Dashboard data operations via Next.js server actions with direct database access.

Admin API

RouterMCP dashboard CRUD is implemented as Next.js server actions in apps/next-app/src/lib/actions/, not as Worker REST endpoints. Actions require a WorkOS AuthKit session and enforce team membership before reading or writing the shared Postgres database.

Architecture

Browser → Next.js Server Action → Drizzle ORM → Neon Postgres
MCP clients → Cloudflare Worker → upstream MCP servers

The Worker handles MCP protocol traffic only (/v1/mcp/*, /health). Project, server, tool, and key management live in next-app.

Authentication

All server actions call withAuth() from @workos-inc/authkit-nextjs. Unauthenticated requests throw "Unauthorized". Team-scoped operations additionally verify membership via repo.isUserTeamMemberByEmail.

Server action modules

Module	File	Purpose
Teams	`teams.ts`	Team CRUD and membership
Projects	`projects.ts`	Project CRUD, settings, feature flags
Servers	`servers/`	MCP server CRUD, auth detection, tool sync
Tools	`tools.ts`	Enable/disable discovered tools
Keys	`keys.ts`	Project API key creation and revocation
OAuth	`oauth.ts`	Upstream OAuth device and authorization flows
Connectors	`connectors/`	Registry connector install flows
Activity	`activity.ts`	Audit log reads
Stats	`stats.ts`	Project usage summaries

Import from @/lib/actions in dashboard components and route handlers.

Projects

projects.ts exports functions such as:

getProjectsForTeam(teamSlug) — list projects with server/tool counts
createProject(teamSlug, input) — create a project under a team
updateProject(projectId, input) — update name, auth mode, meta-tool flags, response limits
deleteProject(projectId) — cascade delete project resources

Project settings include authMode (none | api_key | oauth), maxToolResponseLength, toolResponseTruncationMode, and meta-tool toggles (enableSearchTool, enableExecuteTool, enableCodeMode).

Servers and tools

servers/ handles upstream MCP server lifecycle:

Create/update/delete servers with alias, base URL, transport, and auth configuration
Bearer tokens and OAuth secrets are encrypted with KMS_KEY before storage
Tool discovery syncs upstream tools/list into the mcpTools table

tools.ts toggles individual tools on or off per server.

API keys

keys.ts creates project-scoped MCP client keys. Keys are hashed at rest; the plaintext value is shown once at creation.

OAuth routes (HTTP)

Upstream OAuth still uses Next.js route handlers alongside server actions:

Route	Purpose
`GET /api/oauth/callback`	Authorization code exchange for upstream servers
`GET /api/oauth/authorize`	OAuth authorization entry point

Server-side OAuth token storage and refresh logic lives in oauth.ts and projectOauth.ts.

Worker health check

The Worker exposes a simple health endpoint independent of dashboard CRUD:

GET /health → { "ok": true }

Local development: http://localhost:7995/health

MCP Protocol API — Worker JSON-RPC endpoints
Authentication — WorkOS AuthKit setup
Internal engineering guide: docs-internal/authentication.md

Admin API Reference - Projects, Servers & Keys