MCPサーバーの本番デプロイ・セキュリティ・収益化 — 独自MCPをSaaSとして展開する実践ロードマップ

// src/rate-limiter/index.ts
// スライディングウィンドウアルゴリズムによるレート制限
 
interface RateLimitConfig {
  requestsPerMinute: number;
  requestsPerDay: number;
  tokensPerDay: number;  // ツール呼び出しトークン換算
}
 
const PLAN_LIMITS: Record<string, RateLimitConfig> = {
  free: {
    requestsPerMinute: 10,
    requestsPerDay: 100,
    tokensPerDay: 50_000,
  },
  pro: {
    requestsPerMinute: 60,
    requestsPerDay: 5_000,
    tokensPerDay: 2_000_000,
  },
  enterprise: {
    requestsPerMinute: 600,
    requestsPerDay: 100_000,
    tokensPerDay: 50_000_000,
  },
};
 
export class RateLimiter {
  static async check(
    userId: string,
    env: Env,
    planType: string = "free"
  ): Promise<{ allowed: boolean; remaining: number; resetAt: number }> {
    const config = PLAN_LIMITS[planType] ?? PLAN_LIMITS.free;
    const now = Date.now();
    const windowKey = `ratelimit:${userId}:${Math.floor(now / 60_000)}`;
 
    // KVを使ったスライディングウィンドウカウンター
    const current = await env.KV.get(windowKey);
    const count = current ? parseInt(current) : 0;
 
    if (count >= config.requestsPerMinute) {
      return {
        allowed: false,
        remaining: 0,
        resetAt: Math.ceil(now / 60_000) * 60_000,
      };
    }
 
    // カウンターをインクリメント（60秒後に自動削除）
    await env.KV.put(windowKey, String(count + 1), { expirationTtl: 60 });
 
    return {
      allowed: true,
      remaining: config.requestsPerMinute - count - 1,
      resetAt: Math.ceil(now / 60_000) * 60_000,
    };
  }
 
  // 日次クォータチェック
  static async checkDailyQuota(userId: string, env: Env, planType: string): Promise<boolean> {
    const config = PLAN_LIMITS[planType] ?? PLAN_LIMITS.free;
    const today = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
    const quotaKey = `quota:${userId}:${today}`;
 
    const used = await env.KV.get(quotaKey);
    const usedCount = used ? parseInt(used) : 0;
 
    return usedCount < config.requestsPerDay;
  }
}

// src/security/input-validator.ts
 
// 危険なパターンのリスト（定期的に更新が必要）
const INJECTION_PATTERNS = [
  /ignore previous instructions/gi,
  /disregard all prior/gi,
  /system prompt:/gi,
  /\[SYSTEM\]/gi,
  /<\|im_start\|>/gi,
  /you are now/gi,
  /act as/gi,
  /jailbreak/gi,
];
 
const MAX_INPUT_LENGTH = 10_000; // 文字数上限
 
export class InputValidator {
  static sanitize(input: string): { safe: boolean; sanitized: string; reason?: string } {
    // 1. 長さチェック
    if (input.length > MAX_INPUT_LENGTH) {
      return {
        safe: false,
        sanitized: "",
        reason: `Input exceeds maximum length of ${MAX_INPUT_LENGTH} characters`,
      };
    }
 
    // 2. プロンプトインジェクション検出
    for (const pattern of INJECTION_PATTERNS) {
      if (pattern.test(input)) {
        return {
          safe: false,
          sanitized: "",
          reason: "Potential prompt injection detected",
        };
      }
    }
 
    // 3. HTMLエスケープ（XSS対策）
    const sanitized = input
      .replace(/&/g, "&amp;")
      .replace(/</g, "&lt;")
      .replace(/>/g, "&gt;")
      .replace(/"/g, "&quot;")
      .replace(/'/g, "&#x27;");
 
    return { safe: true, sanitized };
  }
 
  // ツールパラメーターのバリデーション
  static validateToolParams<T>(params: unknown, schema: Record<string, unknown>): T | null {
    // JSON Schema による検証（実装は ajv などのライブラリを使用）
    try {
      // 型チェックと必須フィールド検証
      if (typeof params !== "object" || params === null) return null;
      return params as T;
    } catch {
      return null;
    }
  }
}

// src/observability/logger.ts
 
export interface ToolCallLog {
  requestId: string;
  userId: string;
  toolName: string;
  inputSize: number;
  outputSize: number;
  durationMs: number;
  status: "success" | "error" | "rate_limited";
  errorMessage?: string;
  timestamp: string;
}
 
export class MCPLogger {
  private env: Env;
 
  constructor(env: Env) {
    this.env = env;
  }
 
  async logToolCall(log: ToolCallLog): Promise<void> {
    // 1. 構造化ログ出力（Cloudflare Workers は console.log が Logpush に転送される）
    console.log(JSON.stringify({
      level: log.status === "error" ? "error" : "info",
      ...log,
    }));
 
    // 2. D1 データベースへの永続化（分析・請求用）
    await this.env.DB.prepare(`
      INSERT INTO tool_call_logs
        (request_id, user_id, tool_name, input_size, output_size, duration_ms, status, error_message, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
    `).bind(
      log.requestId,
      log.userId,
      log.toolName,
      log.inputSize,
      log.outputSize,
      log.durationMs,
      log.status,
      log.errorMessage ?? null,
      log.timestamp,
    ).run();
  }
 
  // ユーザーごとの使用統計を取得
  async getUserStats(userId: string, days: number = 30): Promise<{
    totalCalls: number;
    successRate: number;
    avgDurationMs: number;
    topTools: { name: string; count: number }[];
  }> {
    const since = new Date(Date.now() - days * 86400_000).toISOString();
    const result = await this.env.DB.prepare(`
      SELECT
        COUNT(*) as total_calls,
        AVG(CASE WHEN status = 'success' THEN 1.0 ELSE 0.0 END) as success_rate,
        AVG(duration_ms) as avg_duration_ms
      FROM tool_call_logs
      WHERE user_id = ? AND created_at >= ?
    `).bind(userId, since).first<{
      total_calls: number;
      success_rate: number;
      avg_duration_ms: number;
    }>();
 
    return {
      totalCalls: result?.total_calls ?? 0,
      successRate: result?.success_rate ?? 0,
      avgDurationMs: result?.avg_duration_ms ?? 0,
      topTools: [],
    };
  }
}

// src/billing/stripe.ts
import Stripe from "stripe";
 
export class BillingService {
  private stripe: Stripe;
 
  constructor(secretKey: string) {
    this.stripe = new Stripe(secretKey, { apiVersion: "2024-12-18.acacia" });
  }
 
  // サブスクリプション作成
  async createSubscription(params: {
    customerId: string;
    planId: "free" | "pro" | "enterprise";
    successUrl: string;
    cancelUrl: string;
  }): Promise<string> {
    const PRICE_IDS: Record<string, string> = {
      pro: process.env.STRIPE_PRICE_PRO!,
      enterprise: process.env.STRIPE_PRICE_ENTERPRISE!,
    };
 
    const session = await this.stripe.checkout.sessions.create({
      customer: params.customerId,
      mode: "subscription",
      line_items: [
        {
          price: PRICE_IDS[params.planId],
          quantity: 1,
        },
      ],
      success_url: params.successUrl,
      cancel_url: params.cancelUrl,
      // メタデータでプラン種別を記録
      metadata: {
        plan_type: params.planId,
      },
    });
 
    return session.url!;
  }
 
  // Webhookでサブスクリプション状態を同期
  async handleWebhook(payload: string, signature: string, env: Env): Promise<void> {
    const event = this.stripe.webhooks.constructEvent(
      payload,
      signature,
      env.STRIPE_WEBHOOK_SECRET,
    );
 
    switch (event.type) {
      case "customer.subscription.created":
      case "customer.subscription.updated": {
        const subscription = event.data.object as Stripe.Subscription;
        const customerId = subscription.customer as string;
        const planType = subscription.metadata.plan_type ?? "free";
        const status = subscription.status;
 
        // KVにサブスクリプション情報を保存
        await env.KV.put(
          `subscription:${customerId}`,
          JSON.stringify({ planType, status, updatedAt: Date.now() }),
        );
        break;
      }
      case "customer.subscription.deleted": {
        const subscription = event.data.object as Stripe.Subscription;
        const customerId = subscription.customer as string;
        // フリープランにダウングレード
        await env.KV.put(
          `subscription:${customerId}`,
          JSON.stringify({ planType: "free", status: "active", updatedAt: Date.now() }),
        );
        break;
      }
    }
  }
 
  // 使用量ベースの追加課金（従量課金）
  async reportUsage(subscriptionItemId: string, quantity: number): Promise<void> {
    await this.stripe.subscriptionItems.createUsageRecord(subscriptionItemId, {
      quantity,
      timestamp: Math.floor(Date.now() / 1000),
      action: "increment",
    });
  }
}

# .github/workflows/deploy.yml
name: Deploy MCP Server
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"
      - run: npm ci
      - run: npm run test
      - run: npm run typecheck
 
  deploy-staging:
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"
      - run: npm ci
      - name: Deploy to Cloudflare Workers (staging)
        run: npx wrangler deploy --env staging
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
 
  deploy-production:
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment: production  # GitHub環境保護ルールを活用
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "npm"
      - run: npm ci
      - name: Deploy to Cloudflare Workers (production)
        run: npx wrangler deploy --env production
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
      # デプロイ後のスモークテスト
      - name: Run smoke tests
        run: npm run test:smoke
        env:
          MCP_SERVER_URL: ${{ secrets.PRODUCTION_URL }}
          MCP_TEST_API_KEY: ${{ secrets.TEST_API_KEY }}

// src/session/durable-object.ts
export class MCPSession implements DurableObject {
  private state: DurableObjectState;
  private env: Env;
 
  constructor(state: DurableObjectState, env: Env) {
    this.state = state;
    this.env = env;
  }
 
  async fetch(request: Request): Promise<Response> {
    const url = new URL(request.url);
 
    switch (url.pathname) {
      case "/session/get": {
        const sessionData = await this.state.storage.get("session");
        return Response.json(sessionData ?? {});
      }
      case "/session/set": {
        const data = await request.json();
        await this.state.storage.put("session", data);
        // 24時間後に自動削除
        await this.state.storage.setAlarm(Date.now() + 86400_000);
        return Response.json({ ok: true });
      }
      default:
        return new Response("Not found", { status: 404 });
    }
  }
 
  // アラーム（セッションの自動クリーンアップ）
  async alarm(): Promise<void> {
    await this.state.storage.deleteAll();
  }
}