add cfb_* MCP tools for Cloudflare Workers Builds management

[vibe-dex]

Summary

Customer-facing MCP surface for the Cloudflare Workers Builds backend landing in deco-sites/admin#3170. Adds 14 new `cfb_*` tools across 5 shared UIs: setup (one-click + status), secrets, build vars, builds (list/get/logs/trigger), and versions (list/rollback). Each tool is a thin `callAdmin` wrapper — no Cloudflare tokens or business logic live in this process; tenancy is enforced upstream by admin.

Schemas mirror the admin Props/return types exactly. Five new resources point at the same single `dist/client/index.html` bundle (consistent with the existing pattern); routing is by `toolName` in `web/router.tsx`. UIs handle all `McpStatus` states, surface destructive-action confirmations, and the builds UI polls `cfb_get_build_logs` every 2s for running builds.

Test plan

• Pair with admin PR #3170 in dev; invoke each of the 14 tools from a real MCP host and verify the returned shape matches the admin loader/action
• Tenancy probe: configure `SITE_NAME` for a site the test API key cannot access; confirm every `cfb_*` tool surfaces 404 from admin with no CF call
• UI smoke: open each of the 5 shared pages through the MCP host; click happy path + one destructive path; confirm `toolResult` rendering and confirmation dialogs
• End-to-end setup: against a throwaway test site, run `cfb_setup_status` (unprovisioned) → `cfb_setup` → `cfb_setup_status` (worker + both triggers); re-run `cfb_setup` and confirm idempotency

🤖 Generated with Claude Code

---

Summary by cubic

Adds 14 customer-facing cfb_* MCP tools with five shared UIs to onboard and manage Cloudflare Workers Builds (setup, secrets, build vars, builds, and version rollbacks) from the MCP host, and wires them into the Workers-ready app (createApp + static asset serving via ASSETS and wrangler). Also fixes cfb_list_builds by normalizing admin responses to arrays to prevent schema errors.

• New Features

  • Setup: cfb_setup, cfb_setup_status for one-click onboarding and status.
  • Secrets: cfb_list_secrets, cfb_set_secret, cfb_delete_secret (names/types only; values never returned).
  • Build vars: cfb_list_build_vars, cfb_set_build_var, cfb_delete_build_var (plain text, non-secret).
  • Builds: cfb_list_builds, cfb_get_build, cfb_get_build_logs, cfb_trigger_build; logs UI polls every 2s while running.
  • Versions: cfb_list_versions, cfb_rollback with best-effort binding warnings.
  • Each tool is a thin callAdmin wrapper to admin endpoints in deco-sites/admin#3170; tenancy enforced upstream, no Cloudflare creds here.
  • Added five ui://mcp-app/* resources that all serve dist/client/index.html; web/router.tsx maps tools to shared pages; api/app.ts registers all five resources.

• Migration

  • Requires the admin changes in deco-sites/admin#3170.
  • Ensure the MCP host provides the site name and admin API key expected by callAdmin (getConfig); no Cloudflare tokens are needed here.
  • Start with cfb_setup_status (read-only) or run cfb_setup to provision triggers and connect the repo.
  • To deploy on Workers, build the web bundle then use wrangler: bun run build:web && wrangler deploy (or deploy:preview); static assets are served from dist/client via the ASSETS binding. Optional: set DECO_ADMIN_URL in wrangler.jsonc to override the admin origin.

^{Written for commit 627f0a0. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	admin-mcp	627f0a0	Commit Preview URL Branch Preview URL	May 13 2026, 12:38 AM