web3ctx — serving path

web3ctx — serving path An architecture diagram generated by Archify. Coding agent · Claude Code · Cursor · Architecture component Coding agent Claude Code · Cursor /mcp · free · no key · Cloudflare — serverless, no origin box /mcp free · no key /mcp/oauth · GitHub OAuth 2.1 · Cloudflare — serverless, no origin box /mcp/oauth GitHub OAuth 2.1 GitHub · identity only · Architecture component GitHub identity only Worker · five read-only tools · Cloudflare — serverless, no origin box · Cloudflare Worker five read-only tools Rate limiter · Durable Object · Cloudflare — serverless, no origin box Rate limiter Durable Object Layer 0 · entity → version → predicate · Cloudflare — serverless, no origin box Layer 0 entity → version → predicate Retrieval · deps closure → BM25 · Cloudflare — serverless, no origin box Retrieval deps closure → BM25 Core D1 · versions · recipes · Cloudflare — serverless, no origin box Core D1 versions · recipes Lexical D1 · FTS5 · disposable · Cloudflare — serverless, no origin box Lexical D1 FTS5 · disposable R2 bodies · content-addressed · Cloudflare — serverless, no origin box R2 bodies content-addressed KV cache · keyed by deploy id · Cloudflare — serverless, no origin box KV cache keyed by deploy id Streamable HTTP bearer token grant · token never stored same handler higher budget only typed in-band refusal scope first SQL predicate deps closure BM25 in candidates bodies · cursor paging L0 cache Cloudflare — serverless, no origin box Legend Backend Database Cloud Security External

Scope before search

  • • Layer 0 binds project and version, then applies a SQL predicate before any ranking
  • • No scoping evidence means a labelled abstention, never a ranked guess
  • • Version disagreements are stated in the payload, not filtered away

One handler, two tiers

  • • /mcp is authless and free forever; a token on it is refused, never silently honored
  • • /mcp/oauth raises rate limits only — payloads are identical
  • • Refusals are typed and in-band, naming the window that blocked

Version-true by construction

  • • Every unit is labelled project@version with a source pinned to commit or registry path
  • • Recipes are human-validated and carry on-chain receipt hashes
  • • The lexical index is disposable; rebuild-from-R2 is the recovery path