MCP server · Infrastructure

OfficialSource ValidatedRead-writeApache-2.0Updated August 2026

Cloudflare API MCP

Search and operate the Cloudflare API through a compact Code Mode MCP server with OAuth-scoped account access.

InstallSource repository

Quick verdict

Technically compelling and unusually token-efficient, but suitable only when the profile makes remote code execution and production-account reach impossible to miss.

  • MaintainerCloudflare (official)
  • Security scopeRead-write
  • Transportsstreamable-http
  • Install channelremote · https://mcp.cloudflare.com/mcp
  • EvidenceSource Validated
  • LicenseApache-2.0 · Open source

Cloudflare API MCP exposes the vendor's broad API through three compact tools: documentation search, OpenAPI search, and remote JavaScript execution (Code Mode) against authorized Cloudflare endpoints. It reaches products from Workers and storage to DNS, Zero Trust and security controls, so its real authority is bounded entirely by the OAuth permissions or API token selected for the connection. It is a distinct entity from the existing cloudflare-docs profile (a narrower, no-account documentation-only server) and from Cloudflare's separate domain-specific MCP server suite registered in the official Registry as com.cloudflare.mcp/mcp.

MCP security best practices

Install Cloudflare API MCP

http https://mcp.cloudflare.com/mcp

Config entry (mcpServers)
{
  "mcpServers": {
    "cloudflare-mcp": {
      "url": "https://mcp.cloudflare.com/mcp"
    }
  }
}

Cloudflare-hosted Code Mode endpoint, OAuth-authorized by default (a bearer Cloudflare API token is also supported for automation). This is the broad account-capable server, not the narrower cloudflare-docs documentation server. Appending ?codemode=false trades the compact search/execute surface for roughly 2,500 direct endpoint tools and a much larger context footprint; not the profile’s proposed default.

Credentials

No static secret goes in this config, but this server still requires account authorization. Connecting it starts an interactive sign-in and consent flow against the account it reaches, and whatever that account is allowed to do becomes what the agent can do through this server. Authorize it from an account scoped to the work at hand, and keep your client’s approval prompts on.

Verified configurations

Not run by us yet. This profile is Source Validated: the install channel, config entry, credentials and license were checked against the source and upstream metadata, but no configuration has been installed, discovered and executed in a recorded environment. When one is, it appears here with the eight scope dimensions below.

Best for

Cloudflare operators who need one first-party MCP surface across several products and can test with a dedicated account, narrowly selected permissions and human approval for changes.

Why use it

Code Mode avoids injecting thousands of endpoint schemas into the model context while retaining broad official API coverage and documentation lookup.

Tradeoffs

This is a high-authority infrastructure connector. It runs model-authored JavaScript remotely, can mutate or delete production resources across roughly 2,500 API endpoints, and can trigger billable usage. OAuth permission selection helps, but the server is intentionally broad; teams wanting narrower typed tools should consider Cloudflare's domain-specific MCP servers, or the read-only cloudflare-docs profile, instead.

Upstream state

repository active. Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.

Editorial review

Reviewed byOpenSourcesAI EditorialLast updatedAugust 2026SourcesCloudflare API MCP source and documentation; Cloudflare API MCP license; Cloudflare server-family comparison; Official MCP Registry — Cloudflare search (no exact entry for the broad server; distinct from com.cloudflare.mcp/mcp)

Grade B — Source Validated. Re-review is due by 2027-02-18. Config entries, credential names and package status can change upstream; verify against the source repository before granting an agent access.

Sources

  • Cloudflare Docs MCPGive MCP agents current Cloudflare documentation context without granting any access to your Cloudflare account.
  • Netlify MCPBuild, deploy and manage Netlify sites and account resources through Netlify's official hosted MCP server.
  • AWS MCP ServerSearch AWS knowledge and run IAM-authorized AWS API workflows through AWS's managed preview MCP server.

Related guides

All MCP servers →