MCP Server Production Kit: The production layer for MCP servers — OAuth, limits, evals

Hey PH 👋 I run a tiny web agency and we ship MCP servers for clients. Every tutorial stops at hello-world — then security review asks about auth, abuse limits, logging, and how you test a thing an AI agent calls. We kept rebuilding the same layer, so we packaged it. What's inside: OAuth 2.1 resource-server auth (bring Auth0/WorkOS/Clerk/Keycloak — three env vars), per-identity × per-tool sliding-window rate limits on Workers KV, structured JSON logs, a typed tool registry (one line to register a tool), and the part I'm proudest of — an eval harness that drives your tools through a real MCP client the way an agent actually calls them: happy path, schema attacks, scope denial, rate-limit behavior. 6/6 green at packaging. It deploys to Cloudflare Workers with one command, on the official McpAgent pattern. The MCP spec is moving fast (a new release candidate shipped in late July), so every license includes 12 months of updates — spec churn is our problem, not yours. $79 solo / $149 team / $349 agency, one-time. Honest caveat: it's TypeScript + Cloudflare only for now. Ask me anything — I'll be here all day.