Cloudflare Workers

Your site is on Cloudflare. Put your agent surface on your own domain.

A small Cloudflare Worker relays your agent paths to Inception Agents and sends every other request to your site untouched. If we are ever slow, your pages are unaffected.

See the install Book a demo

What the Worker does

Your agent paths, relayed. Your pages, untouched.

The Worker signs each agent request with your install’s relay key and tells us the visitor’s address, Origin and User-Agent, so each visitor is counted and rate-limited as themselves rather than as your Worker. It sends us no cookies, no page content and no Authorization header.

If Inception Agents does not answer within 8 seconds, agent paths get a 502 and your pages are unaffected: they never depend on us.

Request flow

Option	Description
/mcp · /.well-known/mcp.json	Relayed to Inception Agents, signed with your install’s relay key
/agent/* · /llms.txt · agent files	Relayed and signed; never cached
/.well-known/inception-verify	Answered by the Worker itself: the proof the install is yours
Every other request	Sent to your site untouched; HTML pages get the page script once

Five steps, each one checked.

Your developer or agency can take your site live by asking Claude or their coding agent, following the same step-by-step playbook we use. It gives them the template, its checksum and the exact steps for your host.

Deploy with one route

A scoped API token (Workers Admin, plus Workers Routes Write and Zone Read for this zone only) deploys the Worker with just the proof route.

Connect once

A one-time install code, good for an hour, is exchanged for the relay key, which goes straight into the Worker’s secrets. Nothing prints it.

Prove the install

We fetch the proof path with a fresh challenge and the Worker answers it. No DNS record to add, no file to upload.

Add the routes

Route the agent paths, and the pages you want the page script on. Static assets stay off the routes.

Let agents through

If bot protection is on, a skip rule for exactly the relayed paths lets agents reach /mcp, and nothing else loses its protection.

The Worker’s settings

Until the install is proven, the Worker has one route: the proof path. The relay key and its secret never go in this file; the connect step puts them straight into the Worker’s secrets.

wrangler.toml

name = "inception-agents-relay"
main = "src/index.ts"
workers_dev = false

# One route until the install is proven
routes = [
  { pattern = "example.com/.well-known/inception-verify", zone_name = "example.com" },
]

[vars]
IA_HOST = "example.com"        # your host, exactly
IA_TENANT_ID = "your-tenant-id"
# IA_EDGE_BASE and IA_API_BASE come from the connect answer

The skip rule

On Pro and above, a WAF custom rule with the Skip action (Super Bot Fight Mode and the managed rules) for exactly the relayed paths. Nothing else on your site loses its protection. Leave Cloudflare’s own switch (AI → Agent Readiness → WebMCP) off: the Worker is the install.

WAF custom rule

http.host eq "example.com" and (
  http.request.uri.path in {"/mcp" "/agent" "/llms.txt" "/llms-full.txt" "/.well-known/mcp.json" "/.well-known/agent.json" "/.well-known/agent-capabilities.json" "/.well-known/inception-verify"}
  or starts_with(http.request.uri.path, "/agent/")
)

Then, going live

Nothing counts as done because a setting was saved.

After the install, every go-live step is proven by a check from outside your site.

Agents can reach it

We check your site from the outside, the way an AI agent sees it: your tools listed with a standard client, your briefing, and the page script there once, for your account.

A test lead reaches you

We send a test lead through your real site the way a buyer’s agent would. It arrives marked TEST, with what their agent asked first and a link to replay the conversation.

Checked every hour

Once you’re live, we check your site every hour and email your team if agents stop being able to reach it.

Troubleshooting

Common issues and fixes.

The install code is refused

A code works once, for an hour, for one exact host: www.example.com and example.com are different hosts. A used, expired or mismatched code gets the same answer. Ask for a new one.

Agents are challenged

Bot protection runs before Workers. On Pro and above, add the skip rule. On Free, Bot Fight Mode cannot be skipped: turn it off, or accept that some agents are blocked.

The proof fails

Check that the Worker has its key from the connect step, and that bot protection is not challenging the proof path. The skip rule covers it too.

Your domain. Your pages. Their agent gets through.

The Worker is built and available. Book a demo and we’ll walk your team through the install for your site.

Book a demo View All Integrations →