START HERE
Your own shop, ready to build.
Enter the facilitator’s event code. We’ll create private sample orders and inventory for this browser.
Restore my shop
The code stays on the server after joining. Your session lasts four hours. Download a private recovery pass in Access & take it home to return from another browser.
WHAT YOU WILL BUILD
From a question
to a verified action.
- 01Discover the tools
A real MCP endpoint tells the client what it can do.
- 02Ask about your shop
Read orders and inventory from an isolated D1 database namespace.
- 03Review before writing
Preview a support ticket. Confirm its exact contents yourself.
This is a fictional shop with real persistence and protocol calls. No customer systems or purchases are involved.
YOUR PRIVATE WORKSPACE
Northstar Supply
CLIENT → MCP SERVER
Talk to your tools
The manual client makes the same protocol calls an AI client uses. Start with discovery.
Inspect the protocol trace
The actual JSON-RPC requests and responses. No credentials are included.
No requests yet.
YOU DEFINE THE BEHAVIOR
Edit your tool policy
Change lowStockThreshold from 5 to 15. Save, then run check_inventory for BAG-02. Watch lowStock change from false to true.
Threshold 1–30 · priority normal/high · description 20–240 characters. This configuration changes real tool behavior; arbitrary code cannot run.
Try changing the ticket prefix, priority, tool description, and ticketsEnabled. Saving revokes pending proposals from older revisions.
OPTIONAL LIVE WORKERS AI
Let a model choose the tool
Checking AI configuration…
D1 / YOUR SHOP ONLY
The records behind the tools
Orders
Inventory
HUMAN CONFIRMATION
Review proposed tickets
These are proposals only. Confirm writes the exact preview to D1. Reject discards it. Proposals expire after ten minutes.
Confirmed tickets
PERSISTED IN D1AUTHORIZATION CHALLENGE
Prove the boundary holds.
Ask a workshop partner for one of their order IDs. The checker sends real MCP requests: your client must not read that order, and a read-only client must not prepare a ticket.
150-MINUTE FIELD GUIDE
Build it. Change it.
Prove it works.
MCP is a shared language between an AI client and tools. Cloudflare Workers runs your server, the Agents SDK handles that language, and D1 stores your shop’s records. Workers AI can choose which tool to call. Your server still decides what is allowed.
The first endpoint milestone targets 15 minutes after the facilitator has deployed the shared host. Your private tools run there during the workshop. A personal cloud deployment is a separate coordinator-led handoff.
- 00–15 MIN
Connect to your private shop
Open Workbench, enter the event code, and choose Connect & discover tools. Open the protocol trace. Find the initialization response, then the list of three tools.
Checkpoint: “Endpoint connected” appears only after the server receives a real discovery request. Copy an order ID from your records into the client and run
lookup_order. Compare the result with the record.Explain it: The browser is a client. The endpoint is
/mcp. Tool arguments carry the order ID; your secure session supplies the shop identity. - 15–35 MIN
Read the contract
Run
check_inventoryforBAG-02. Expect quantity 12, threshold 5, andlowStock: false. In the trace, find the tool’s input schema andreadOnlyHint.Try an invented order ID. It must return a tool error, not another customer’s data. A schema describes the arguments; a database filter enforces ownership. Neither a model prompt nor a tool annotation is authorization.
- 35–60 MIN
Make the tool your own
In the JSON editor, change the shop name, set the threshold to 15, and write a clearer inventory description. Save. Run inventory for
BAG-02again.Checkpoint: Quantity stays 12;
lowStockbecomes true and the policy revision increases. The server records “Policy changed behavior.” Discover again to see your description.Stretch: Set threshold to 31 or add an unknown key. Saving must fail with a useful validation error. Correct it and save again.
- 60–85 MIN
Separate a suggestion from a write
Select
prepare_support_ticket, paste your delayed order ID, and write a useful summary. Run it. Check that the confirmed ticket list is unchanged.Read the proposed contents, then choose Confirm this ticket. Refresh. The exact ticket persists. Prepare another and reject it. Change
ticketPrefixandticketPriority; a new proposal reflects both.Stretch: Prepare a proposal, then change the policy. Confirming that stale proposal must fail. Prepare a fresh one under the new policy.
- 85–110 MIN
Put an AI client behind the same boundary
If Workers AI is enabled, ask “Check inventory for BAG-02.” Then ask it to prepare a support ticket, including your exact order ID. Inspect the tools it chose and their actual results. Confirm only after reading the preview.
The model gets at most one inference call and three tool calls per request. It has no confirmation tool. If live AI is unavailable, use the manual client and discuss the model’s role; the interface will not fake an AI response.
Change the inventory description, discover again, and compare the next model selection. Model behavior may vary. Tool results remain the source of truth.
- 110–135 MIN
Try to cross the boundary
Trade only sample order IDs with a partner. Run the boundary challenge. Both checks must pass. In Access & take it home, create a read-only token. Use the token probe to list tools: the ticket tool must be absent.
Turn
ticketsEnabledoff and discover tools again. Try asking the model to ignore the policy. The server still refuses writes. Restore the setting for your final demo.Discuss: Hiding a button is not authorization. The server must verify every request. The automated test suite also checks foreign confirmations, token revocation, replay, injection, and concurrent confirmation.
- 135–150 MIN
Keep the build and show your proof
Download a private recovery pass, your portable source ZIP and a separate data export. The source includes your current configuration as its default. Neither export includes session tokens, event codes, or model credentials.
Show your six verified milestones and the changed tool output. Follow the coordinator’s personal-deployment handoff if available. The source bundle contains operator deployment instructions; no per-student repository is needed.
Exit ticket: Explain where shop identity comes from, why an AI cannot confirm a ticket, and what happens if you change policy after preparing one.
When something goes wrong
- “Setup required” or event code unavailable
- The facilitator must finish D1 migrations, secret setup, and hostname configuration.
- “Order not found”
- Copy an exact ID from your shop. Another participant’s ID is supposed to fail.
- “Proposal expired”
- Prepare a new proposal. It may have expired, been rejected, or come from an older policy revision.
- AI error or limit reached
- Use the manual MCP client. Failed inference attempts count toward the 30-call budget.
- Session expired
- Sessions last four hours. Use your private recovery pass to restore the same shop. Entering the event code without a session creates a fresh shop.
PORTABLE BY DESIGN
Your endpoint. Your build.
Connect another MCP client
The browser uses an HttpOnly session cookie. External clients use a short-lived, scoped bearer token. This workshop uses direct tokens, not an OAuth sign-in flow.
Creating a token revokes the previous one. Tokens never allow browser confirmation or configuration changes.
No token probe yet.
Configure your MCP client with the endpoint and an Authorization: Bearer … header. No desktop client is required.
Take it home
Your ZIP contains the Worker, browser client, SQL migrations, tests, workshop instructions, and your customized defaults. Source and data are separate downloads.
Sign in first. Credentials are excluded. The data export contains only your fictional shop records and milestone evidence.
Keep this hosted workspace
Download a private recovery pass to restore this shop from another browser for 90 days. Your saved work and remaining usage limits stay the same. Downloading again replaces the previous pass. Treat it like a password.
Deploy to your own account
Your build runs on the sponsored workshop host. The source and configuration can be deployed to your own Cloudflare account using the included guide. This app does not create or convert accounts.
The included README explains how an operator deploys the standalone app. Workers AI requires its own account capability; do not assume it transfers with a temporary account claim.
Save your recovery pass and exports first. Signing out revokes browser sessions and client tokens; your recovery pass remains valid until revoked or expired.