fix(cloudflare): use Worker-safe validation for MCP

[LJAYi]

Summary

• configure the Cloudflare MCP client to use the MCP SDK's CfWorkerJsonSchemaValidator
• add a regression test that disables string-based code generation while validating advertised MCP tool output schemas

Root cause

The MCP SDK client defaults to AJV for JSON Schema validation. When Cloudflare's MCP server advertises tool outputSchema values, AJV compiles them with new Function(...). Cloudflare Workers disallow runtime code generation from strings, so credential validation and MCP requests fail with:

Cloudflare MCP request failed: Code generation from strings disallowed for this context

The SDK's Cloudflare-specific validator uses @cfworker/json-schema and performs validation without eval or new Function.

Impact

Cloudflare-hosted Open Connector deployments can validate Cloudflare MCP credentials and invoke its tools. Node deployments retain the same behavior.

Because the provider is currently broken on Cloudflare in v1.3.3, could this be included in a patch release after review?

Validation

• node scripts/typecheck.ts src scripts-all examples
• vitest run (61 files, 590 tests)
• dedicated regression test with Function disabled and MCP outputSchema values present

[coderabbitai]

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of Cloudflare MCP tool schemas, including environments where runtime code generation is unavailable.
  • Ensured MCP tool metadata and output schemas are validated consistently for OAuth and API token authentication.

Walkthrough

The Cloudflare MCP executor now configures its MCP client with CfWorkerJsonSchemaValidator. Tests restore global stubs after each case, simulate unavailable dynamic code generation, and verify the resulting MCP tool metadata. The shared tools/list mock now includes outputSchema for each tool entry.

Possibly related PRs

• oomol-lab/open-connector#232: Adds the related Cloudflare MCP executor credential and tool validation logic.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title follows the required type(scope): subject format and accurately summarizes the Cloudflare MCP validation change.
Description check	✅ Passed	The description clearly matches the Cloudflare MCP validator update and regression test changes in this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}