orgx-mcp

A Cloudflare Workers deployment that exposes OrgX initiatives, milestones, tasks, org snapshots, and Stripe upgrades over the Model Context Protocol (MCP). The worker reuses the Next.js API routes inside this repo, so shipped business logic stays in one place.

• pnpm (matches the repo's package manager)
• Cloudflare account with Workers enabled
• The following environment variables must be configured for both the worker and the Next.js app:
• MCP_SERVICE_KEY (Vercel) / ORGX_SERVICE_KEY (Worker secret)
• ORGX_API_URL
• MCP_JWT_SECRET (Worker secret)
• Existing Stripe/Supabase secrets (STRIPE_*, SUPABASE_*)

> Note: OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET are NOT needed. OAuth clients (like ChatGPT) register dynamically via POST /register and get their credentials stored in the OAuthState Durable Object.

# From the repo root
pnpm install
cp .dev.vars.example .dev.vars   # customize once, ignored by git
pnpm dev                         # runs wrangler dev on http://127.0.0.1:8787

wrangler.toml stays out of git; all local secrets live in .dev.vars (same format as wrangler secret put). Example contents:

ORGX_API_URL="http://localhost:3000"
ORGX_SERVICE_KEY="oxk-..."
MCP_JWT_SECRET="your-32-byte-secret"

When running pnpm dev, Wrangler automatically loads .dev.vars, so the worker can mint JWTs and proxy to the local Next.js API.

# From the repo root
pnpm install --frozen-lockfile
pnpm wrangler deploy                    # prod
pnpm wrangler deploy --env preview      # staging (uses [env.preview])

Before deploying, seed Cloudflare secrets once per environment:

pnpm wrangler secret put ORGX_SERVICE_KEY --env production
pnpm wrangler secret put MCP_JWT_SECRET --env production

These secrets are NOT overwritten by wrangler deploy (unlike vars in wrangler.toml).

CI expects matching GitHub Secrets:

• `ORGX_SERV