Cloud Tasks

A task backend for coding agents. Deploys to your Cloudflare account in one prompt.

Paste this into opencode, Claude Code, or Codex — your agent installs it for you.

Already deployed? Connect your agent in one line →

agent prompt 
Install and deploy the open-source "Cloud Tasks" project into my own Cloudflare account, then tell me how to connect this agent to it. Do every step for me and pause only when you need my input (for example, to approve a login).

1. Clone the repo and work inside it:
   git clone https://github.com/onurkerem/cloud-tasks.git
   The Worker source lives in packages/worker/ — run every command from there.

2. Run: npm install

3. Authenticate Wrangler. Run: npx wrangler login
   Tell me to complete the browser approval. If I can't use a browser, ask me for a CLOUDFLARE_API_TOKEN instead.

4. Create the D1 database and write its id into wrangler.jsonc:
   npm run deploy:prepare

5. Apply the schema to the remote database:
   npm run db:migrate:remote

6. Generate a strong API key (32 random hex bytes) and store it as a Worker secret for REST API use:
   npx wrangler secret put API_KEY
   Enter the generated value and remember it.

7. Configure Cloudflare Access for the MCP endpoint. Create a Self-hosted Access application for <worker-url>/mcp, then store:
   npx wrangler secret put CF_ACCESS_TEAM_DOMAIN
   npx wrangler secret put CF_ACCESS_POLICY_AUD
   If I do not have the Access application yet, pause and tell me the exact dashboard steps.

8. Deploy the Worker:
   npm run deploy

9. Capture the deployed URL (https://cloud-tasks.<my-subdomain>.workers.dev, or your custom domain if you added one) and run the REST production smoke test:
   WORKER_URL=<that url> API_KEY=<the key> npm run smoke:prod
   If anything fails, read the error, fix it, and retry.

10. Do NOT modify this agent's own config. When done, report back:
    - the Worker URL,
    - the API_KEY value,
    - the REST API index (<url>/api),
    - the OAuth MCP endpoint (<url>/mcp), protected by Cloudflare Access,
    - the API-key MCP endpoint (<url>/api/mcp), authenticated with the API_KEY secret (no OAuth — ideal for persistent local MCP clients).

Built for agents, ready in minutes

database

D1-backed task store

Every task is a durable record in Cloudflare D1 — description, tags, assignee, and status (todo / in_progress / done) — indexed for fast filtered queries.

hub

Two APIs, one backend

A REST CRUD API at /api/tasks and a Model Context Protocol endpoint — /mcp (Cloudflare Access) or /api/mcp (API key) — that exposes the same data as agent tools.

shield

Secure by default, free to run

REST and /api/mcp are gated by an API key (Authorization: Bearer or x-api-key); the /mcp endpoint is protected by Cloudflare Access. Runs entirely on Cloudflare's free-tier Workers + D1.

How it works

Your coding agent talks to a single MCP endpoint. The Worker turns each tool call into a D1 query and returns the result.

smart_toy

Your agent

opencode · Claude Code · Codex

arrow_downward
cloud

Cloud Tasks Worker

POST /mcp · Cloudflare Access

arrow_downward
database

Cloudflare D1

Persistent task records

MCP tools exposed at /mcp

create_task list_tasks get_task update_task delete_task claim_next_task

Usage

Talk to Cloud Tasks however you like — raw REST for scripts and dashboards, or the MCP endpoint for agents. REST and /api/mcp use your API key; /mcp uses Cloudflare Access and Managed OAuth.

check_circle

Create tasks with tags and an assignee; filter by status, assignee, tag, or free text.

check_circle

Atomically claim the oldest todo task — perfect for multi-agent work queues.

check_circle

Point any MCP-compatible agent at /mcp and it gets six task tools out of the box.

REST
# Create a task
curl -X POST https://tasks.keremorenli.com/api/tasks
-H "Authorization: Bearer $API_KEY" -H "content-type: application/json"
-d '{"description":"Ship the API","tags":["backend"]}'
# Filter the backlog
curl -H "Authorization: Bearer $API_KEY"
"https://tasks.keremorenli.com/api/tasks?status=todo&tag=backend"
# Claim the next task (atomic)
curl -X POST https://tasks.keremorenli.com/api/tasks/claim
-d '{"assignee":"agent-b","tags":["backend"]}'
MCP
# OAuth MCP (Cloudflare Access)
# Connect OAuth-capable MCP clients to
https://tasks.keremorenli.com/mcp
# API-key MCP — no OAuth, no session expiry
# Point persistent local clients (Codex, Claude Code) at
https://tasks.keremorenli.com/api/mcp · "Authorization: Bearer $API_KEY"

Already deployed?

Connect your agent in one line

Hosted MCP uses Cloudflare Access. The legacy installer remains for older API-key MCP deployments and backs up every file before it touches a thing.

  • check_circle For legacy API-key MCP deployments only; hosted MCP uses Cloudflare Access
  • check_circle Pick any of: opencode, Claude Code, Codex, Antigravity
  • check_circle Merges only the cloud-tasks entry — your other config stays untouched
  • check_circle Backs up each file first; sets 600 perms on any file holding your key
  • check_circle Optional connectivity test against your endpoint before writing
  • check_circle Works on macOS and Linux; needs bash + python3

Supported agents

opencode Claude Code Codex Antigravity
one-line install 
curl -fsSL https://raw.githubusercontent.com/onurkerem/cloud-tasks/main/packages/website/public/install.sh | bash

Works on macOS and Linux. Requires bash + python3. Review it first on GitHub.

Prefer the manual path?

Clone the repo and run the deploy script — wrangler.jsonc already ships with a placeholder D1 id. Everything lives in packages/worker/.

packages/worker/wrangler.jsonc 

{
  "name": "cloud-tasks",
  "main": "src/index.ts",
  "compatibility_date": "2026-06-18",
  "compatibility_flags": ["nodejs_compat"],
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "cloud-tasks",
      "database_id": "00000000-0000-0000-0000-000000000000",
      "migrations_dir": "migrations"
    }
  ]
}

packages/worker/.dev.vars 

API_KEY=replace-with-a-long-random-secret
CF_ACCESS_TEAM_DOMAIN=https://your-team.cloudflareaccess.com
CF_ACCESS_POLICY_AUD=your-access-aud-tag

key Set the production secret with wrangler secret put API_KEY. 

npx wrangler login
npm run deploy:prepare
npm run db:migrate:remote
npx wrangler secret put API_KEY
npx wrangler secret put CF_ACCESS_TEAM_DOMAIN
npx wrangler secret put CF_ACCESS_POLICY_AUD
npm run deploy

Need an API token or your account ID? Grab them from the Cloudflare dashboard open_in_new.