Add deployable Computer MCP example - #28

Computer already provides durable filesystem and command tools, but the repository did not show how to expose them through a remote MCP server. This adds examples/mcp, a deployable single-user example built with @cloudflare/codemode.

MCP clients see one public code tool. Code Mode turns the internal Computer tools into codemode.read, codemode.ls, codemode.write, codemode.edit, and codemode.exec functions that the model can combine in one call. The workspace belongs to one durable object, so files persist between MCP requests.

worker-shell is the fast default and has no ambient outbound network access, though its built-in Git command supports HTTPS remotes. A model can select container-shell when it needs Debian, Node.js, npm, native binaries, or package downloads. The container starts on demand, and Computer synchronizes /workspace through its FUSE mount. Code Mode itself runs in an isolated Dynamic Worker without outbound network access.

For example, the model can use the public code tool to run:

async () => {
  await codemode.write({
    path: "/workspace/message.txt",
    content: "hello from Code Mode",
  });

  const file = await codemode.read({ path: "/workspace/message.txt" });
  const shell = await codemode.exec({
    command: "node --version",
    backend: "container-shell",
  });

  return { content: file.content, node: shell.stdout.trim() };
}

The MCP endpoint requires a bearer token and fails closed until MCP_TOKEN is configured. To deploy from a clone and set the secret:

npm install
npm run deploy --workspace @example/computer-mcp
openssl rand -hex 32
npx wrangler secret put MCP_TOKEN --config examples/mcp/wrangler.jsonc

Clients connect to https://<worker>.workers.dev/mcp over Streamable HTTP and send Authorization: Bearer <MCP_TOKEN>. The README also covers the Deploy to Cloudflare button, client configuration, backend selection, local development, debugging, and the single-user security model.

The workerd integration test connects a real MCP client, verifies authentication and the one-tool interface, exercises filesystem and Worker-shell operations, checks persistence, and confirms that Code Mode cannot reach the network directly. Type checking, repository checks, and the Wrangler deployment dry-run also pass.