MCP and docs production runbook

Owner: GRIFFai platform operations. Canonical MCP endpoint: https://mcp.griff.run/mcp. Documentation: https://docs.griff.run.

Release

1. In griffai-saas-mcp, run npm test, npm run type-check, and npm run deploy:dry-run.
2. Upload a Worker version, record its version ID and the currently deployed rollback version, then canary it before promotion.
3. Verify health, OAuth discovery, unauthenticated MCP rejection, invalid-scope rejection, invalid-client rejection, and revocation.
4. In griffai-wiki, run npm run test:release, npm audit --omit=dev, npm run typecheck, npm run build, and npm run deploy:dry-run. Production-runtime audit findings block deployment.
5. Deploy and verify the homepage, MCP guide, client setup, manifest, llms.txt, llms-full.txt, and sitemap.

Never place tenant keys, bearer tokens, signing secrets, or admin credentials in logs or receipts.

The connect.griff.run validation-only issuer expires automatically at 2026-11-09T00:00:00Z. Verify /health reports the configured sunset and inactive state after the deadline, then remove the alias route in the next normal release.

Rollback

For MCP, redeploy the recorded prior Cloudflare Worker version and confirm /health reports its prior build ID. For docs, redeploy the recorded prior docs version; on a first release, detach the custom domain or deploy the last known-good artifact. Re-run the public probe matrix after rollback.

Incident triage

Fail closed on authentication ambiguity. Preserve Cloudflare request IDs, UTC timestamps, Worker version IDs, HTTP status codes, and redacted response shapes. Escalate suspected credential exposure immediately and rotate through the secret-management path; do not copy secrets into tickets.