How it works

Left: how a change ships. Right: how a tool call arrives. Click for full size.

Two repos split the work. One holds a directory per MCP server: some wrap upstream packages, others are first-party TypeScript. GitHub Actions builds only the directories a push changed, pushes each image to GitHub Container Registry, writes its sha256 digest into a Pulumi ESC environment, and triggers a deployment. The other repo, a Pulumi C# program, reads those digests and deploys each container over SSH from a customer-managed Pulumi workflow agent. At runtime, Claude signs in through Cloudflare Access with OAuth, which forwards each call with a signed token down one Cloudflare Tunnel. The tunnel reaches each MCP container by its Docker network name, and no container publishes a port. The server re-verifies the token, then applies its own limits, such as the MQTT server's topic allowlist, before touching a home system.

Notable engineering details

• Two independent checks. Access at the edge, then origin-side verification of the signed token on the first-party servers that have one, against that server's own audience, which the Pulumi program pulls from the stack that owns the Access apps through a StackReference.
• A narrow MQTT server. The broker is pinned from configuration and every subscribe and publish is checked against read and write allowlists. It replaced a third-party server whose tools accepted a host and credentials on every call.
• Request and response over pub/sub. Subscribe before publishing, accept only the live echo (never a retained message), and re-check every delivered topic against the allowlist.
• Merge ships it. CI maps each directory to its ESC key and writes every digest in one job, so parallel builds can't race on the environment. The only human step is a one-time switch to make a new server's image package public.
• Digest-pinned images. Each container depends explicitly on its image resource, so a replacement never fails trying to delete an image that's still in use.
• Stateless transport. A fresh MCP server per HTTP request, so no session has to survive the tunnel hop.

The source is private for security and privacy reasons, so the walkthrough quotes a redacted extract and its line numbers aren't linked to GitHub.

Code walkthrough

Step through the code, chapter by chapter

Written by code-walkthrough, a Claude Code skill I built so a private codebase can still be explained honestly, quoted verbatim from a redacted extract.

Back to the portfolio