Tl;dr
Releasing this today: https://github.com/victor-bajanov/codemode-mcp-public.
It's a scaffold for standing up remote MCP servers that follow Cloudflare's Code Mode pattern - comes with Gmail and Xero providers, and you can add your own in maybe 100 lines of code.
To find out why, read on.
But why?
Like many (most?) others running a solo business, I use AI heavily to help me with admin, finances, and the like. Specifically, I use Claude, which is mostly great.
A little while ago I ran across a couple of annoyances though:
- The Gmail connector can only connect to one account at a time. Naturally, I have two accounts: my work (Bajanov Advisory) account and my personal gmail which I've had since the days when dinosaurs roamed the earth, and gmail accounts were invite-only.
- I often get Claude to sense-check my maths on financial operations before executing to make sure I've provisioned enough money for future liabilities (tax and stuff), which involved a lot of screenshotting-and-pasting, followed by painstakingly following Claude's instructions in the UI step by step.
- The other part I've been a little disappointed by in Xero is the amount of manual data entry you still have to do in 2026. They have companion apps for things like parsing invoice PDFs, but they have strong 2008 vibes (looking at you, HubDoc)
So naturally, I looked around for a Xero MCP server. GitHub is full of them, there's even an official one! But...
... they are all local MCPs, so you can't use them for submitting expenses on the go (yes, Xero has an app for this, no, I don't understand why it takes 15 minutes to process a single invoice photo)
... the official one doesn't cover the full API surface, specifically it only has NZ Payroll (I'm in Australia)
... the others are random forks with zero github stars, so would need a full code audit anyway
So I wondered, how hard would it be to set up my own remote MCP for Gmail, that could be connected in parallel to the main one (since it would be a custom connector in Claude), additionally lets me do some things the official one doesn't expose tools for (like creating filters that label things)? And a remote MCP for Xero that I could use on the go, with Claude on my phone?
Enter Cloudflare
Around the same time, I was reading and rereading Cloudflare's 'Agent Week' announcements which included a post about their Code Mode MCP architecture.
The Code Mode architecture has an obvious appeal when you're dealing with a new API surface for a complex app (like Xero, or, for that matter, Gmail). Instead of publishing hundreds of tools and relying on lazy loading search, you let the LLM write code against the API, grounded with the OpenAPI spec accessible via a search tool. But actually, Claude is quite well-versed in many APIs for common software products out of the box, so it doesn't have to start by reading and grokking the spec docs - it mostly gets it right, with the search tool to fall back on to fix errors.
And, since I already wanted two of them, obviously (I thought) it would make sense to set up the infrastructure once so that I could just cheaply add new APIs and deploy them.
I already use Cloudflare a lot (my website and this blog are Workers all the way down), so it seemed like a natural place to host an MCP.
One obvious caveat with the Code Mode idea is that it requires your MCP server to execute arbitrary code that an LLM has written. You know nothing about that LLM - it could be your Claude client. It could be Mythos working under the instructions to break into your MCP. You probably don't want to run this on your laptop, or on a Mac Mini under your desk (they're sold out anyway...). You want this running somewhere where container escape means they are in the super-hardened cloud environment of some hyperscaler whose security engineers collectively earn the GDP of a small country.
Cloudflare largely solved this with their @cloudflare/codemode library, and it's a really good natural fit to their core infrastructure. The server you connect to is a Durable Object (DO) that handles your session, but when your LLM submits code via the execute tool, it spins up a Dynamic Worker with no access to anything other than the specific function bindings it's been given. They claim these start up in single-digit milliseconds - which is AFAICT the fastest version of this model you're going to find from any vendor today. In fact, most don't have a managed product that can really cover the use case at all, without you having to write a lot of the security isolation parts yourself.
Importantly, the Dynamic Worker doesn't have a fetch(..) binding - it can't make arbitrary network calls. It has a request binding that lets it make calls to the API it's allowed to call (there is no way it can override the site, because that is held outside the Dynamic Worker). The host (the DO) handles the request and can apply additional sanitisation or blocking rules.
That last sentence is important - it lets you set up your MCP with a finer-grained permission set than what the provider's API scopes allow. For example, you probably don't want to have your Gmail MCP able to send emails to arbitrary people (that plus reading your emails, which you presumably are going to allow as well or it's not very useful, is a lethal trifecta right there). But wouldn't it be useful if it could send some emails? Like, if it could email you reminders, or maybe in a corporate setting if it could email your teammates (high-trust environment) but not the whole company and not your boss (low-trust... or umm I guess I don't know how you feel about your boss 😜). But you can't get there with API scopes - either the OAuth client has gmail.send or not.
This intermediate handler layer lets you not only check which API tool is being called, but inspect the payload and decide based on that. So you can have an MCP which is allowed to email whitelisted recipients, but not anyone else. You can have the MCP authorise certain bills in Xero but not others (based on counterparty contact, or amount, or whatever you want). The handler is just whatever typescript code you care to (have Claude) write - so your imagination is the limit.
The adventure
I don't want to write a boring step by step account of what I did, but I will pull out a few highlights.
My tool of choice for this was Claude Code with the excellent superpowers plugin by Jesse Vincent. It forces you to start with its brainstorming skill, which asks you questions you never thought you would get asked, lets you test out ideas and weigh up pros and cons of architectural and workflow decisions, and then commits that all to a design document for you to review and sign off.
It (Opus-with-superpowers) emphatically suggested I don't try to build a generic scaffold, but instead follow a pattern of:
- Build a Gmail MCP and get it working
- From this code, pull out a lightweight scaffold based on obviously reusable things (like OAuth - a lot of this stuff is handled by the Cloudflare libraries anyway)
- Use the scaffold to add the Xero MCP, taking note of where it fell short
- Refactor the scaffold and the whole codebase to properly separate generic from provider-specific concerns, knowing what you know from having done two provider implementations
- Add more advanced features like MCP Elicitation
So that's what we did. I kicked off the first bullet point overnight on May 4, in a constrained container running Claude Code with --dangerously-skip-permissions, and woke up to a working Gmail MCP implementation on May 5. Obviously, the Force was with Claude on that particular night.
That was the first learning - pretty complex stuff can get built for you while you sleep, using nothing but Claude Code with a publicly available orchestration plugin.
After that it was pretty smooth sailing in that vein until I (we? Claude and I?) got to Xero. That was the first bug we hit (cloudflare/agents#1466). Turns out that using brand-new libraries comes with some risk! But boy was it a lot of fun - Claude debugged the living daylights out of this (actually got to the root cause very fast, and in a few more minutes created a harness to reproduce it in isolation), I just asked questions and gave nudges. A friend asked how long it had been since I raised an issue against an open source project's github repo...
Debugging MCP elicitation also had its challenges. Turns out elicitation is not supported anyway in any client I use except Claude Code (and MCP Inspector, the debugging tool), which makes it less useful than I expected. So right now you can set up permissions to elicit on some steps, but they just fall back to deny in those clients. That was the second learning, and a bit of a disappointment.
One day, though.
Back on the bright side, Cloudflare have been amazingly responsive - fixing 2 of the 4 issues I raised pretty much straight away. From their github commit history, it's pretty clear they lean very heavily on AI coding and review tools as well.
So what do I do with this?
If you're brave enough, you can clone the repo, set up a Cloudflare account, and go nuts. Maybe there's that SaaS app you've always wanted to connect to your Claude/ChatGPT but it was just too hard - now's your chance. Just point your AI coding tool at the codebase, with superpowers, and ask it to write the provider module. I bet you it will get it right first go, or maybe second at the worst.
You'll need a "Workers Paid" account to host it - USD 5 per month (so if you live in Sydney that's like... a deposit towards a coffee).
Please enjoy!
(Note the LICENSE file in the repo - if you want to use this commercially and your org is turning over more than $10m AUD, reach out first... otherwise go for it).