From da06190e5f4b9f29b94cb55d5208eea3dd690ffa Mon Sep 17 00:00:00 2001
From: Ben Senescu <44480372+bensenescu@users.noreply.github.com>
Date: Sun, 28 Jun 2026 17:58:51 -0400
Subject: [PATCH] docs: document DCR redirect-URI step for MCP behind
 Cloudflare Access (#48)

* docs: document DCR redirect-URI step for MCP behind Cloudflare Access

Enabling Managed OAuth alone leaves MCP clients unable to finish Dynamic
Client Registration when their redirect URI isn't allowlisted, so they log
in but expose no tools (issue #47). Document allowing localhost/loopback
clients and HTTPS web-connector redirect URIs, linking Cloudflare's docs.

* docs: fold DCR redirect-URI guidance into the setup steps

Move the Dynamic Client Registration guidance from a standalone paragraph
into step 6 of the numbered list, with sub-bullets for localhost/web
redirect URIs and a footnote explaining why (logs in but no tools).

* docs: replace DCR footnote with a sub-bullet
---
 docs/SELF_HOSTING_CLOUDFLARE.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/SELF_HOSTING_CLOUDFLARE.md b/docs/SELF_HOSTING_CLOUDFLARE.md
index d0ca0c5..503fadb 100644
--- a/docs/SELF_HOSTING_CLOUDFLARE.md
+++ b/docs/SELF_HOSTING_CLOUDFLARE.md
@@ -66,7 +66,13 @@ Managed OAuth is required for MCP clients and is not enabled by default.
 3. Find your OpenSEO application, then select `Edit`.
 4. Go to `Additional settings` -> `OAuth`.
 5. Turn on `Managed OAuth`.
-6. Save.
+6. In `Managed OAuth settings`, allow the redirect URIs your MCP clients use:
+   - Allow `localhost` / loopback clients — for CLI and desktop agents (Codex
+     CLI, Claude Code) that register `http://localhost:PORT/callback`.
+   - Add HTTPS redirect URIs for web connectors (a path may end in `/*`).
+   - Without this, clients can't finish [Dynamic Client Registration](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/)
+     and log in but expose no tools.
+7. Save.
 
 MCP clients should connect to: