feat(mcp): add whoami, an OpenAI profile tool for the connected identity

[mattzcarey]

Adds whoami, which returns the Cloudflare user or account the connection is authenticated as. It's marked as an OpenAI profile tool, so ChatGPT can tell connected accounts apart and recognise the same one after a reconnect. Replaces #254.

// tools/call whoami {}
{ "structuredContent": { "id": "user:7c5dae5552338874e5053f2534d2767a", "email": "alice@example.com" } }
// with an account token
{ "structuredContent": { "id": "account:023e105f4ecef8ad9ca31a8372d0c353", "name": "Alice Co" } }

• Named whoami, not get_profile. The API already has GET /accounts/{id}/profile, /user/billing/profile and /organizations/{id}/profile. Endpoint tools are named <method>_<path>, so get_profile reads like one of them. whoami can never clash with an endpoint tool. OpenAI allows any name; ChatGPT finds the tool through _meta['openai/profile'].
• The ID is the Cloudflare ID with a user: or account: prefix. OpenAI says to use an existing immutable, opaque provider ID when there is one. Cloudflare user and account IDs are exactly that. The prefix keeps users and accounts apart. Every user credential (OAuth, cfut_, cfoat_, legacy) maps to the same profile. The format is a permanent contract, and AGENTS.md now says so.
• The definition is static (see Remove account IDs and names from execute tool description #235). Only tools/call reads the credential. The tool is registered in both modes, _meta.securitySchemes lists the identity scopes every grant holds, and arguments are rejected.
• An empty upstream ID returns a tool error, not a placeholder ID.
• No Cache-Control change. Caches don't store POST responses without explicit freshness headers, and a blanket no-store would undo feat(mcp): let clients cache tools/list for an hour and share it across users #245.

flowchart LR
  A[AuthProps] -->|user_token| U["user:<user.id> + email"]
  A -->|account_token| C["account:<account.id> + name"]
  U --> R[structuredContent + JSON text]
  C --> R

Loading