---title: Self Hosted Cloudflaredescription: "Run Executor as a single Cloudflare Worker in your own account, with Cloudflare Access for auth and D1 for storage."--- Executor runs as a single Cloudflare Worker. Authentication is handled entirely by[Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/policies/access/)(there is no separate app login), storage is [D1](https://developers.cloudflare.com/d1/),tool code runs in QuickJS inside the Worker, and the web console, API, and MCPendpoint are all served from that one Worker. It is single-tenant: every Access-verified user belongs to the one configured org,and you manage members and credentials in Cloudflare Access rather than in the app. ## Prerequisites - A Cloudflare account with Workers and Zero Trust (Access) enabled.- The [Executor repo](https://github.com/RhysSullivan/executor) checked out, with  dependencies installed (`bun install`). ## Deploy From `apps/host-cloudflare`: ```bashbunx wrangler loginbun run deploy:setup``` `deploy:setup` is idempotent: it creates or reuses the `executor` D1 database,writes its id into `wrangler.jsonc`, generates and uploads the `EXECUTOR_SECRET_KEY`secret, and deploys the Worker. It then prints the one remaining manual step. ## Put it behind Cloudflare Access Until the Worker is behind an Access application, every API and MCP route returns`401`. In the Zero Trust dashboard: 1. Go to **Access → Applications → Add an application → Self-hosted**.2. Set the application domain to `executor-cloudflare.<your-subdomain>.workers.dev`.3. Add an Access policy (for example, emails ending in `@yourcompany.com`).4. Copy the application **Audience (AUD)** tag, then redeploy with your Access settings:    ```bash   bunx wrangler deploy \     --var ACCESS_AUD:<aud> \     --var ACCESS_TEAM_DOMAIN:<your-team>.cloudflareaccess.com   ```    You can also set `ACCESS_AUD` and `ACCESS_TEAM_DOMAIN` in `wrangler.jsonc` and   redeploy. Now visiting the Worker prompts a Cloudflare Access login, and the Worker validatesthe issued JWT on every request. ## Connect an agent The Worker serves a streamable-HTTP MCP endpoint at `/mcp`, gated by Access like therest of the surfaces. Point your client at`https://executor-cloudflare.<your-subdomain>.workers.dev/mcp`; it authenticatesthrough Cloudflare Access. See [MCP Proxy](/mcp-proxy) for how the endpoint exposesyour integrations.