cloudflare-mcp-go
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CLOUDFLARE_API_TOKEN | Yes | Authenticates all Cloudflare API calls. | |
| CLOUDFLARE_ACCOUNT_ID | No | Needed by account, audit log, KV, and intel tools. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| download_indicator_feed_dataB | Download the latest snapshot data of a threat-intelligence indicator feed by feed ID. Returns the raw feed body. |
| export_dns_recordsA | Export all DNS records for a Cloudflare zone as a BIND zone file. Returns the raw BIND-format text. |
| get_account_audit_log_historyB | Get the resource change history for a specific account audit log entry (v2) by entry ID. |
| get_account_audit_logs_v2B | Get account audit logs (Version 2) for a Cloudflare account. Supports since/before time filters and a limit. Records who changed what and when. |
| get_account_detailsA | Get details of a specific Cloudflare account by ID (name, settings, created date). |
| get_account_insight_contextA | Get the context (affected resources and details) for a specific Security Center insight in a Cloudflare account by issue ID. |
| get_account_insight_countsB | Get aggregated Security Center insight counts for a Cloudflare account by dimension (class, severity, or type). |
| get_account_insights_audit_logB | Get the Security Center insights audit log for a Cloudflare account (changes to insights over time). |
| get_account_issue_audit_logB | Get the audit log for a specific Security Center insight (issue) in a Cloudflare account by issue ID. |
| get_account_log_datasetC | Get a specific Logs Explorer dataset for a Cloudflare account by dataset ID. |
| get_account_logpush_jobA | Get details of a specific Logpush job in a Cloudflare account by job ID. |
| get_account_logpush_transformerB | Get a specific Logpush transformer in a Cloudflare account by transformer ID. |
| get_account_logpush_transformer_contentB | Get the content (transform definition) of a specific Logpush transformer in a Cloudflare account. |
| get_account_memberA | Get details of a specific Cloudflare account member by member ID (user, roles, policies, status). |
| get_account_partner_insight_countB | Get the count of partner-provided Security Center insights for a Cloudflare account. |
| get_account_recent_scansB | Get the recent Security Center scans for a Cloudflare account. |
| get_account_roleC | Get details of a specific Cloudflare account role by role ID (name, description, permissions). |
| get_account_security_center_stateB | Get the Security Center state (onboarding/configuration status) for a Cloudflare account. |
| get_account_subscriptionA | Get a specific Cloudflare account subscription by its identifier (product, state, price, frequency). |
| get_account_tokenA | Get details of a specific account-owned API token by token ID (name, status, policies, condition). |
| get_asn_intelA | Get an overview of an Autonomous System Number (ASN) and its subnet allocations. Useful for understanding the network behind a suspicious IP and assessing whether an entire ASN is involved in attacks. |
| get_attack_surface_issue_counts_by_classA | Get Security Center attack-surface issue counts grouped by class for a Cloudflare account. |
| get_attack_surface_issue_counts_by_severityC | Get Security Center attack-surface issue counts grouped by severity for a Cloudflare account. |
| get_attack_surface_issue_counts_by_typeB | Get Security Center attack-surface issue counts grouped by type for a Cloudflare account. |
| get_bulk_domain_detailsB | Get threat intelligence details for multiple domains at once (GET bulk). Returns per-domain risk and category data. |
| get_cmb_configA | Get the Customer Metadata Boundary (CMB) config for a Cloudflare account (data localization region for logs). |
| get_dns_analyticsA | Get DNS query analytics report for a Cloudflare zone. Returns query counts, response codes, and query type distributions. Useful for detecting DNS anomalies and attack patterns. |
| get_dns_analytics_bytimeB | Get DNS query analytics for a Cloudflare zone grouped by time interval. Returns time-series data points (grouped by time_delta) for spotting trends and spikes. |
| get_dns_recordA | Get a single DNS record in a Cloudflare zone by record ID. Returns the record's full detail (type, name, content, TTL, proxy status, comment). |
| get_dns_record_usageA | Get DNS record usage for a Cloudflare zone (counts toward plan limits). Returns current and allowed record counts. |
| get_dns_settingsA | Get DNS settings for a Cloudflare zone (e.g. Foundation DNS, multi-provider, nameservers, zone mode). Returns the zone's DNS configuration. |
| get_dnssecA | Get DNSSEC details for a Cloudflare zone (status, DS record, digest, key tag, algorithm). Useful for verifying DNSSEC configuration. |
| get_domain_historyA | Get historical threat data for a domain. Returns past and current security threat categories and content classifications. Useful for checking if a domain has a pattern of malicious behavior over time. |
| get_domain_intelA | Get security intelligence for a domain. Returns risk scores, content categories, and DNS information. Useful for investigating suspicious domains found in referrer headers or access logs. |
| get_domain_intel_bulkA | Get threat intelligence for multiple domains at once. Returns risk scores and content categories for each domain. Useful for batch assessment of suspicious domains found in logs. |
| get_firewall_ruleA | Get details of a specific custom firewall rule by ID. Returns the full rule configuration including filter expression, action, and priority. Useful for investigating why a specific rule triggered a block. |
| get_indicator_feedC | Get the metadata of a specific threat-intelligence indicator feed by feed ID. |
| get_indicator_feed_dataB | Get the raw data of a specific threat-intelligence indicator feed by feed ID. Returns the feed body (e.g. STIX/CSV). |
| get_indicator_feed_upload_statusA | Get the status of a specific upload to a threat-intelligence indicator feed by feed ID and upload ID. |
| get_insight_countsA | Get aggregated Security Center insight counts by dimension (severity, class, or type). Useful for quick security posture overview and prioritization. |
| get_ip_intelA | Get threat intelligence for an IP address. Returns geolocation, ASN, infrastructure type, and security threat categories. Useful for investigating suspicious IPs found in security events or access logs. |
| get_ip_listsC | Get the available Cloudflare threat-intelligence IP lists for a Cloudflare account. |
| get_kv_metadataB | Read the metadata associated with a key in a Workers KV namespace. |
| get_kv_namespaceA | Get a Workers KV namespace by ID. Returns the namespace details (ID, title, supports URL encoding). |
| get_kv_pairs_bulkB | Get multiple key-value pairs from a Workers KV namespace at once. The keys argument is a JSON object with a keys array. Read-only (no mutation) despite using POST. |
| get_kv_valueB | Read the value stored for a key in a Workers KV namespace. Returns the raw stored value. |
| get_log_by_rayidA | Look up an HTTP request log entry by its Cloudflare Ray ID. Returns request details including client IP, path, user agent, status code, and security actions. Useful for investigating why a specific request was blocked or challenged. |
| get_log_datasetC | Get a specific Logs Explorer dataset for a Cloudflare zone by dataset ID. |
| get_log_retention_flagB | Get the log retention flag for a Cloudflare zone (whether Logpull log retention is enabled). |
| get_logpush_jobB | Get details of a specific Logpush job in a Cloudflare zone by job ID. |
| get_partner_integration_settingsC | Get the Security Center partner integration settings for a Cloudflare account and partner. |
| get_rate_limitA | Get details of a specific rate limiting rule by ID. Returns the full configuration including threshold, period, action, and match criteria. |
| get_rulesetA | Get a specific ruleset with all its rules. Returns the complete rule definitions including expressions, actions, and configurations. Useful for inspecting what traffic patterns are matched by a ruleset. |
| get_securitytxtC | Get the security.txt configuration for a Cloudflare zone (security contact and disclosure policy). |
| get_sinkholeB | Get a specific DNS sinkhole by ID for a Cloudflare account. |
| get_subscription_cancel_reasonB | Get the cancellation reason recorded for a Cloudflare account subscription. |
| get_url_intelB | Get threat intelligence for a URL. Returns risk and category information for the URL. |
| get_whoisA | Get WHOIS registration data for a domain. Returns registrant information, nameservers, and registration/expiration dates. Useful for investigating domain ownership and detecting newly registered suspicious domains. |
| get_zoneA | Get details of a specific Cloudflare zone. Returns zone details such as ID, name, status, and plan. |
| get_zone_insights_audit_logB | Get the Security Center insights audit log for a Cloudflare zone (zone scope). |
| get_zone_issue_audit_logA | Get the audit log for a specific Security Center insight (issue) in a Cloudflare zone by issue ID. |
| get_zone_partner_insight_countB | Get the count of partner-provided Security Center insights for a Cloudflare zone. |
| get_zone_recent_scansC | Get the recent Security Center scans for a Cloudflare zone. |
| get_zone_settingsB | Get configuration settings for a Cloudflare zone (SSL mode, minimum TLS version, cache level, security level, etc.). Returns the full settings list. |
| list_account_audit_log_product_categoriesA | List the product categories available for filtering account audit logs (v2). |
| list_account_log_datasetsC | List Logs Explorer datasets configured for a Cloudflare account. |
| list_account_log_filesC | List stored log files for a Cloudflare account (Logpull/stored logs). Supports start, end, and bucket filters. |
| list_account_logpush_dataset_fieldsC | List the available Logpush fields for a specific dataset in a Cloudflare account. |
| list_account_logpush_dataset_jobsC | List Logpush jobs for a specific dataset in a Cloudflare account. |
| list_account_logpush_jobsA | List Logpush jobs for a Cloudflare account. Returns job details including dataset, destination, and enabled status. |
| list_account_logpush_transformer_versionsB | List the versions of a specific Logpush transformer in a Cloudflare account. |
| list_account_logpush_transformersC | List Logpush transformers for a Cloudflare account. |
| list_account_membersB | List members of a Cloudflare account. Returns member details including user, roles, and status. |
| list_account_rolesB | List the roles available in a Cloudflare account. Returns role IDs, names, descriptions, and permissions. |
| list_account_security_insightsB | List Security Center insights for a Cloudflare account (account scope). Returns security issues with severity, type, and classification. |
| list_account_subscriptionsB | List the subscriptions for a Cloudflare account. Returns subscription details including product, state, and price. |
| list_account_tokensB | List the account-owned API tokens for a Cloudflare account. Returns token IDs, names, status, and policies. |
| list_accountsA | List Cloudflare accounts accessible with the current API token. Returns account details such as ID, name, and settings. |
| list_attack_surface_issue_typesC | List the Security Center attack-surface-report issue types for a Cloudflare account. |
| list_attack_surface_issuesB | List Security Center attack-surface-report issues for a Cloudflare account (misconfigurations and exposures). |
| list_audit_logsA | List audit log entries for a Cloudflare account. Returns operation history including timestamps, actors, actions, and affected resources. Useful for investigating who changed what and when. |
| list_available_account_log_datasetsA | List the Logs Explorer datasets available to be configured for a Cloudflare account. |
| list_available_log_datasetsB | List the Logs Explorer datasets available to be configured for a Cloudflare zone. |
| list_dns_recordsA | List DNS records for a Cloudflare zone. Returns record details such as ID, type, name, content, TTL, and proxy status. |
| list_dnssec_zskC | List DNSSEC Zone Signing Keys (ZSKs) for a Cloudflare zone (multi-signer DNSSEC). Returns the ZSK records. |
| list_firewall_rulesA | List custom firewall rules for a Cloudflare zone. Returns rule expressions, actions, and priorities. Useful for investigating which rules may be blocking or challenging traffic. |
| list_indicator_feed_permissionsB | List the indicator feed permissions (feeds the account can view) for a Cloudflare account. |
| list_indicator_feedsB | List the threat-intelligence indicator feeds owned by a Cloudflare account. |
| list_instant_logs_jobsB | List Instant Logs (edge) jobs for a Cloudflare zone. |
| list_ip_access_rulesB | List IP access rules for a Cloudflare zone. Returns rules that block, challenge, or allow specific IPs, CIDRs, ASNs, or countries. |
| list_kv_keysA | List keys in a Workers KV namespace. Supports prefix filtering and cursor pagination. Returns key names, expiration, and metadata. |
| list_kv_namespacesA | List Workers KV namespaces in a Cloudflare account. Returns namespace details such as ID and title. |
| list_log_datasetsB | List Logs Explorer datasets configured for a Cloudflare zone. |
| list_log_fieldsA | List all available HTTP request log fields for a Cloudflare zone. Returns field names and descriptions. Use this to discover which fields can be specified when calling get_log_by_rayid or list_received_logs. |
| list_logpush_dataset_fieldsB | List the available Logpush fields for a specific dataset in a Cloudflare zone. |
| list_logpush_dataset_jobsC | List Logpush jobs for a specific dataset in a Cloudflare zone (e.g. http_requests, firewall_events). |
| list_logpush_jobsA | List Logpush jobs for a Cloudflare zone. Returns job details including dataset, destination, and enabled status. |
| list_partner_shadow_zone_hostsC | List the hosts in a partner-discovered shadow zone for a Cloudflare account, partner, and domain. |
| list_partner_shadow_zonesC | List partner-discovered shadow zones (unmanaged domains) for a Cloudflare account and partner. |
| list_passive_dnsA | List domains that have resolved to a specific IP address (passive DNS). Useful for identifying shared hosting or malicious infrastructure by revealing which domains point to a given IP. |
| list_rate_limitsA | List rate limiting rules for a Cloudflare zone. Returns thresholds, matching criteria, actions, and bypass rules. Useful for checking brute-force protection and identifying rate-limited traffic. |
| list_received_logsA | Retrieve HTTP request logs for a Cloudflare zone within a time range. Returns NDJSON log entries. Time range is limited to 1 hour and data must be at least 5 minutes old. Useful for investigating traffic patterns and anomalies. |
| list_rulesetsA | List all rulesets for a Cloudflare zone. Returns ruleset metadata (ID, name, kind, phase, version) without individual rules. Use get_ruleset to inspect rules within a specific ruleset. |
| list_scanned_dns_recordsB | List DNS records discovered by a DNS record scan for a Cloudflare zone, pending review. Returns the scanned records. |
| list_security_insightsB | List Security Center insights for a Cloudflare zone. Returns security issues with severity, type, and classification. Useful for identifying misconfigurations and vulnerabilities. |
| list_sinkhole_ingressesC | List the ingress rules for a specific DNS sinkhole by sinkhole ID. |
| list_sinkholesC | List the DNS sinkholes owned by a Cloudflare account. |
| list_token_permission_groupsB | List the permission groups available for account-owned API tokens. Useful for building token policies. |
| list_user_audit_logsA | List audit log entries for the current Cloudflare user (user-scoped). Returns the user's operation history including timestamps, actions, and affected resources. |
| list_waf_managed_rulesetsA | Get the WAF managed rulesets entrypoint for a Cloudflare zone. Returns which managed rulesets (e.g. Cloudflare Managed Ruleset, OWASP) are enabled and their configuration. |
| list_zone_partner_shadow_hostsB | List partner-discovered shadow hosts for a Cloudflare zone and partner. |
| list_zonesB | List zones in your Cloudflare account. Returns zone details such as ID, name, status, and plan. |
| query_account_logs_sqlC | Run a Logs Explorer SQL query for a Cloudflare account (GET). Returns the query results. |
| query_logs_sqlC | Run a Logs Explorer SQL query for a Cloudflare zone (GET). Returns the query results. |
| query_security_eventsB | Query security events for a Cloudflare zone using the GraphQL Analytics API. Returns event details including client info, action taken, rule details, bot score, and response status for security event triage. |
| retrieve_account_logsB | Retrieve stored log entries for a Cloudflare account (Logpull). Returns NDJSON. Supports start, end, and path filters. |
| verify_account_tokenB | Verify the account-owned API token used for the request (checks it is valid and active) for a Cloudflare account. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 117 tools
Many tools are near-duplicates split only by account vs zone scope (e.g. list_log_datasets vs list_account_log_datasets, query_logs_sql vs query_account_logs_sql, list_logpush_jobs vs list_account_logpush_jobs) or by subtle naming differences (get_domain_intel_bulk vs get_bulk_domain_details, get_indicator_feed_data vs download_indicator_feed_data). Threat-intel and audit-log tools also overlap heavily, making misselection likely for an agent.
All tool names use snake_case and mostly follow a verb_noun pattern with consistent verbs like list, get, and query. Minor deviations exist in scope placement (account/zone qualifier inserted inconsistently) and version suffixes (e.g. get_account_audit_logs_v2), but the naming is broadly predictable.
117 tools is an extreme mismatch for a practical MCP server, far exceeding the 50-tool threshold for severe bloat. This creates overwhelming selection complexity and makes it difficult for an agent to reliably choose the right tool.
The surface is almost entirely read-only (list, get, query, verify, download, export) with no create, update, or delete operations for DNS records, firewall rules, KV pairs, tokens, logpush jobs, or other resources. While read coverage is broad, the lack of lifecycle mutations is a significant gap for a Cloudflare management server.