Manage the security-room Cloudflare Access policy from config via a security-team GitHub team

.github/workflows/deploy.yml

@@ -66,11 +66,16 @@ jobs:
           ORG_BILLING_EMAIL: ${{ secrets.ORG_BILLING_EMAIL }}
           DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
           DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
+          CLOUDFLARE_ROLE_MANAGEMENT_TOKEN: ${{ secrets.CLOUDFLARE_ROLE_MANAGEMENT_TOKEN }}
         run: |
           echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
           export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
           pulumi login gs://mcp-access-prod-pulumi-state
           pulumi config set discord:guildId "$DISCORD_GUILD_ID" --stack prod
           pulumi config set discord:botToken "$DISCORD_BOT_TOKEN" --secret --stack prod
           pulumi config set githubBillingEmail "$ORG_BILLING_EMAIL" --secret --stack prod
+          # Cloudflare Access is optional until the CLOUDFLARE_ROLE_MANAGEMENT_TOKEN secret exists
+          if [ -n "$CLOUDFLARE_ROLE_MANAGEMENT_TOKEN" ]; then
+            pulumi config set cloudflare:roleManagementToken "$CLOUDFLARE_ROLE_MANAGEMENT_TOKEN" --secret --stack prod
+          fi
           make up

.github/workflows/preview.yml

@@ -66,6 +66,7 @@ jobs:
           ORG_BILLING_EMAIL: ${{ secrets.ORG_BILLING_EMAIL }}
           DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
           DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
+          CLOUDFLARE_ROLE_MANAGEMENT_TOKEN: ${{ secrets.CLOUDFLARE_ROLE_MANAGEMENT_TOKEN }}
         run: |
           echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
           pulumi login gs://mcp-access-prod-pulumi-state
@@ -81,6 +82,9 @@ jobs:
           if [ -n "$ORG_BILLING_EMAIL" ]; then
             CONFIG_FLAGS="$CONFIG_FLAGS --config githubBillingEmail=$ORG_BILLING_EMAIL"
           fi
+          if [ -n "$CLOUDFLARE_ROLE_MANAGEMENT_TOKEN" ]; then
+            CONFIG_FLAGS="$CONFIG_FLAGS --config cloudflare:roleManagementToken=$CLOUDFLARE_ROLE_MANAGEMENT_TOKEN"
+          fi
 
           # Run preview and capture output
           set +e

Pulumi.prod.yaml

@@ -4,3 +4,10 @@ config:
   googleworkspace:credentials:
     secure: v1:Ntr2su0kgwp0oAh3:av1h5ir44/HNmtOQBftB6AD/0N7r+nLtIuPNnM47Xgyo71xO0GiV6oG81fT7dDhaxOwbBMWiEiOP+8s3XRiTJoAQHlqybvyHsgiprELsQfAPo2srnSDt289ggi11zPttYb/iNgOvoKwFxCfrapPv3Gnh0akbl3AgsJafs0uNToiNWmV176GaepR2JHEc7dpjIzpS6CFS8lVVl262ROInU85n1mEtaQ9eYZ69LPJn+ZQLSHAdMRROP1hv49Q26iqh4icJGmqbQQ6XGh4e5E0TgHT+/UPbuAzKnearRN+jFdqaJPQneXav9xy5W9zS4834LGa6Otawa12r5DlSIB5LunYCVDENhXcDhouwFHc7OK6bVUe2iY+557YfESZcznuYuHOq0ChPyKKJ7n5nE0Pu34nEJWMR3BARCLcGMuPIQALiecFMKDJjbVJN0ShS0nch4dDJpWH4KHNqyCs2q9h/Mume9pSu4PhZXg28VcBILh4a9B0JF2BzwqFy79OP0gmoz/B7IoIcjN28HnHrYmnK/97xrbTV7YzI2x5iYY9xwW3IlaKIrzr8f6vBAXTZmSFTOAqVWdsGgzalpqljDIqwJbh2YVQAy8NPLhfSxlkMJNPxfO0DR9AcL/kITQPL/f5WkRGU9+aur2K7gp2vkXUoObx8elnogIHpklPHRmb0obqoR8LTCD97Vt/rLL+ZaPgp2eBWwWydz1XAo78PVq53qGGbXk5lrv+i4qUxiUy8639ea4sdRJf2yGNWJb14hrpf5PBn7+bn2mSMdyY2jQIVbE0ltFYUVfPrzUNG51O39EwD9iFf/aR0lyxgO+fF8mMWOOTZleCPBMDY1t6c5u3TlipuSZF79q2LbuTnXGA8XmONiqoGyKDVIaYTNpOllFtuL105scGledqj9S2Q5bbgdRldlFXbFbGXWAYtj4A1z7gBRklb9UMJXbMyECRtfepbLu93XgKZaKjfXdRZkNtVNOjrE9KsGEUp0dkLUToKzj9tdDGxninCEUanhEV5ACTuXxGNqcvYoegYVRnGuLfCZTVMWwIezombduQDh7mEKkBRyw+XqQeRjCGHm+tZaAeo5p82cGX2bcxR2KselYfCVzP3n/yJsqp/D+STYd3bqq5Kno1f2obys2pyGhDri+scaZRZiWF7EysuYEuMC1D6EPkIo9ZEDfhgBU5RbJqC8h8DTTTLzsJa8r25L7qph/E7wVQywSLlL6e6GQ9bbepSikrNxXvftzkmEDNruN+5dVFznOEL5rTRa8Q98Dwet3i5c2PzWCzhz9/24rE0vrEOPO6NNgQ+du53wfG5uwkXEjAC4+w8nbXUrqe64y6o6AnRlo8YBwECV+qNfdpl0+6/JTP83L6aWo+u+QIiq4qpTF95SBNBt//SXk1KkYYgYNTo5Y/thjQ4ycHakHO4Mu/6Gz3+20uIOcSyhvO30Pk65scNcsTPHy1cT61cdK77fipJynVkn6rLKSWvqXMEeP6LwnioLx5WChyNAf+oubFMzlgS8zLW+kH8NxR4BIBpwbuyy+hpXXKZKNYKJtCzSUdBuV3PNZ0b0BaIEr6CyeqPtTPCfAoCxpvXipYJUEWLe6yPdorBQU0AYp3jMblrmqz/eAAPkiI5c7gTF6FAk0ezjzhvY3nVKPIvNi8Zj/5oxlt7p/kGjtUbMaQmGDrZco6TfDf0AtdERIDCUWnplKqLuz6NjIbZ7acAeyrBKyVslKNDn6tRZGk/4XrUFYgIEdWShOLZxAxI7o564n9+TycSIkz+LWYltQtRM1v5lnwNHSWXaXp7NUbhwWA5FlWPKBDOznhM0d6R5CRGfmtxE0KMQ3wac6QiODL3Zh5TJeKyFvXTh9hpSVfCafCMDtPWjzYj0X5G/DFCyNhIOf8Z8jfMBf2kh0AWI8ojZNS3c8ip1+elzLcGLDVfkLGF7rwvVDYXL/2cfamtfwR+CrljXlzT+FPRaMER8plhj6hN27UCWjILXVE7UqInNz/nkTS/YsZtVRaafCEXO1ytyV0gkXbKk00WFN6Qg3cK8HB0ITTYns8+NhstRTXewj9VJv/Kl7GV9Uz/DQX4KZW9rlJNd3XZjPYJRsHeRNXCnezTydyLpjrLYipbpYnuQcqBhE7S3nBiM+fTFrm8XJr7EBf4uIm8/9PSG52PMUiSsLHt+qMg36z+pliavLU5GXUw8RLONP2EnjI14vu8rz8BqlXhUuluWYRKeVNXprIG6pAkahqxhTmqwqYu1VIPDTPfuWJfQ9RCz5BYQEN4flTkuqGj0yYdl9CRxuL+m1BbPcZLufx+gY0gC5buiskzalfek3QhQLu2kH9P4zGuK/03jRVYlPf4IL0rt4l/e5iMV3bKB27Ds6W2An4NQB13WaujyINDiicJcRCyIQwsJt9aiLxf+NKc7N3iCLgjVw85K63WcDcW+zh8YOc89mJj/y3SOfTDAVCUjEzye9TldX8/7biavhsn4Bwdd71VkzxS/eSAJHeTXjw94FveP1d/A86LMBl/PThVEJmQMBZFjiMVw8x8xWG78NfqZDR2QeMU8meBhXrj4gwb3s2H9+H/6HcxoPB4O5kGbY4piQ3yu9MzPojVpQspdT2tgH+CAaNg3qHy3R/HHuWLxuXVGZj+2t3NoGvHrQRiS5e/9IwkQ2EA/3b20ZsBqP9F63oApr+PVnZYMbtRjJLdl02tIsMm4n5xoOI+0yP/93XSwD/rM+YXYu2PLiQRm5IkbDVu8Hg15OzIHSiGkTyPZb2/QBja10O9M/suKF7VZmS74skWZH3ETCNWyA5TpNwltafvou/1WtipHqNs45SXKJMr9iT3yI2jr/KGXlBDIih7mTiY5KN9mioAH1F5ROe0siEzBdaQe9soQsOBfFIZYzMBN/IKjuiqohG2DdDfsZqyYn0zO4GrqQ6Afv0fDY2fJJfbXCbn9i8saEI8CcSI2c2WTIxgQk+q6iOBBr0X/7WGzH7lmAHd4sDoIIi8F1QJyNlFsWj3r+5oe64jQa2XAkgVF3I6JENWpgSz6AJu7zQgnbg3ZIfF0kkwt+jRxEXsuLwdDO0XSxKBqv7Ynk0xDsV+5BkHzLv70fXh6BM8+LcK7kI8dgy8zJMLtctmAd9LmWcs7uWw8Di/EnZHZR5pDju0a+miq15yvHiJVjN6k5SoFRCVOQ==
   github:owner: modelcontextprotocol
+  # Cloudflare Access (see README "Cloudflare Access (security-room)").
+  # cloudflare:roleManagementToken is set by the deploy workflow from the CLOUDFLARE_ROLE_MANAGEMENT_TOKEN secret.
+  cloudflare:accountId: c39d6379ccfdb20a3627eeddffa80ec9
+  cloudflare:githubIdentityProviderId: 1e53bc11-a504-4572-92d1-4c8d56fc198b
+  # Adopt the existing dashboard-created policies on the first deploy. Set to "false"
+  # in a follow-up PR once the deploy that imported them has succeeded.
+  cloudflare:importExistingPolicies: "true"

README.md

@@ -12,6 +12,7 @@ Infrastructure as Code for managing access to MCP community resources using Pulu
 - **Google Workspace Groups**: Automatically syncs group memberships for @modelcontextprotocol.io email accounts
   - **Email Groups**: Groups with `isEmailGroup: true` accept emails from anyone (including external users) and notify all members. External posts are moderated for security.
 - **Google Workspace User Accounts**: Provisions @modelcontextprotocol.io accounts for members of roles with `provisionUser: true` (directly, or via a role nested under one through `github.parent` — e.g. SDK teams under `sdk-maintainers`, working groups under `working-groups`)
+- **Cloudflare Access (security-room)**: Syncs the Cloudflare Zero Trust Access policy that decides who can sign in to `securityroom.modelcontextprotocol.io` from the roles declared in [`src/config/accessPolicies.ts`](src/config/accessPolicies.ts). See [Cloudflare Access (security-room)](#cloudflare-access-security-room) below.
 - **npm & PyPI Package Publishing Access** (declared, not applied): Expected registry access is declared in [`src/config/packageAccess.ts`](src/config/packageAccess.ts) and drift against the live npm registry is detected by CI — but changes are applied manually by a maintainer. See [npm & PyPI Package Publishing Access](#npm--pypi-package-publishing-access) below for why and how.
 
 ### Opting in to a Google Workspace account (maintainers)
@@ -31,6 +32,24 @@ If you're a maintainer — explicitly or implicitly (SDK maintainers, working gr
 
 Once merged, Pulumi provisions the account. An admin will share your initial password (retrievable via `pulumi stack output --show-secrets newGWSUserPasswords`).
 
+## Cloudflare Access (security-room)
+
+[securityroom.modelcontextprotocol.io](https://securityroom.modelcontextprotocol.io) is protected by Cloudflare Zero Trust Access with GitHub as the identity provider. The reusable Access policy `Maintainers` that grants sign-in is managed from this repo by [`src/cloudflare.ts`](src/cloudflare.ts), driven by [`src/config/accessPolicies.ts`](src/config/accessPolicies.ts):
+
+- Each entry in `ACCESS_POLICIES` lists the roles (from `roles.ts`) whose GitHub team may sign in. Pulumi renders one `github-organization` include rule per team on the policy. Nothing else about the Access application (domain, identity providers, session settings) is managed here.
+- **Cloudflare matches direct team membership only.** A member of `python-sdk` does not satisfy a rule for its parent team `sdk-maintainers`. That is why the policy allows the `security-team` team (the `SECURITY_TEAM` role: the MCP Security Team of SDK security leads, which has no parent team and grants no repository permissions) alongside `core-maintainers`, `lead-maintainers` and `security-managers`.
+- **To add someone to the MCP Security Team** (and grant sign-in): add `ROLE_IDS.SECURITY_TEAM` to their `memberOf` in [`src/config/users.ts`](src/config/users.ts). **To allow another team**: add its role to the policy's `roles` in `accessPolicies.ts` (validation checks the role exists and has a GitHub team).
+- After access is granted, a user who was previously denied must revoke the "Cloudflare Access" OAuth app under their GitHub settings (Applications → Authorized OAuth Apps) and sign in again, otherwise Cloudflare keeps using the cached team list from their earlier login.
+
+### One-time setup
+
+1. In the Cloudflare dashboard for the **MCP Domain Account**, create a token dedicated to Access policy role management. Give it a descriptive name so it does not read as a generic API token, e.g. `mcp-access: Access policy role management`, and scope it to only **Account → Access: Apps and Policies → Edit** on the MCP Domain Account. Do not reuse this token for anything else.
+2. Add it as the GitHub Actions secret `CLOUDFLARE_ROLE_MANAGEMENT_TOKEN` in the `production` environment (repository settings → Environments → production). The deploy workflow passes it to Pulumi as `cloudflare:roleManagementToken`. Until the secret exists, the Cloudflare module logs "Cloudflare integration disabled: roleManagementToken not configured" and creates nothing, so previews stay green.
+3. The account ID and GitHub identity-provider ID are non-secret and live in [`Pulumi.prod.yaml`](Pulumi.prod.yaml).
+4. **Adopting the existing policy.** Pulumi's `import` resource option only succeeds when the program's inputs match the live resource, so adoption is two deploys:
+   - With `cloudflare:importExistingPolicies: "true"` in `Pulumi.prod.yaml`, the first deploy imports the existing `Maintainers` policy (by its `cloudflarePolicyId`) as-is, ignoring its rule lists.
+   - Then set the flag to `"false"` in a follow-up PR; its preview shows exactly the include-rule changes that the next deploy applies. Leave the flag off from then on.
+
 ## npm & PyPI Package Publishing Access
 
 Publishing access to the `modelcontextprotocol` npm organization and to the MCP PyPI projects is **config-as-code with human-applied changes** — deliberately outside the Pulumi resource graph:
@@ -94,6 +113,9 @@ The following secrets must be configured in GitHub Actions for automated deploym
   - Used to decrypt encrypted values in Pulumi stack configuration
   - Keep this secure - if lost, you cannot decrypt your Pulumi state
 
+- **`CLOUDFLARE_ROLE_MANAGEMENT_TOKEN`** (optional, `production` environment): Cloudflare token dedicated to Access policy role management, scoped only to **Account → Access: Apps and Policies → Edit** on the MCP Domain Account (not a general-purpose API token)
+  - Used to manage the Cloudflare Access policy for `securityroom.modelcontextprotocol.io` (see [Cloudflare Access (security-room)](#cloudflare-access-security-room))
+
 ## Initial Setup
 
 If setting up this infrastructure for the first time:

package.json

@@ -14,6 +14,7 @@
   },
   "license": "MIT",
   "dependencies": {
+    "@pulumi/cloudflare": "^6.21.0",
     "@pulumi/github": "^6.11.0",
     "@pulumi/googleworkspace": "file:sdks/googleworkspace",
     "@pulumi/pulumi": "^3.218.0",

scripts/test-config.ts

@@ -17,6 +17,7 @@ import {
   getNpmPackageAccess,
   NPM_DEFAULT_POLICY,
 } from '../src/config/packageAccess';
+import { ACCESS_POLICIES, getAccessPolicyTeams } from '../src/config/accessPolicies';
 
 let passed = 0;
 let failed = 0;
@@ -172,6 +173,49 @@ test('PyPI project names are unique', () => {
   return names.length === new Set(names).size;
 });
 
+// Test Cloudflare Access policy config
+test('SECURITY_TEAM role exists (GitHub-only, no parent team)', () => {
+  const role = roleLookup.get(ROLE_IDS.SECURITY_TEAM);
+  return (
+    role !== undefined &&
+    role.github?.team === 'security-team' &&
+    role.github.parent === undefined &&
+    role.discord === undefined &&
+    role.google === undefined &&
+    !role.provisionUser
+  );
+});
+test('ACCESS_POLICIES is not empty with unique ids', () => {
+  const ids = ACCESS_POLICIES.map((p) => p.id);
+  return ids.length > 0 && ids.length === new Set(ids).size;
+});
+test('All access policy roles exist and have GitHub teams', () =>
+  ACCESS_POLICIES.every((p) => p.roles.every((id) => !!roleLookup.get(id)?.github?.team)));
+test('Access policy roles are unique within each policy', () =>
+  ACCESS_POLICIES.every((p) => p.roles.length === new Set(p.roles).size));
+test('security-room policy renders the expected include-rule teams in order', () => {
+  const policy = ACCESS_POLICIES.find((p) => p.id === 'security-room-maintainers');
+  if (!policy) return false;
+  const teams = getAccessPolicyTeams(policy);
+  const expected = ['core-maintainers', 'lead-maintainers', 'security-managers', 'security-team'];
+  return teams.length === expected.length && teams.every((t, i) => t === expected[i]);
+});
+test('security-team team has members', () =>
+  MEMBERS.some((m) => m.github && m.memberOf.includes(ROLE_IDS.SECURITY_TEAM)));
+test('getAccessPolicyTeams throws for a role without a GitHub team', () => {
+  try {
+    getAccessPolicyTeams({
+      id: 'bogus',
+      description: '',
+      cloudflarePolicyName: 'x',
+      roles: [ROLE_IDS.ADMINISTRATORS],
+    });
+    return false;
+  } catch {
+    return true;
+  }
+});
+
 // Summary
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

scripts/validate-config.ts

@@ -14,6 +14,7 @@ import {
   UNMAPPED_PYPI_USERS,
 } from '../src/config/packageAccess';
 import { MEMBERS } from '../src/config/users';
+import { ACCESS_POLICIES } from '../src/config/accessPolicies';
 import { hasProvisionUserRole, resolveGoogleMemberEmail } from '../src/config/utils';
 import type { RoleId } from '../src/config/roleIds';
 
@@ -304,6 +305,47 @@ console.log('Validating package registry references in packageAccess.ts...');
   }
 }
 
+// Validate Cloudflare Access policies in accessPolicies.ts
+console.log('Validating Cloudflare Access policies in accessPolicies.ts...');
+{
+  const policyIds = new Set<string>();
+  for (const policy of ACCESS_POLICIES) {
+    if (policyIds.has(policy.id)) {
+      console.error(`ERROR: Access policy "${policy.id}" is declared twice in accessPolicies.ts`);
+      hasErrors = true;
+    }
+    policyIds.add(policy.id);
+
+    if (policy.roles.length === 0) {
+      console.error(`ERROR: Access policy "${policy.id}" has no roles; nobody could sign in`);
+      hasErrors = true;
+    }
+
+    const seenRoles = new Set<RoleId>();
+    for (const roleId of policy.roles) {
+      if (seenRoles.has(roleId)) {
+        console.error(`ERROR: Access policy "${policy.id}" lists role "${roleId}" more than once`);
+        hasErrors = true;
+      }
+      seenRoles.add(roleId);
+
+      const role = roleLookup.get(roleId);
+      if (!role) {
+        console.error(
+          `ERROR: Access policy "${policy.id}" references role "${roleId}" which does not exist in roles.ts`
+        );
+        hasErrors = true;
+      } else if (!role.github) {
+        // Cloudflare Access matches GitHub teams, so a role without one cannot be granted
+        console.error(
+          `ERROR: Access policy "${policy.id}" references role "${roleId}" which has no GitHub team`
+        );
+        hasErrors = true;
+      }
+    }
+  }
+}
+
 // Validate parent role references in roles.ts
 console.log('Validating parent role references in roles.ts...');
 for (const role of ROLES) {

src/cloudflare.ts

@@ -0,0 +1,73 @@
+import * as pulumi from '@pulumi/pulumi';
+import * as cloudflare from '@pulumi/cloudflare';
+import { ACCESS_POLICIES, GITHUB_ORG, getAccessPolicyTeams } from './config/accessPolicies';
+
+const config = new pulumi.Config('cloudflare');
+// Cloudflare integration is optional - only enabled if roleManagementToken is configured,
+// so previews stay green before the CLOUDFLARE_ROLE_MANAGEMENT_TOKEN secret exists.
+// The token is scoped to Access policy role management only (Account > Access: Apps and
+// Policies > Edit); it is not a general-purpose Cloudflare API token.
+const CLOUDFLARE_ROLE_MANAGEMENT_TOKEN = config.getSecret('roleManagementToken');
+const CLOUDFLARE_ENABLED = CLOUDFLARE_ROLE_MANAGEMENT_TOKEN !== undefined;
+
+if (!CLOUDFLARE_ENABLED) {
+  pulumi.log.info('Cloudflare integration disabled: roleManagementToken not configured');
+}
+
+// Access policies keyed by policy id (accessPolicies.ts)
+const accessPolicies: Record<string, cloudflare.ZeroTrustAccessPolicy> = {};
+
+if (CLOUDFLARE_ENABLED) {
+  const accountId = config.require('accountId');
+  const githubIdentityProviderId = config.require('githubIdentityProviderId');
+  // Pulumi's `import` option requires the program's inputs to match the live
+  // resource, so adopting an existing policy is a two-step process:
+  //   1. importExistingPolicies=true: adopt the policy as-is (rule fields ignored)
+  //   2. importExistingPolicies=false (or unset): manage the rules from config
+  // See README "Cloudflare Access (security-room)".
+  const importExisting = config.getBoolean('importExistingPolicies') ?? false;
+
+  const provider = new cloudflare.Provider('cloudflare', {
+    // Provider argument name; the value is the role-management token above.
+    apiToken: CLOUDFLARE_ROLE_MANAGEMENT_TOKEN,
+  });
+
+  ACCESS_POLICIES.forEach((policy) => {
+    const teams = getAccessPolicyTeams(policy);
+    const importId =
+      importExisting && policy.cloudflarePolicyId
+        ? `${accountId}/${policy.cloudflarePolicyId}`
+        : undefined;
+
+    accessPolicies[policy.id] = new cloudflare.ZeroTrustAccessPolicy(
+      `access-policy-${policy.id}`,
+      {
+        accountId,
+        name: policy.cloudflarePolicyName,
+        decision: 'allow',
+        includes: teams.map((team) => ({
+          githubOrganization: {
+            identityProviderId: githubIdentityProviderId,
+            name: GITHUB_ORG,
+            team,
+          },
+        })),
+      },
+      {
+        provider,
+        import: importId,
+        // connectionRules and sessionDuration are set by the Cloudflare API with
+        // defaults we do not model. During import, also keep the live rule lists so
+        // the adoption succeeds; the next deploy without the flag applies the config.
+        ignoreChanges: importId
+          ? ['connectionRules', 'sessionDuration', 'includes', 'excludes', 'requires']
+          : ['connectionRules', 'sessionDuration'],
+      }
+    );
+  });
+}
+
+export const cloudflareAccessPolicyIds = Object.fromEntries(
+  Object.entries(accessPolicies).map(([id, policy]) => [id, policy.id])
+);
+export { accessPolicies as cloudflareAccessPolicies };