【substack-mcp】Cloudflare Remote MCPを本番デプロイする

[nanameru]

Closes #6

変更概要

• OAuth用Cloudflare KV namespaceの実IDをwrangler.jsoncへ設定
• デプロイと読み取り専用の本番接続検証をtest-board.yamlへ登録

検証結果

• npm install: 成功、脆弱性0件
• npm run type-check: 成功
• python3 -m compileall -q src: 成功
• Containerを含むwrangler deploy --dry-run: 成功
• 11個のbridge dispatchをFakeClientで確認: 成功
• 本番OAuth接続: 成功（ChatGPTで11ツールを認識）
• list_drafts(limit=1): 成功（記事本文は表示せず、書き込み系ツールは未実行）

リスク / 注意事項

• Workers ContainersはWorkers Paidプランが必要
• Substackは非公開APIとsession cookieを利用するため、session失効時はSecret更新が必要
• 初回本番検証では書き込み系ツールを一切実行しない
• SUBSTACK_SESSION_TOKENをログ、Issue、PR、AIチャットへ出力しない
• GitHub OAuthのClient SecretはCloudflareの暗号化Secret欄へ直接登録し、リポジトリや作業記録へ保存しない

[amazon-q-developer]

Review Summary

This PR prepares the Cloudflare Remote MCP for production deployment by configuring OAuth KV namespace and adding test validation. Critical issue found that blocks merge:

Critical Issues (Must Fix)

1. test-board.yaml: YAML syntax error on line 11 - cases: [] conflicts with the subsequent case definition, causing parsing failures
2. wrangler.jsonc: Production KV namespace ID hardcoded in version control poses security risk if repository is/becomes public

Recommendations

• Fix the YAML syntax error before deployment
• Consider environment-specific configuration or Wrangler secrets for production infrastructure IDs
• Verify test parsing after fixing the YAML structure

The deployment strategy (read-only validation first) and security notes in the PR description are well-considered.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[amazon-q-developer]

🛑 Syntax Error: YAML structure is invalid. Line 11 declares cases: [] (empty array) but line 12 starts defining a case item with indentation, which conflicts with the empty array declaration. This will cause parsing failures.

Suggested change

	cases: []
	- id: TC-001
	cases:
	- id: TC-001

[amazon-q-developer]

🛑 Security Risk: Production KV namespace ID is hardcoded in version control. If this repository is or becomes public, this exposes your production OAuth storage infrastructure. Consider using Wrangler secrets or environment-specific configuration files that are gitignored.