Post-cutover hardening: mcp.hummbl.io production MCP server

[hummbl-dev]

Post-cutover hardening: mcp.hummbl.io production MCP server

Context: mcp.hummbl.io was promoted to production on 2026-07-04 (commit 5a6f401). The cutover receipt is at docs/receipts/2026-07-04-mcp-production-cutover.md. This issue tracks post-cutover hardening tasks.

Scope

Log review

• Review Worker logs after first 24h production window
• Confirm no unexpected Durable Object errors
• Confirm no unexpected Access/auth failures
• Check for tools/list count drift (should be 12)

Access behavior verification

• Confirm unauthorized requests are blocked by Access (302 to login)
• Confirm read-only profile for users without hummbl-mcp-write group
• Confirm full profile for hummbl-mcp-write members
• Verify .well-known metadata from external client perspective (outside Cloudflare network)

Documentation

• Client connection guide (docs/mcp/client-connection.md)
• Production cutover receipt (docs/receipts/2026-07-04-mcp-production-cutover.md)
• Document emergency rollback procedure in runbook
• Add MCP client connection recipe for Claude Desktop / Cursor / Windsurf

Monitoring

• Set up /health uptime check (external probe)
• Set up failed Access/auth spike alerting
• Set up unexpected write-tool call alerting
• Set up Durable Object error alerting
• Set up /.well-known/oauth-protected-resource availability check
• Consider Cloudflare Workers Analytics for request volume/latency

Write-tool audit gates

• Decide whether add_relationship needs additional confirmation
• Decide whether audit_model_references needs rate limiting
• Decide whether export_models needs audit logging
• Consider adding an audit log for all write-tool invocations

IdP hardening (future)

• Add GitHub as an IdP for richer identity claims
• Consider SCIM-based group sync if team grows
• Evaluate whether OTP is sufficient for long-term production

References

• Cutover receipt: docs/receipts/2026-07-04-mcp-production-cutover.md
• Auth docs: docs/auth.md
• Client connection: docs/mcp/client-connection.md
• Deployment readiness: docs/deployment-readiness.md
• Wrangler config: wrangler.mcp.toml

Priority

Not urgent — the server is live and verified. These are hardening tasks for the first production window.

[hummbl-dev]

Authenticated MCP client verification completed

Date: 2026-07-04T16:25:00Z
Client: curl-based MCP client with production Cloudflare Access JWT
Endpoint: https://mcp.hummbl.io/mcp

Results

Test	Status	Detail
initialize	PASS	Server v1.2.0, protocol 2024-11-05, session established
tools/list	PASS	12 tools, full profile (hummbl-mcp-write member)
get_model P1	PASS	Returned First Principles Framing
list_all_models	PASS	120 models returned
search_models "belonging"	PASS	0 results (correct — no model with that keyword)
add_relationship	AUTHORIZED / BACKEND FAIL	Tool was accessible (authz PASS) but backend REST API returned 404 / Cloudflare error 1042

Conclusion

Production MCP read-only tool plane is operational. Write tools are correctly authorized under full profile, but persistence currently fails because the backend HUMMBL REST API endpoint is invalid or unreachable.

This is a backend API configuration issue, not a production cutover blocker.

New P1 task

Configure and verify HUMMBL REST API endpoint for write-gated MCP tools.

The write tools (add_relationship, audit_model_references, export_models) make subrequests to a HUMMBL REST API. The 404 / Cloudflare 1042 error indicates the target URL is either:

• Not set as a Worker secret/env var
• Pointing to an endpoint that doesn't exist yet
• Behind a DNS record that hasn't been created

Next verification target after fix:

add_relationship → persisted
audit_model_references → executed
export_models → returned/exported expected artifact
negative read-only profile → write tools hidden or rejected

Updated checklist

• External MCP client connection verified
• Cloudflare Access authentication verified
• JWT verification verified
• Access group resolution via get-identity verified
• Full-profile authorization verified
• MCP initialize handshake verified
• Tool discovery verified
• Read-only tool execution verified (3/3 calls)
• Write-tool authorization verified (accessible under full profile)
• Write-tool backend persistence (BLOCKED — 404/1042)
• Read-only negative test (non-write user gets read-only profile)
• Health/metadata uptime monitoring
• Write-tool audit logging

[hummbl-dev]

---

Automated triage run (2026-07-24)

• Category: infra
• Priority: P2
• Severity: medium
• Staleness: fresh
• Recommended next action: Resolve the write-tool backend 404/Cloudflare 1042 error first — the HUMMBL REST API endpoint for add_relationship/audit_model_references/export_models is either unset or pointing to a non-existent DNS record.

Notes: Read-only MCP plane is verified operational (initialize, tools/list, 3/3 read tools pass). Write-tool authorization works but persistence fails due to backend API configuration, not a cutover blocker. Monitoring and uptime checks remain unconfigured.