Setting up the agent

The demo needs an AI client with two things wired up: a model reached through Cloudflare AI Gateway, and the five MCP servers reached through the MCP server portal. These are the two places the controls live.

Sign in as the right person

Every demo is run as Delta Graham — delta.graham@company.com, password Savetheinternet!1. When the agent connects to the portal you will be sent through Cloudflare Access and then FlareID; log in as Delta, not as the admin account. The whole point is that the agent is acting with a real, low-privilege identity.

First: authenticate each MCP server (one browser login each)

wire-protection.sh registers the five MCP servers with Access and creates an Access application for each, but it cannot perform the upstream OAuth login those servers require — that is an authorization-code flow with a browser in the middle, and no API mints that token. Until it is done each server sits in Waiting with zero tools, and the portal has nothing to offer your agent.

1. In the Cloudflare dashboard, go to Zero Trust → Access controls → MCP Portals → MCP servers. All five (hr, crm, work, wiki, fin) should be listed, each showing Waiting.
2. Select a server → Edit → Authenticate server.
3. Sign in as delta.graham@company.com (password Savetheinternet!1). Cloudflare then fetches the server's tools and the status becomes Ready.
4. Repeat for crm, work and wiki.
5. fin (Ledger) is the exception: it only admits the leadership team, so authenticate that one as nikita.crist@company.com. Delta cannot authenticate it, and that is the control the access-control script demonstrates — once it is Ready, her portal still will not list its tools.
6. Check the portal lists tools from all five when signed in as the CEO, and from four as Delta.

Option A — opencode

Add a provider pointing at AI Gateway's OpenAI-compatible endpoint and an MCP entry pointing at the portal. In ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "provider": {
    "cf-ai-demo": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "Cloudflare AI Gateway (demo)",
      "options": {
        "baseURL": "https://aig.<ZONE>/compat"
      },
      "models": {
        "workers-ai/@cf/google/gemma-4-26b-a4b-it": {
          "name": "Google Gemma 4 (Workers AI)"
        }
      }
    }
  },
  "mcp": {
    "servers": {
      "ai-demo": {
        "type": "remote",
        "url": "https://mcp.<ZONE>/mcp"
      }
    }
  },
  "default_agent": "employee",
  "agents": {
    "employee": {
      "description": "An ordinary employee's assistant - company tools only",
      "mode": "primary",
      "steps": 10,
      "system": "You are the assistant of an employee at this company. Answer using only the company tools available to you. You have no filesystem, no shell and no access to the public internet. If the tools cannot answer the question, say so plainly rather than guessing or searching.",
      "permissions": [
        { "action": "shell",     "resource": "*", "effect": "deny" },
        { "action": "edit",      "resource": "*", "effect": "deny" },
        { "action": "read",      "resource": "*", "effect": "deny" },
        { "action": "glob",      "resource": "*", "effect": "deny" },
        { "action": "grep",      "resource": "*", "effect": "deny" },
        { "action": "webfetch",  "resource": "*", "effect": "deny" },
        { "action": "websearch", "resource": "*", "effect": "deny" },
        { "action": "subagent",  "resource": "*", "effect": "deny" },
        { "action": "skill",     "resource": "*", "effect": "deny" }
      ]
    }
  }
}

On first use the portal returns 401 and opencode opens a browser window for the Access login. After that its token is stored. If the server list shows needs authentication, run /mcps, select it and sign in.

Option B — Open WebUI

1. Model. Settings → Connections → add an OpenAI-compatible connection. Open WebUI runs server-side, so it has no Cloudflare One client session to borrow: point it at https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/employee-gateway/compat with a Cloudflare API token that has Workers AI access, or give it an Access service token against https://aig.<ZONE>/compat. Use the same model id as above, workers-ai/@cf/google/gemma-4-26b-a4b-it.
2. Tools. Bridge the MCP portal to an OpenAPI tool server and add it under Settings → Tools:
   uvx mcpo --port 8000 -- npx -y mcp-remote@latest https://mcp.<ZONE>/mcp
   Recent Open WebUI builds can also add a streamable-HTTP MCP server directly; either path works, the portal does not care.
3. Access. Open WebUI itself sits behind its own Cloudflare Access application with SSO, so the person typing prompts is already authenticated before they reach it.

Running without the protection layer first

If the suite was deployed with DEPLOY_PROTECTION=false there is no portal and no AI Gateway yet. Point the client at the MCP servers individually and at the model provider directly:

{
  "mcp": {
    "servers": {
      "workweek": { "type": "remote", "url": "https://hr-mcp.<ZONE>/mcp" },
      "pipeline": { "type": "remote", "url": "https://crm-mcp.<ZONE>/mcp" },
      "relay":    { "type": "remote", "url": "https://work-mcp.<ZONE>/mcp" },
      "nexus":    { "type": "remote", "url": "https://wiki-mcp.<ZONE>/mcp" },
      "ledger":   { "type": "remote", "url": "https://fin-mcp.<ZONE>/mcp" }
    }
  }
}

Each server runs its own OAuth 2.1 flow and delegates login to Cloudflare Access, so you will sign in as Delta once per server — except ledger, which will refuse her, because its Access application allows only the leadership team. Every demo script works in this mode — that is the "before" half of each one.

Check it works

Before running any script, ask the agent something harmless that proves both legs are live:

Who am I, and which tools do you have available?

You should see Delta Graham come back from the whoami tool, a list of tools from the four apps she can reach — Ledger's will be absent, by design — and, if the protection layer is deployed, a corresponding request in the AI Gateway log and in the MCP portal log.