Cloudflare Sentinel Custom MCP Tools

Call-ready custom MCP tool collection for Cloudflare CCF data in Microsoft Sentinel.

This repository is for Cloudflare users, ISV developers, partner engineers, or joint customer teams that want an agent surface such as Claude Code, GitHub Copilot in VS Code, Copilot Studio, Foundry, Security Copilot, or a product-owned agent to call focused Cloudflare investigation tools over Sentinel data.

The repo includes both:

1. Production MCP tools over the official Cloudflare CCF table CloudflareV2_CL.

2. A LogSeeder schema generated from the official Cloudflare CCF table so you can seed sample Cloudflare-shaped rows before a call.

Grounding

Official schema (the Cloudflare CCF solution, which provisions CloudflareV2_CL):

Azure/Azure-Sentinel/Solutions/Cloudflare CCF/Data Connectors/CloudflareLog_CCF/CloudflareLog_Table.json

Official analytic rules used as design inspiration:

Important: the analytic rules use legacy parser column names like SrcIpAddr and HttpRequestMethod. These tools are re-authored against the real CCF table columns such as ClientIP, ClientRequestMethod, ClientRequestUserAgent, ClientCountry, EdgeResponseStatus, SecurityAction, and WAF attack score fields.

Related MCP server: Rubrik Sentinel MCP Tools

What this publishes

scripts/publish-mcp-tools.py calls the Sentinel Platform Services authoring API and publishes each file in mcp-tools/*.kql as a Kqs custom MCP tool under one collection:

Cloudflare-Sentinel-MCP-Tools

Runtime endpoint:

https://sentinel.microsoft.com/mcp/custom/Cloudflare-Sentinel-MCP-Tools/

Tools

For detailed usage, input arguments, KQL strategy, and expected output shape, see docs/tool-reference.md.

Prerequisites

1. A Microsoft Sentinel workspace with Sentinel Platform Services / data lake enabled.

2. Production Cloudflare CCF data already flowing into CloudflareV2_CL, or use LogSeeder to seed sample rows before a call.

3. Azure CLI authenticated to the tenant that owns the Sentinel workspace.

4. Permission to author custom MCP collections in Sentinel Platform Services.

5. Python 3.9+.

This is an alpha/private-preview style surface. The publisher and runtime both use the Sentinel Platform Services resource ID 4500ebfb-89b6-4b14-a480-7f749797bfcd. In practice:

• The tenant must have Microsoft Sentinel data lake and the required Microsoft Defender / Sentinel Platform Services licensing enabled.

• To create, update, or delete custom tools, use an identity with Security Operator, Security Administrator, or Global Administrator privileges for the Microsoft Security experience plus read access to the target Sentinel workspace.

• To list or invoke the tools, use an identity with Security Reader or Global Reader privileges plus read access to the target Sentinel workspace.

• If API publishing is unavailable in your tenant, create the same KQL as custom tools through the Microsoft Defender portal / Advanced hunting "Save as tool" flow, then use the same runtime endpoint pattern.

Seed sample Cloudflare data with LogSeeder

The generated schema is in:

logseeder/CloudflareV2_CL.json

Copy it to your LogSeeder repo and ingest:

cp logseeder/CloudflareV2_CL.json ~/sentinel-logseeder/schemas/
cd ~/sentinel-logseeder

pwsh -NoLogo -NoProfile -ExecutionPolicy Bypass \
  -File ./scripts/Invoke-SampleDataIngestion.ps1 \
  -TableName CloudflareV2_CL \
  -Schema ./schemas/CloudflareV2_CL.json \
  -RowCount 3000 \
  -TimeWindowMinutes 1440 \
  -Deploy -Ingest

Verify:

CloudflareV2_CL
| where TimeGenerated > ago(24h)
| summarize Rows=count(), LastSeen=max(TimeGenerated)

Publish the tools through the API

git clone https://github.com/MitchellGulledge3/cloudflare-sentinel-mcp-tools.git
cd cloudflare-sentinel-mcp-tools

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

python3 scripts/publish-mcp-tools.py \
  --collection Cloudflare-Sentinel-MCP-Tools \
  --workspace-id "<workspace-customer-id>"

Use --dry-run first if you want to inspect the API payloads without writing anything.

Quick start for Claude Code

TOKEN=$(az account get-access-token \
  --resource 4500ebfb-89b6-4b14-a480-7f749797bfcd \
  --query accessToken -o tsv)

python3 scripts/write-claude-mcp-config.py \
  --collection Cloudflare-Sentinel-MCP-Tools \
  --bearer-token "$TOKEN"

Suggested Claude Code prompt:

Read this repo. Use the Cloudflare-Sentinel-MCP-Tools MCP server from .mcp.json.
List the available Cloudflare tools, then call Cloudflare_Zone_Security_Posture for workspace <workspace-customer-id>.
After that, call Cloudflare_Bad_Client_IP_Reputation and Cloudflare_WAF_Allowed_Threats and summarize the highest priority findings.

Run locally from the terminal

cp .env.example .env
# edit .env
python3 run_tools.py --prompt "Summarize Cloudflare zone security posture" --show-raw
python3 run_tools.py --prompt "Show Cloudflare WAF allowed threats" --show-raw
python3 run_tools.py --prompt "Investigate Cloudflare client IP 203.0.113.42" --show-raw

Run locally from VS Code / GitHub Copilot

TOKEN=$(az account get-access-token \
  --resource 4500ebfb-89b6-4b14-a480-7f749797bfcd \
  --query accessToken -o tsv)

python3 scripts/write-vscode-mcp-config.py \
  --collection Cloudflare-Sentinel-MCP-Tools \
  --bearer-token "$TOKEN"

Open .vscode/mcp.json, start the MCP server, and ask Copilot Chat to call the Cloudflare tools.

Configure any MCP-capable agent

Register this remote MCP endpoint in any MCP-capable agent runtime that supports authenticated HTTP MCP servers:

https://sentinel.microsoft.com/mcp/custom/Cloudflare-Sentinel-MCP-Tools/

At runtime, every tool requires:

{
  "workspaceId": "<workspace-customer-id>"
}

Cloudflare_Client_IP_Investigation also requires:

{
  "ClientIP": "203.0.113.42"
}

workspaceId is the workspace customer ID the Sentinel custom MCP runtime uses to bind the KQL execution target. The KQL text itself does not call workspace("<id>"); target selection is handled by the platform tool runtime.

Repository map

Notes for alpha users

• The tools are read-only KQL tools.

• All tools query the official Cloudflare CCF table CloudflareV2_CL directly (not a parser alias).

• FirstSeen/LastSeen in output are computed from TimeGenerated; time filtering is always done on TimeGenerated.

• If a workspace has no Cloudflare rows, the tools execute but return zero-row or zero-count output.