GoldShore MCP
Private tooling for approved humans and agents.
The public site can explain the offering, but mcp.goldshore.ai itself is reserved for identities that have already been approved. That keeps the surface useful for the team without turning it into an open prompt endpoint.
Actual connection
One endpoint. One server. Permission-gated tools.
The production surface is mounted inside the unified gs-api Worker. The protected admin console reads the same live tool catalog and executes through the same implementation—there is no simulated server list or separate MCP Worker.
[mcp_servers."mcp.goldshore.ai"]
url = "https://mcp.goldshore.ai/mcp"
bearer_token_env_var = "MCP_GOLDSHORE_TOKEN"Cloudflare Access service identities may also require CF-Access-Client-Id and CF-Access-Client-Secret headers. Keep all values in an encrypted secret store.
Request approval
Account and tool permissions are granted to a named human or service identity.
Authenticate at the edge
Cloudflare Access validates the identity before the request reaches gs-api.
Initialize the client
Connect with Streamable HTTP and negotiate the supported protocol version.
Review available tools
The live tools/list response and protected admin console share one canonical catalog.
Who can use it
Only you, approved operators, and a dedicated agent/service identity path.
How it is gated
Cloudflare Access sits in front of the host so the endpoint does not accept anonymous use.
What it is for
Controlled prompts, read/write actions, and internal tool calls that support the GoldShore stack.
What stays out
Public prompt boxes, open registrations, and broad anonymous tooling access.
Policy
Public explanation, private execution.
GoldShore can describe the MCP capability on the public site, but the live host stays behind Cloudflare Access and does not accept anonymous prompts or changes. That gives the product a front door without making the underlying tool surface public.