> product // mcp-servers // the making of
MCP Servers
how it was made.
One monorepo. 510 commits. 78 servers, all running on Cloudflare Workers with shared OAuth, shared core, and one deployment pattern. It started as a framework experiment in the first week of January 2026 and never stopped growing, because every business system we connect to teaches the platform something the next server gets for free.
The short version
The mcp-packages monorepo opened on 5 January 2026 with a Google Workspace integration and a pnpm workspace scaffold. Three days later the entire Google layer was deleted and restarted, 'Remove Google MCP servers (starting fresh)', which set the tone. Every server since has been built on the same pattern: gateway tools instead of one-tool-per-action, a shared OAuth provider, a shared UI package, and a single deployment command. The platform grew outward from there: Xero, Rocket.net, Synergy Wholesale, Gmail, Drive, GitHub, Cloudflare infrastructure, Bing Webmaster Tools, DataForSEO, Google Analytics, RobotAlp, Jim2, and a dozen others, each one wiring a real business system to any MCP-aware AI assistant.
The unglamorous truth is that roughly a quarter of the commits are fixes: timeout protection, unbounded paginators that trapped an agent for eight hours, PII stripped from logs, pagination bugs, and a run of security findings in June 2026 (SSRF, IDOR, stored XSS) closed before any reached production. The rest is steady accretion, new servers, new actions, shared tooling lifted into mcp-core so every server that came after got it automatically. That is the honest story: a lot of steady, unglamorous work, and a fleet that is genuinely useful because of it.
// the build log · mined from the commit history, nothing dramatised
Start over, get the foundation right
The monorepo opened 5 January with Google Workspace integrations and a shared mcp-core package. Three days later, the entire Google layer was deleted and rebuilt from scratch. That single 'starting fresh' commit bought the pattern that every subsequent server inherited: gateway tools, shared OAuth, shared UI. By the end of the month there were servers for Australian Business, Weather, GitHub, Rocket.net, Synergy Wholesale, Xero, Gmail, Chat, Calendar, Drive, Docs, Sheets, Slides, and Tasks, plus the first email-router servers for individual clients.
Collapsing tool sprawl into something maintainable
Xero launched with 65 individual tools and was immediately consolidated into 18 action-based ones. Synergy's 79 tools became 8. GitHub's 22 became 3. SMTP2Go's 51 became 9. The gateway tool pattern, one tool, an action parameter, actions listed in the description, was adopted fleet-wide through February. At the same time, shared infrastructure matured: a token index with session persistence, a shared admin dashboard, MCP tool annotations, and 21 resources added across the Google Workspace servers.
The fleet grows and learns about safety
The Cloudflare infrastructure server shipped in late February: Workers, DNS, KV, D1, R2, WAF, analytics, SSL, and more, all through one gateway. The Brain server arrived as an internal knowledge graph. PageDrop and SiteDrop gave agents a way to publish files and multi-page sites to shareable URLs. Meanwhile, PII was stripped from several server logs after a review found contact data leaking through responses. A shared timingSafeEqual function was rolled out across 32 servers to harden token comparison.
Turning the lights on across 66 workers
Workers Observability was enabled fleet-wide in one commit: 66 server configs touched at once. Multi-account support landed for all 10 Google Workspace servers so a single deployment could serve multiple Google identities. New servers added: Bing Webmaster Tools, Google Analytics, Mailchimp, Google Local (Places, geocoding, routes, weather, air quality), RobotAlp monitoring, DataForSEO, and SimPRO. The fleet AI was upgraded to Nemotron 120B. The custom domain limit on jezweb.ai was hit, prompting a migration to mcpserver.au domains across 35 servers.
An agent trapped for eight hours teaches the fleet a lesson
A Synergy Wholesale paginator with no upper bound trapped an agent in a loop for eight hours before being noticed. The fix was a sweep: nine unbounded paginators bounded fleet-wide in one commit. The goanna-mcp server arrived, the fleet's own AI asking to talk to the fleet, and went through 16 rounds of security review before its role resolution was hardened ('resolveRole fails closed, was fail-open to builder'). Jim2, Stripe, ServiceM8, and Twilio servers were built out from scaffolds. Five redundant scaffolded servers were trimmed.
Agents that can receive files, and a fleet hardened before launch
A fleet-wide audit found that read-back, agents sending files, not just reading them, was the gap. A week of work added general-purpose attachment upload to Gmail, Chat, and Drive; drop zones to PageDrop; binary file upload to Drive; and image attach to Rezdy. A tsc scan revealed fleet-wide backtick corruption that had been lurking quietly. Security findings were closed before any reached production: SSRF in Drive and Docs, upload-ticket IDOR in Gmail and Chat, stored XSS in the drop-zone file server. Twelve unused email-router workers were retired and archived.
git log: “fix(synergy-wholesale): bound paginating loops, agent trapped 8hrs”
The commit that prompted a fleet-wide sweep of nine unbounded paginators: a real failure that taught the platform a durable lesson.
// the roads not taken
Tried, measured, set aside: the judgement lives here as much as in what shipped.
The original Google Workspace layer, day 3
'Remove Google MCP servers (starting fresh)', three days in, the first substantial integration was deleted and rebuilt to get the shared OAuth pattern right before it spread to every subsequent server.
65 individual Xero tools → 18 action-based
The first Xero server launched with one TypeScript function per operation. Within a week it was consolidated into gateway tools: the refactor that proved the pattern and triggered the same treatment across Synergy, GitHub, and SMTP2Go.
Five scaffolded servers that never earned their keep
May 2026: 'trim 5 redundant scaffolded MCP servers', placeholders that had been built but never filled out were removed rather than left to accumulate.
Twelve email-router workers retired
June 2026: twelve per-client email-router workers that had served their purpose were retired and their source archived. The fleet catalogue was regenerated to reflect the honest current count.
Want something built like this?
This is how we work: in the open, measured, honest about the dead ends.