Cloudflare MCP API Server (Enterprise Edition)

A high-performance Model Context Protocol (MCP) server providing AI assistants with read-only access to the Cloudflare ecosystem. Query your entire Cloudflare infrastructure using natural language through Claude, Cursor, or any MCP-compatible client. Inspired by mcp-server-cloudflare.

Security-First Design

This server implements NIST 800-53 Rev. 5 controls for FedRAMP High environments:

Related MCP server: Cloudflare API MCP Server

Why Use This?

• Infrastructure discovery: "What DNS records exist across all my zones?"

• Security audits: "Which zones don't have WAF enabled?" or "Show me all rate limiting rules"

• Troubleshooting: "What are the SSL settings for example.com?"

• Documentation: Generate configuration reports by asking questions

• Learning: Explore your Cloudflare setup without memorizing API endpoints

Features

• 354 read-only tools covering the entire Cloudflare API surface (as of 2026-02-05)

• Zero write operations - cannot modify any configurations (safe to use)

• Natural language queries - ask questions, get answers

• Built-in security - rate limiting, audit logging, token protection

API Coverage

Quick Start

1. Install

git clone https://github.com/pocc/cloudflare-mcp.git
cd cloudflare-mcp
npm install
npm run build

2. Create API Token

1. Go to Cloudflare Dashboard → API Tokens

2. Click Create Token

3. Use Custom Token with read-only permissions:

   • Account Settings: Read

   • Zone: Read

   • Zone Settings: Read

   • DNS: Read

   • SSL and Certificates: Read

   • Firewall Services: Read

   • Analytics: Read

   • Access: Apps and Policies: Read

   • Worker Scripts: Read

   • Load Balancers: Read

   • (add more as needed for your use case)

3. Configure Your MCP Client

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "cloudflare": {
      "command": "node",
      "args": ["/path/to/cloudflare-mcp/dist/index.js"],
      "env": {
        "CLOUDFLARE_API_TOKEN": "your-api-token-here"
      }
    }
  }
}

Cursor / Other MCP Clients

CLOUDFLARE_API_TOKEN="your-token" node dist/index.js

Example Queries

Once connected, ask natural language questions:

Discovery

• "List all my zones and their status"

• "What Workers do I have deployed?"

• "Show me all Access applications"

Security Audit

• "Which zones have bot management enabled?"

• "What WAF rules are configured on example.com?"

• "List all rate limiting rules across my account"

• "Show audit logs from the last 24 hours filtered by user@example.com"

Troubleshooting

• "What are the SSL settings for example.com?"

• "Is Argo Smart Routing enabled on my zones?"

• "What DNS records exist for api.example.com?"

• "Show me the load balancer configuration for production"

Zero Trust

• "List all Cloudflare Tunnel connections"

• "What Access policies protect my apps?"

• "Show Gateway network policies"

• "What devices are registered in my Zero Trust org?"

Security

Best Practices:

• Use the principle of least privilege when creating tokens

• Never commit tokens to version control

• Rotate tokens periodically

Documentation

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT