give the user only its exact trusted Deployer-origin /credential-input/ URL, then require get_credential_input_status({projectName,credentialRef}) to report captured. Readiness and plan use {projectName,receipt,credentialRef}; deploy adds confirmationId. Never ask for or send raw username/password through MCP. Ambiguous expiry recovery first calls get_deployment_status({projectName}) only to select a branch; status never returns a receipt. Only explicit STATUS_NOT_FOUND permits calling validate_site({projectName,inputRef}) with the exact original inputRef to renew the same finalized claim/artifact receipt. SERVICE_UNAVAILABLE or any other error forbids renewal and credential-input creation. A nonterminal may reuse the Agent-retained original accepted signed receipt only when project and artifact match exactly and server-authoritative recoveryMode=exact-receipt. recoveryMode=operator-required, missing, or invalid stops and escalates to the operator. Stable, mismatched, or malformed state also stops. No branch creates a new upload or project name. Active returns URL, username, and status=captured, never password. Runtime proves Custom Domain absence but does not enumerate Worker routes because Deployer has no Zone permission; route absence is an administrator-controlled assumption. Publishing still requires a displayed read-only plan and separate explicit confirmation.

Rollback is separate: call read-only plan_rollback({projectName}), display the exact current artifact/deployment state and every recorded candidate, require the user to select one exact opaque rollbackTargetId, then display exact current plus selected target and obtain a separate explicit confirmation. Only then call rollback_proposal({projectName,rollbackTargetId,confirmationId}). Never omit, infer, default, or auto-select the target.