diff --git a/cli/src/lib/deploy.ts b/cli/src/lib/deploy.ts
index 94472c5..9793238 100644
--- a/cli/src/lib/deploy.ts
+++ b/cli/src/lib/deploy.ts
@@ -225,7 +225,10 @@ function discoverWorkerDirs(root: string): { tier1: string[]; tier2: string[] }
   }
   // self-hosted 也部署自己的 MCP worker（mcp-account-source §5c：codeload 主庫即得 MCP，
   // .mcp.json 指自己的 mcp 而非官方 mcp.arcrun.dev）。
-  for (const name of ['cypher-executor', 'registry', 'mcp']) {
+  // kbdb：MCP 的 partnerAuthMiddleware 透過 KBDB service binding 打 arcrun-kbdb worker（mcp/wrangler.toml）。
+  //   D1 arcrun-kbdb 已由 init/update 建好，但 worker 本體要一併部署，否則 binding 指向不存在的 service
+  //   → 每個 MCP 認證請求都 throw（self-hosted MCP failed 根因，2026-06-10）。
+  for (const name of ['cypher-executor', 'registry', 'kbdb', 'mcp']) {
     const dir = join(root, name);
     if (existsSync(join(dir, 'wrangler.toml'))) tier2.push(dir);
   }
diff --git a/mcp/wrangler.toml b/mcp/wrangler.toml
index 77afbe0..dda37f7 100644
--- a/mcp/wrangler.toml
+++ b/mcp/wrangler.toml
@@ -11,7 +11,7 @@ workers_dev = true   # 對齊 arcrun 部署慣例（rule 05）：deploy 掃描
 services = [
   { binding = "COMPONENT_REGISTRY", service = "arcrun-registry" },
   { binding = "CYPHER_EXECUTOR", service = "arcrun-cypher-executor" },
-  { binding = "KBDB", service = "inkstone-kbdb-api" }
+  { binding = "KBDB", service = "arcrun-kbdb" }
 ]
 
 # Route — MCP 搬進 arcrun 主庫後改用 arcrun.dev zone（與其他 worker 一致）。