Everything a Gateway offers

A Gateway is one Worker (every-app-gateway) with one D1 database (every-app-gateway) in the person's own Cloudflare account, at https://<gateway host>, installed by pnpm everyapp setup --domain <host>. It signs people in, decides who may open which app, holds every key, and serves one MCP connector for every app. This page says what it offers and how an agent reads each part; the deeper pages are linked, not repeated.

The shape

• The Gateway. The sign-in, the app launcher, Manage workspace (/admin, owners and admins) and the connector https://<gateway>/mcp. Its state is the D1 database; the CLI reads and writes that database through the Cloudflare login, never through the Gateway (ADR-0003, docs/security-model.md). pnpm everyapp status --json is the one state query (the CLI by job).
• Apps. Each app is a Worker of its own on a host under the app base domain (<app>.<base>), built from its everyapp.config.ts (manifest) by pnpm everyapp deploy from the app's directory, or by pnpm everyapp install <GitHub URL> from a release someone published (deploy). An app lives beside the checkout in a repository of its own, linked to it (the CLI by job). The Gateway gives an app only what its manifest declares: a signed identity, its own secrets, AI through providers, services through capabilities (identity, secrets). Every route is private unless the manifest lists it under public, which only a route the internet must reach needs (a webhook, a collector, an OAuth callback); the starter has none. An app's AI tools are defineTools() in its code, snapshotted by the Gateway and served as <app>_<tool> (mcp). An agent writes one with the build skill (Build an app, Example patterns).
• MCP apps. A data provider, or any remote MCP server, the Gateway offers to members' AI clients as an app with no page and no Worker (a provider app in the code: an apps row of tier provider, PROVIDER_APP_TIER), turned on by pnpm everyapp mcp on <id> or added by pnpm everyapp mcp add <url>, its key or credential a Gateway setting. The registry is PROVIDER_APPS in packages/sdk/src/internal/providerApps.ts; the ids are PROVIDER_APP_IDS, today dataforseo alone (key DATAFORSEO_API_KEY; seventeen read tools in apps/every-app-gateway/src/server/provider-apps/dataforseo.ts, listed in full on /mcp as dataforseo_<tool>); a remote server is a row whose manifest carries a remote block (packages/perimeter/src/registry/remoteMcpApps.ts), its tools served through packages/toolbus/src/remote/. To a person, a card under "MCP apps" on the launcher with a "Use it from your agent" dialog (this Gateway's MCP address, the tool prefix); its row in Apps, its calls in Usage and Activity. Reference: mcp; docs/design/2026-10-mcp-apps-ui.md (section 3, every person-facing surface), docs/design/2026-10-mcp-provider-apps.md, docs/design/2026-10-mcp-by-url.md.
• The one connector. https://<gateway>/mcp serves every app the caller can use plus the built-ins named under the reserved app id everyapp (packages/toolbus/src/builtins.ts): five core ones, everyapp_list_apps, everyapp_whoami, everyapp_search_tools, everyapp_call_read and everyapp_call_write, and the workspace tools (packages/toolbus/src/workspace.ts): every action of Manage workspace as everyapp_workspace_<action> for an owner or admin, four every member has over their own tokens and AI connections (People), and the MCP app tools (packages/toolbus/src/mcpApps.ts, owners and admins): everyapp_mcp_list, everyapp_mcp_show, everyapp_mcp_add, everyapp_mcp_remove, everyapp_mcp_on, everyapp_mcp_off, everyapp_mcp_refresh and everyapp_mcp_tool, the mcp commands' twins; and the provider tools (packages/toolbus/src/providers.ts): everyapp_provider_list and everyapp_provider_connections for every member, everyapp_provider_disconnect for a member's own account (an owner's or admin's for anyone's), everyapp_provider_add and everyapp_provider_remove for owners and admins on a self-hosted Gateway, the provider commands' twins (the provider tools); and the sign-in provider tools (packages/toolbus/src/signin.ts, owners and admins): everyapp_signin_list and everyapp_signin_show, the reads of Sign-in, with no tool that adds or removes a provider (the sign-in provider tools). Behind the Gateway's OAuth and consent page, or a personal access token epat_…; every call audited as one mcp_tool_calls row. An app host serves its own https://<app-host>/mcp only where its manifest opts in (mcp: { by, why }, manifest): that one app, to a personal token, with no OAuth; none of the four open apps does. A member connects once and every app they can open follows (Connecting clients).

Apps, MCP apps and the compact surface

The instructions a client reads at initialize (gatewayInstructionsHead, packages/toolbus/src/view.ts) name the mode, the apps, and each app that needs setup with its command, under CLAUDE_CODE_INSTRUCTIONS_READ (4,096 characters). An agent on /mcp calls everyapp_list_apps first, and everyapp_whoami for the person's role or the connection's access.

People

Roles are owner, admin and member (apps/every-app-gateway/src/server/org-roles.ts; the action-by-role table is in docs/design/2026-10-teams.md). A member opens the apps they are given and connects AI clients; an admin also invites, manages apps and groups, deletes a user or an app, sets caps and reads Usage and Activity; an owner can also make or demote another owner and remove one (owners are peers; the workspace always keeps one; only an owner acts on an owner). The identity an app receives carries org_role; everyapp_whoami answers user.role.

Everything below is Manage workspace (/admin, the sidebar footer's link; apps/every-app-gateway/src/routes/_app/admin.tsx), for owners and admins; a member who opens it sees "You don't have access to this page". The terminal and the connector do the same, tab by tab, below. The person's page is /docs/people. Every command and every tool, paired with the UI action each stands for, is on Managing the workspace: the CLI and the MCP tools.

AI connections (OAuth consents) are each person's own, listed and revoked under AI connections in the account menu (/settings/connections); removing or deactivating a person ends all of theirs (Connections and revocation).

The same from a terminal: pnpm everyapp workspace <command> (packages/cli/src/commands/workspace/; every command takes --json, and all but rename and role take --org <slug> for another organization of the Gateway) acts under the operator's Cloudflare login on the Gateway's database, so it checks no role and mails nothing: invite and reset-link print the link to hand over. The same from an AI client: the workspace tools (packages/toolbus/src/workspace.ts, run by apps/every-app-gateway/src/server/toolbus/workspace-tools.ts) act as the caller, listed in the full listing only, to a role that reaches each tool's minRole (admin means owner or admin), never to a credential bound to some apps; they hand out no credential (no invite link, no reset link, no token value; an invite is mailed when the Gateway can), and every call is an Activity row (Workspace tools).

• Users: pnpm everyapp workspace users; pnpm everyapp workspace invite <email> [--role admin], pnpm everyapp workspace invite-link <email|id>, pnpm everyapp workspace uninvite <email|id>; pnpm everyapp workspace role <email> owner|admin|member; pnpm everyapp workspace deactivate <email>, pnpm everyapp workspace reactivate <email>, pnpm everyapp workspace remove <email> --yes; pnpm everyapp workspace reset-link <email>. Tools: everyapp_workspace_users, everyapp_workspace_invite, everyapp_workspace_uninvite, everyapp_workspace_role (an admin changes members only), everyapp_workspace_deactivate, everyapp_workspace_reactivate, everyapp_workspace_remove (owner), everyapp_workspace_reset_email (mails the reset link to the member; EMAIL_NOT_CONFIGURED without a sender).
• Apps: pnpm everyapp workspace apps; pnpm everyapp workspace app set <app> [--everyone on|off] [--name <name>] [--description <text>]; pnpm everyapp workspace app access <app> [--add|--remove|--set <email>]…; pnpm everyapp workspace app cap <app> <n|off> or pnpm everyapp workspace app cap <app> --unlimited (no cap even under the workspace default); pnpm everyapp workspace cap default <n|off> (the workspace default for every app without its own). Tools: everyapp_workspace_apps, everyapp_workspace_app_set, everyapp_workspace_app_access, everyapp_workspace_app_access_set, everyapp_workspace_app_cap, everyapp_workspace_cap_default, everyapp_workspace_app_delete (owner; the catalog row, the Worker stays until pnpm everyapp delete).
• Groups: pnpm everyapp workspace groups; pnpm everyapp workspace group create <name> [--description <text>], pnpm everyapp workspace group set <group> [--name <name>] [--description <text>], pnpm everyapp workspace group delete <group> --yes; pnpm everyapp workspace group members <group> [--add|--remove|--set <email>]…; pnpm everyapp workspace group apps <group> [--add|--remove|--set <app>]…. Tools: everyapp_workspace_groups, everyapp_workspace_group_create, everyapp_workspace_group_set, everyapp_workspace_group_delete, everyapp_workspace_group_members, everyapp_workspace_group_members_set, everyapp_workspace_group_apps, everyapp_workspace_group_apps_set.
• Tokens and AI connections: pnpm everyapp workspace tokens [--user <email>] [--all] (every member's, never a value; --all adds revoked and expired ones) and pnpm everyapp workspace token revoke <id>; pnpm everyapp workspace connections [--user <email>] and pnpm everyapp workspace connection revoke <id>. Tools, for every member and only over their own: everyapp_my_tokens, everyapp_revoke_token, everyapp_my_connections, everyapp_revoke_connection. Nothing makes a token: Tokens → New token alone, since the value is shown once to its person.
• Sign-in: pnpm everyapp signin list and pnpm everyapp signin show <id> read what the tab shows; pnpm everyapp signin add <id> and pnpm everyapp signin remove <id> set and delete the provider's Worker secrets under the Cloudflare login. Tools, for owners and admins: everyapp_signin_list and everyapp_signin_show ({ id }), reads only: no tool adds or removes a sign-in provider.
• Providers: pnpm everyapp provider list, show <id>, presets, add --oauth <preset | spec> (prints the redirect URI; --client-id with the secret on stdin sets the two Worker secrets at once), remove <id>, connections [--all | --user <email>] and disconnect <id> [--user <email> | --organization] (providers). Tools: everyapp_provider_list and a member's own everyapp_provider_connections and everyapp_provider_disconnect; everyapp_provider_add ({ spec } or { preset }), everyapp_provider_remove, and the two connection tools over any account, for owners and admins on a self-hosted Gateway. Pasting a client has no tool and no command: the dialog seals it, or pnpm everyapp secret set <ID>_CLIENT_ID <ID>_CLIENT_SECRET sets it as Worker secrets. Connecting is a browser flow (/connect/<id>), so it has neither.
• Usage: pnpm everyapp workspace usage [--month YYYY-MM]; everyapp_workspace_usage.
• Activity: pnpm everyapp workspace activity [--app <app>] [--user <email>] [--decision allowed|blocked] [--risk read|write|destructive] [--since <time>] [--limit <n>] [--before <cursor>]; everyapp_workspace_activity (one page, newest first; nextBefore for the next).
• Activity → Audit: pnpm everyapp workspace audit [--actor <who>] [--type <type>] [--since <time>] [--limit <n>] [--before <cursor>]; everyapp_workspace_audit (one page, newest first; nextBefore for the next).
• MCP apps from an owner's or admin's AI client: everyapp_mcp_list, everyapp_mcp_show, everyapp_mcp_add (a credential by its setting's name, never its value), everyapp_mcp_on, everyapp_mcp_off, everyapp_mcp_refresh, everyapp_mcp_tool and everyapp_mcp_remove (confirm: true); the terminal's are pnpm everyapp mcp … (the CLI by job).
• Events (outbound webhooks and alert mail; the CLI's are pnpm everyapp events …, the CLI by job): everyapp_workspace_events (the subscriptions, never a signing secret), everyapp_workspace_events_add (a webhook URL or email to owners or admins; a generated signing secret comes back once, in that answer, and opens nothing on the Gateway), everyapp_workspace_events_set, everyapp_workspace_events_remove (confirm: true; Cap alerts is turned off instead), everyapp_workspace_events_test (a ping and its first attempt), everyapp_workspace_event_deliveries and everyapp_workspace_event_redeliver.
• The workspace itself: pnpm everyapp workspace show (the owners, whether it can send mail, the counts) and pnpm everyapp workspace rename "<name>" (1 to 64 characters; WORKSPACE_NOT_CLAIMED before the Gateway has an owner; the same as Manage workspace → Rename); everyapp_workspace_show, everyapp_workspace_rename.

The last owner's role is never changed anywhere (LAST_OWNER). Beside the workspace commands the CLI sets what the Gateway holds for people (secret set EMAIL_FROM EMAIL_FROM_NAME so invites and resets go out by mail from the Admin UI and the tools; access on so the Access policy admits the people invited). pnpm everyapp status --json reports the owner (data.owner, data.claimed), not the member list: that is workspace show and workspace users.

Cloudflare Access

When: a company's Gateway, before people are invited; it is free for up to 50 people and adds a second sign-in at Cloudflare's edge (a one-time PIN by email, or the company's identity provider). Recommend it to every person whose Gateway more than one person will use (the index).

The one command is pnpm everyapp access on (access; the setup file packages/cli/skills/everyapp/setup/access.md): the Zero Trust team (--team <name> when the account has none; the name is permanent), the one-time PIN, an allow policy with every member's and invitee's email (--email, --email-domain add more), two Access applications in front of the Gateway's host and the apps' hosts, and the three CLOUDFLARE_ACCESS_* Gateway settings. Rerunnable; run it again after inviting someone, since Access keeps its own list. pnpm everyapp access show reports; pnpm everyapp access off takes it down (--yes only when the person said so).

What changes for MCP clients: nothing, without Managed OAuth. The plan (packages/cli/src/lib/access/plan.ts) lets /mcp, /mcp/*, /oauth/token, /oauth/register and /.well-known/* past Access on the Gateway's host, /mcp on an app host whose manifest opts in (mcp: { by, why }), and each app's public routes on its own host; the person passes Access's login once in the browser at /oauth/authorize. With Access's Managed OAuth on the Gateway's application (switched on by hand, never by access on), Access itself is the OAuth server: MCP and API clients behind Access.

The CLI by job

Every route the CLI answers (commandPaths() in packages/cli/src/app.ts), run as pnpm everyapp … with --json when an agent drives it (json); every flag is on cli. A group (db, access, secret, mcp, email, events, workspace) answers --help with its subcommands; provider is mcp's old name, kept through launch week.

Not a command: making a personal access token (Tokens → New token: the value is shown once to its person); connecting an AI client (the client's own mcp add, Connecting clients). Not for a person's Gateway: pnpm everyapp teardown --account-id <id> --dry-run empties a dedicated test account named in EVERYAPP_TEST_ACCOUNTS and refuses any other (in the checkout docs/runbooks/onboarding-loop-test-accounts.md).

What to suggest next

The playbook is the proactive next-steps design; everyapp status has no Next: block on main yet (when it lands, rows 1 to 5, 8 and 9 print there and in data.next). Until then an agent reads the signals itself. Commands are pnpm everyapp ….

Noise rules, which bind an agent as they bind the Gateway: rows 1 to 4 and 7 to 9 are for owners and admins, and a member hears one thing, connect an AI client (everyapp_whoami says which the person is; row 10 is an order members see, not a nudge); once per state, said while the signal is true and dropped when it isn't, never a list of what was suggested; at most four at a time, in the table's order, never one the person cannot act on, never a fix status already prints; never "you have not used X" to a person (usage ranks, it does not prompt) and no cap nudges (a cap is opt-in); one command or one URL per suggestion, and a value (a key) never through the chat (secrets).

Where each signal is read: pnpm everyapp status --json (data.apps[] with status, bound, publicRoutes, email and setup; data.owner, data.claimed, data.access, data.mode; data.fixes[] as { code, severity, message, run, note?, fix? } with the codes in ProblemCode, packages/cli/src/commands/status/problems.ts) for rows 3, 7 and 8, every line explained on status; pnpm everyapp secret list --json outside an app directory (data.gateway.names, the Gateway Worker's settings, names only; data.apps[].setup) for rows 1, 2, 2b and 9, with which apps list providers or email in each manifest or data.apps[].setup.unmet[].need; pnpm everyapp mcp list --json (data.providers[] with id, name, on and key: { name, set }; data.next already carrying mcp on <id> and secret set <KEY>) for rows 2 and 2b in one call; from an AI client, everyapp_list_apps (a tools count per usable app; available: false with reason for one that needs setup) and everyapp_whoami (user.role, connection.kind, access, apps), where row 5's "serves tools" is a count above zero; pnpm everyapp workspace users --json, pnpm everyapp workspace connections --json, pnpm everyapp workspace tokens --json and pnpm everyapp workspace usage --json for rows 4, 5 and 10 (what Users, AI connections, Tokens and Usage show); from an AI client, everyapp_workspace_users and everyapp_workspace_usage as an owner or admin, and a member's own everyapp_my_connections and everyapp_my_tokens.

Other MCP servers to recommend

A server the whole team should reach goes on the Gateway as an MCP app (pnpm everyapp mcp add <url>; the Gateway holds its credential), never into each person's client. For the client itself two are worth adding, and nothing else. The Gateway's own connector first: https://<gateway>/mcp, every app the caller can reach plus the everyapp_ built-ins, behind the Gateway's OAuth and consent (Connecting clients); every member should have it. Cloudflare's, below, is for the owner or operator, the person whose Cloudflare login ran everyapp setup. The rule for both, decided for the launch (TODO.md, "Agent-forward layer (2026-10-24)"): everyapp setup and everyapp create install none and print nothing about them; an agent names one in a single line when the person's task needs it and waits for a yes; it never writes a client config unasked, and never one the repository shares (.mcp.json from Claude Code's --scope project, .cursor/mcp.json, .codex/config.toml). The same rule, with the add and remove lines per client, is the setup skill's section "Optional: MCP servers worth having beside EveryApp" (packages/cli/skills/everyapp/setup/gateway.md); the person's page is /docs/connect-ai.

Cloudflare's MCP server

https://mcp.cloudflare.com/mcp (Streamable HTTP). Four tools: search and execute (code mode over the Cloudflare API: the agent writes JavaScript that is run on Cloudflare's side, the token outside the sandbox), docs (developers.cloudflare.com) and whoami. Auth: OAuth with the person's Cloudflare login (Minimal on the consent page is the least; a call that lacks a scope asks the person to add it), or an API token as a bearer header for automation. Scope: the whole account, as the person, within the granted permissions; execute takes an account_id. There is no Gateway narrowing.

When it helps: reading what everyapp status and everyapp access show do not report about the account the Gateway runs in (the zone's records, the Workers and their versions, the D1 database, the Access team and policies, email, logs, API tokens, the plan and the bill). When it is noise: anything everyapp does. The CLI writes the Gateway's database and the deploy ledger beside Cloudflare, and a deploy refuses to replace a Worker last changed in the dashboard or through the API until a person confirms in a terminal (assertReplaceable in packages/cli/src/lib/cf/deploy.ts; rerun_interactive), so a Worker, secret, record or policy written through this server stops the next deploy. Read before write; a write is a live API call on the whole account, as the person, with no undo. When the person says yes, in Claude Code: claude mcp add --transport http cloudflare https://mcp.cloudflare.com/mcp, then they authenticate under /mcp; Codex, claude.ai, Claude Desktop and Cursor are in the setup skill's section.

GitHub

Nothing to add. pnpm everyapp install <GitHub URL> fetches releases/latest/download/everyapp-release.tar.gz anonymously (deploy). For what surrounds a repository (which release, its README, an issue, the Actions runs of an app the person builds), a terminal harness has gh, and claude.ai has its built-in GitHub connector.

Not recommended

Cloudflare's separate docs server https://docs.mcp.cloudflare.com/mcp (the API server's docs tool is the same search) and its product servers. A docs MCP for EveryApp: none; the agent docs are Markdown at https://everyapp.com/docs/agent/<page>.md and /llms.txt, fetched without MCP.

Sources

• packages/cli/src/app.ts (commandPaths), packages/cli/src/commands/status/problems.ts, packages/cli/src/commands/configure/command.ts, packages/cli/src/commands/provider/index.ts (the mcp group), packages/perimeter/src/registry/remoteMcpApps.ts, packages/cli/src/commands/workspace/command.ts and index.ts, packages/cli/src/lib/access/plan.ts, packages/cli/src/lib/app/settings.ts, scripts/pack-for-app.mjs
• packages/toolbus/src/builtins.ts, workspace.ts, view.ts and remote/; apps/every-app-gateway/src/server/toolbus/gateway-mcp.ts and workspace-tools.ts; apps/every-app-gateway/src/server/provider-apps/; packages/sdk/src/internal/providerApps.ts
• apps/every-app-gateway/src/routes/_app/admin.tsx; apps/every-app-gateway/src/server/org-roles.ts, app-cap.ts, services/AdminService.ts (a delete that deactivates instead), services/InvitationService.ts, services/UserPatService.ts; apps/every-app-gateway/src/db/usage.schema.ts, mcp.schema.ts
• docs/design/2026-10-teams.md, docs/design/2026-10-mcp-provider-apps.md, docs/design/2026-10-mcp-apps-ui.md, docs/design/2026-10-mcp-by-url.md, the proactive next-steps design (PR #588, not on main), docs/runbooks/cloudflare-access.md, docs/runbooks/app-releases.md, docs/security-model.md; the MCP-servers rule: PR #585 (TODO.md, the setup skill, connect-ai)
• https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/, https://github.com/cloudflare/mcp, https://developers.cloudflare.com/changelog/post/2026-10-19-cloudflare-mcp-step-up/, https://code.claude.com/docs/en/mcp and claude mcp add --help of 2.1.309 (read 2026-10-24)