MCP · Infrastructure · Cloudflare
Cloudflare API MCP Server
Inspect Cloudflare services and request API operations from an AI host, with OAuth permissions or scoped API tokens.
Wide API reach. An overprivileged connection can change many infrastructure products. Narrow scope before an agent starts investigating.
Understand the tool
What it does.
Cloudflare's main remote MCP server exposes its API and documentation. Code Mode lets the host compose API work in a Dynamic Worker. Credentials still determine which account operations are authorized.
Why use it?
Use it for operational questions spanning several Cloudflare screens. Gather relevant configuration into one explanation, specifying the account, zone and output before an investigation becomes a change.
A useful fit for
- Cloudflare configuration review
- API-assisted investigations
- Documented change proposals
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Explain a DNS configuration
A site owner needs to understand which records serve a subdomain.
- Select one authorized account and zone.
- Read relevant DNS records and documentation.
- Describe the current routing and unresolved questions.
Intended outputA configuration explanation with no DNS changes.
Use case 02
Prepare a Worker change
A developer needs to plan an update without touching production prematurely.
- Inspect the named Worker's available configuration.
- Read the documentation for the intended change.
- Draft the proposed operations and verification steps.
Intended outputA reviewable change plan with account and resource identifiers.
A concrete starting point
Illustrative prompt: DNS review
Grant read permissions for the specified zone.
For the Cloudflare zone I select, explain the records serving the app subdomain. Read only the relevant configuration and docs. List uncertainties and proposed checks. Do not create, update or delete resources.What this can change
Read results enter the AI host. Authorized API writes can affect availability, security settings and paid resources.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A remote MCP host supporting Streamable HTTP and the chosen authentication flow.
- Cloudflare account access and deliberately selected API permissions.
- A clear account/zone boundary and permission to share returned configuration with the AI host.
- Authentication
- OAuth with selected permissions, or supported user/account API tokens.
- Can read
- Cloudflare API data allowed by the credential
- Developer documentation
- Can write or change
- API mutations allowed by the credential
- Network and data flow
- mcp.cloudflare.com
- Cloudflare API and authentication services
- AI host/model provider
- Approval and control
- Restrict credential permissions and review proposed mutations in the host. Code execution isolation does not make authorized API changes harmless.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Streamable HTTP clients
- Older clients forced to use SSE need updating
- Product-specific servers remain separate optional choices
Costs and account requirements
Resource and product charges depend on the Cloudflare services used. AI host costs are separate; a universal MCP price is not established here.
Current pricing or plan information ↗Apache-2.0
Source license; Cloudflare service terms and usage charges are separate.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Wide API reach
An overprivileged connection can change many infrastructure products. Narrow scope before an agent starts investigating.
Operational consequences
A technically valid API request can still interrupt a site or create costs.
Where it may fall short
- No account connection, deployment or permission test was performed.
- This review covers the main API server, not every Cloudflare MCP server.
Observed behavior · 2026-10-18
Runtime and security findings.
The current Cloudflare API MCP endpoint rejected credential-free initialization and published OAuth discovery metadata. No Cloudflare resources were accessed.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Discovery scopes do not measure resource authority
The 401 challenge and public metadata named user:read and account:read. Those names alone do not tell us what a later authorized execute call can do. We did not receive a token or invoke any API tool.
In practice: Review the actual Cloudflare resource permissions during setup; do not infer a read-only connection from discovery labels.
Documented concern
Code execution still needs narrow API permissions
The API MCP uses generated code to call Cloudflare APIs. Its documentation allows OAuth permission selection or scoped API tokens; account tokens also need Account Resources: Read for account detection. IP-filtered API tokens are currently unsupported.
In practice: Use a dedicated token or grant for the selected account and task. Check compatibility before relying on a token with an IP filter.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.cloudflare.com/mcp
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: db5e479bb0e41f6d8ed1edf3c0215fdc48b7fc8ba7dff4af13bfc6abefce9873. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Windows 11 build 26200; Python 3.12.10 urllib; OpenSSL 3.0.16.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T00:47:10.611440+00:00 through 2026-10-19T00:47:20.626366+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Initial sandbox DNS failures were retained separately and resolved with approved network access; they are not endpoint failures.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://mcp.cloudflare.com/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T00:47:10.611440+00:00. WWW-Authenticate: Bearer; resource_metadata=https://mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp. Advertised challenge scope: user:read account:read. Empty response body.
Public authentication discoveryMet expectation
- Method
GET https://mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T00:47:20.626366+00:00; Content-Type: application/json. Resource: https://mcp.cloudflare.com/mcp. 2 supported scopes: user:read, account:read. Authorization server: https://mcp.cloudflare.com. Bearer methods: header.
Practical caveats
- This review targets https://mcp.cloudflare.com/mcp, not the separate public documentation or older product-specific servers.
- A sandbox for generated code does not make authorized DNS, deployment or resource changes harmless. Review the requested API method and target.
- Upstream caps tool results by default. Disabling truncation can return very large responses, so broad inventory queries need explicit limits.
What this evaluation does not establish
- OAuth consent, API-token permissions, account selection, denied writes and revocation.
- Code Mode execution, sandbox containment, API result truncation and prompt-injection resistance.
- DNS, Workers, storage or other account workflows; no authenticated tools were listed or called.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
Strong infrastructure coverage and visible permission choices make it useful after simpler MCP tasks. Broad API reach raises the setup burden.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Current primary server
- Authentication and transport
- API execution model
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official server catalog and setup ↗developers.cloudflare.com
- Current API server repository ↗github.com
- Source license ↗github.com
- Cloudflare plans ↗www.cloudflare.com