Cloudflare MCP Server

Read from the package source without running it. The installed server may list more.

• cloudflare_account_info

  Get Cloudflare account details (account name, ID, settings). No zone_id needed.

• cloudflare_cache_purge

  Purge cached files from Cloudflare's edge. Purge specific URLs (files), cache tags, URL prefixes, or everything.

• cloudflare_certificate_get

  Get details of a specific SSL/TLS certificate pack including hosts, status, validity, and issuer.

• cloudflare_certificate_list

  List SSL/TLS certificate packs for a zone. Shows all certificates including Universal SSL, Advanced, and custom uploads.

• cloudflare_ddos_analytics

  Query DDoS attack analytics for a zone using Cloudflare GraphQL Analytics. Returns aggregated attack traffic data.

• cloudflare_dns_createwrite action

  Create a new DNS record in a zone.

• cloudflare_dns_deletewrite action

  Delete a DNS record from a zone.

• cloudflare_dns_export

  Export all DNS records for a zone in BIND zone file format. Returns raw text.

• cloudflare_dns_get

  Get a single DNS record by its record ID.

• cloudflare_dns_import

  Import DNS records from a BIND zone file. Sends the file content as multipart/form-data.

• cloudflare_dns_list

  List DNS records for a zone. Optionally filter by type, name, content, or proxied status.

• cloudflare_dns_search

  Search DNS records by name pattern. Returns all records whose name contains the given string.

• cloudflare_dns_updatewrite action

  Update an existing DNS record (full replacement via PUT).

• cloudflare_dnssec_disable

  DESTRUCTIVE: Disable DNSSEC for a zone. Also remove the DS record at your domain registrar to avoid DNS resolution failures.

• cloudflare_dnssec_enable

  DESTRUCTIVE: Enable DNSSEC for a zone. After enabling, you must add the DS record at your domain registrar for DNSSEC to become fully active.

• cloudflare_dnssec_status

  Get the DNSSEC status for a zone.

• cloudflare_ip_access_createwrite action

  Create an IP access rule for a zone. Targets can be a specific IP, CIDR range, ASN, or country code.

• cloudflare_ip_access_deletewrite action

  Delete an IP access rule from a zone by its rule ID.

• cloudflare_ip_access_list

  List IP access rules (firewall rules) for a zone. Filter by mode (block, challenge, whitelist, js_challenge).

• cloudflare_kv_deletewrite action

  Delete a key from a Workers KV namespace.

• cloudflare_kv_list_keys

  List keys stored in a Workers KV namespace. Supports prefix filtering and cursor-based pagination.

• cloudflare_kv_namespace_createwrite action

  Create a new Workers KV namespace in the account.

• cloudflare_kv_namespace_deletewrite action

  DESTRUCTIVE: Delete a Workers KV namespace by its ID. This removes all keys in the namespace.

• cloudflare_kv_namespace_list

  List all Workers KV namespaces in the account.

• cloudflare_kv_read

  Read the value of a key from a Workers KV namespace. Returns the raw string value.

• cloudflare_kv_writewrite action

  Write a value to a key in a Workers KV namespace. Optionally set a TTL for automatic expiration.

• cloudflare_r2_bucket_createwrite action

  Create a new R2 storage bucket. Name must be 3-63 lowercase alphanumeric characters with hyphens.

• cloudflare_r2_bucket_deletewrite action

  DESTRUCTIVE: Delete an R2 bucket. The bucket must be empty before deletion.

• cloudflare_r2_bucket_domain_add

  Attach a custom domain to an R2 bucket, enabling public access via that domain. The domain must belong to a zone in the same account. Cloudflare automatically creates a CNAME record.

• cloudflare_r2_bucket_domain_list

  List custom domains attached to an R2 bucket. Shows domain name, status, and zone info.

• cloudflare_r2_bucket_domain_removewrite action

  Remove a custom domain from an R2 bucket. This disables public access via that domain.

• cloudflare_r2_bucket_get

  Get details of an R2 bucket including creation date and location.

• cloudflare_r2_bucket_list

  List all R2 buckets in the account. Supports filtering by name and pagination.

• cloudflare_r2_object_deletewrite action

  Delete an object from an R2 bucket.

• cloudflare_r2_object_get

  Get metadata of an object in an R2 bucket (size, etag, content type, last modified). Does not return object body.

• cloudflare_r2_object_list

  List objects in an R2 bucket. Supports prefix filtering, delimiter for directory-like listing, and pagination.

• cloudflare_rate_limit_get

  Get details of a specific rate limiting rule including threshold, period, action, and match conditions.

• cloudflare_rate_limit_list

  List all rate limiting rules for a zone with pagination.

• cloudflare_rate_limit_status

  Check Cloudflare API rate limit consumption. Returns current limit, remaining requests, and reset time from response headers.

• cloudflare_security_events

  Query recent security/firewall events for a zone using Cloudflare GraphQL Analytics.

• cloudflare_security_insights

  List Security Center insights (configuration issues, vulnerabilities, misconfigurations) for the account. Requires CLOUDFLARE_ACCOUNT_ID.

• cloudflare_security_insights_severity_count

  Get Security Center insight counts grouped by severity (low, moderate, critical). Quick overview without fetching all issues. Requires CLOUDFLARE_ACCOUNT_ID.

• cloudflare_security_level_get

  Get the current security level setting for a zone (off, essentially_off, low, medium, high, under_attack).

• cloudflare_security_level_set

  DESTRUCTIVE: Update the security level for a zone. Changes affect live traffic immediately. Use 'under_attack' only during active DDoS attacks.

• cloudflare_ssl_setting_get

  Get the current SSL/TLS encryption mode for a zone (off, flexible, full, strict).

• cloudflare_ssl_setting_set

  DESTRUCTIVE: Set the SSL/TLS encryption mode for a zone. Changes affect live traffic immediately. 'strict' is recommended for production.

• cloudflare_ssl_verification

  Get SSL/TLS verification status for a zone. Shows certificate validation progress, hostname coverage, and brand check status.

• cloudflare_tls_setting_get

  Get the minimum TLS version setting for a zone (1.0, 1.1, 1.2, or 1.3).

• cloudflare_tls_setting_set

  DESTRUCTIVE: Set the minimum TLS version for a zone. Changes affect live traffic immediately. Higher versions are more secure but may break older clients.

• cloudflare_token_verify

  Validate the configured Cloudflare API token and check its permissions.

• cloudflare_tunnel_config_get

  Get the ingress configuration for a Cloudflare Tunnel.

• cloudflare_tunnel_config_updatewrite action

  Update the ingress configuration for a Cloudflare Tunnel.

• cloudflare_tunnel_createwrite action

  Create a new Cloudflare Tunnel. A secure 32-byte tunnel secret is automatically generated.

• cloudflare_tunnel_deletewrite action

  Delete a Cloudflare Tunnel by its ID. This action cannot be undone.

• cloudflare_tunnel_get

  Get details for a specific Cloudflare Tunnel by its ID.

• cloudflare_tunnel_list

  List Cloudflare Tunnels for the account. Optionally filter by name or deleted status.

• cloudflare_tunnel_token

  Get the connector token for a Cloudflare Tunnel. This JWT token is used by cloudflared to authenticate with the Cloudflare edge. Store securely — treat as a credential.

• cloudflare_under_attack_status

  Check whether a zone is currently in 'Under Attack' mode. Returns the current security level and whether DDoS protection is maximized.

• cloudflare_waf_create_custom_rulewrite action

  Add a new custom WAF firewall rule to a zone. Uses Cloudflare Rules Language for the expression.

• cloudflare_waf_delete_custom_rulewrite action

  Delete a custom WAF firewall rule from a zone ruleset.

• cloudflare_waf_get_ruleset

  Get a specific WAF ruleset by ID, including all rules within the ruleset.

• cloudflare_waf_list_custom_rules

  List all custom WAF firewall rules for a zone (http_request_firewall_custom phase entrypoint).

• cloudflare_waf_list_rulesets

  List all WAF rulesets for a zone (managed, custom, rate-limiting, etc.).

• cloudflare_web_analytics_createwrite action

  Create/enable a Web Analytics (RUM) site. Enables privacy-first, cookie-free analytics beacon auto-injection for the specified hostname.

• cloudflare_web_analytics_deletewrite action

  Delete a Web Analytics (RUM) site and stop collecting analytics.

• cloudflare_web_analytics_get

  Get details of a specific Web Analytics (RUM) site by ID.

• cloudflare_web_analytics_list

  List all Web Analytics (RUM) sites for the account. Returns site IDs, hostnames, and creation dates.

• cloudflare_web_analytics_stats

  Query Web Analytics traffic stats for a zone. Returns page views, visits, and bandwidth grouped by time.

• cloudflare_worker_analytics

  Query Workers invocation analytics (time-series). Returns per-script metrics including requests, errors, subrequests, and CPU time percentiles ordered by time.

• cloudflare_worker_deletewrite action

  DESTRUCTIVE: Delete a Workers script by name. This action cannot be undone.

• cloudflare_worker_deploywrite action

  Deploy a Workers script. Creates or updates the named script with the provided source code.

• cloudflare_worker_deploy_projectwrite action

  Deploy a multi-file Workers project using wrangler. Runs 'npx wrangler deploy' in the given project directory.

• cloudflare_worker_list

  List all Workers scripts deployed in the account.

• cloudflare_worker_route_createwrite action

  Create a Workers route that maps a URL pattern to a Worker script for a zone.

• cloudflare_worker_route_list

  List all Workers routes for a zone. Routes map URL patterns to Worker scripts.

• cloudflare_worker_secret_deletewrite action

  Delete a secret from a Workers script by name.

• cloudflare_worker_secret_list

  List all secrets bound to a Workers script. Only secret names are returned, not values.

• cloudflare_worker_secret_set

  Set a secret for a Workers script. Creates or updates the named secret. The secret value is NOT echoed in the response for security.

• cloudflare_worker_usage

  Query Workers usage summary (per-script aggregated). Returns scripts ranked by total request count, with error rates and CPU time percentiles.

• cloudflare_zone_get

  Get zone details including status, nameservers, and plan.

• cloudflare_zone_health

  Check the health of a zone: combines zone status, DNSSEC configuration, and SSL mode into a single health report.

• cloudflare_zone_list

  List all Cloudflare zones with pagination. Optionally filter by status or name.

• cloudflare_zone_setting_get

  Get a specific zone setting by name (e.g., 'ssl', 'security_level', 'minify').

• cloudflare_zone_setting_updatewrite action

  Update a specific zone setting (e.g., change SSL mode, security level).

• cloudflare_zt_create_appwrite action

  Create a new Zero Trust Access application. Protects a domain with identity-based access control.

• cloudflare_zt_create_idpwrite action

  Create a new identity provider (IdP) for Zero Trust Access. Supports GitHub, Google, SAML, OIDC, Azure AD, Okta, and one-time PIN.

• cloudflare_zt_create_policywrite action

  Create an access policy for a Zero Trust Access application. Policies define who can access the application.

• cloudflare_zt_delete_appwrite action

  DESTRUCTIVE: Delete a Zero Trust Access application. This removes the application and all its associated policies.

• cloudflare_zt_delete_idpwrite action

  DESTRUCTIVE: Delete an identity provider (IdP) from Zero Trust Access.

• cloudflare_zt_delete_policywrite action

  DESTRUCTIVE: Delete an access policy from a Zero Trust Access application.

• cloudflare_zt_gateway_status

  Get the Zero Trust Gateway (DNS/HTTP filtering) configuration status for the account.

• cloudflare_zt_get_app

  Get details for a specific Zero Trust Access application by its ID.

• cloudflare_zt_list_apps

  List all Zero Trust Access applications for the account.

• cloudflare_zt_list_idps

  List all identity providers (IdPs) configured for Zero Trust Access on the account.

• cloudflare_zt_list_policies

  List all access policies attached to a Zero Trust Access application.

• Code scan45 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancerepository not readable: repo not found3/15
• Maintainer identityno repository or website to verify2/10

Cloudflare MCP Server: common questions

Is Cloudflare MCP Server safe?

With care: it is graded C, so read the findings first (65/100). Read the Cloudflare MCP Server safety report

How do I install Cloudflare MCP Server?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Cloudflare MCP Server need an API key?

No secret keys are declared. It reads 2 settings from the environment.

Is Cloudflare MCP Server maintained?

The latest release is v2026.4.10.

What can I use instead of Cloudflare MCP Server?

Servers from other publishers that do the same job: Porkbun (official) MCP server, Scrapling MCP Server and MCP server. Compare all Cloudflare MCP Server alternatives.