Deployment Topology
Run the gateway on Cloudflare Workers and host the frontend on Vercel. Configure CORS and site URLs so the public app, authenticated app shell, and MCP clients all target the same production gateway.
Required Environment Variables
Validate encryption keys, Supabase JWT verification settings, OAuth secrets, and public app environment variables before rollout. Keep production secrets in platform-managed secret stores only.
Post-Deploy Verification
Confirm login flow, integration connect/update/remove, MCP initialize, tools/list visibility, and strict OBOtools/call execution with a project-scoped cxexec_* token. Record release checks and auth-path transcripts in your deployment runbook.