cloudflare-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CLOUDFLARE_API_BASE | No | Override API base (defaults to v4 endpoint) | |
| CLOUDFLARE_ZONE_MAP | No | Zone mapping as {"example.com": "<zone_id>"} or example.com=<zone_id>,... | |
| CLOUDFLARE_API_TOKEN | No | API token (never printed, only last 4 chars in status) | |
| CLOUDFLARE_ACCOUNT_ID | No | Account id used for account scoped endpoints | |
| CLOUDFLARE_MCP_RETRIES | No | HTTP retry budget | |
| CLOUDFLARE_MCP_TIMEOUT | No | HTTP timeout budget | |
| CLOUDFLARE_MCP_DOCS_DIRS | No | os.pathsep separated markdown dirs indexed for cf_search_docs | |
| CLOUDFLARE_MCP_WRANGLER_FALLBACK | No | Set to 0 to disable the local wrangler fallback |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cf_system_statusA | Verify Cloudflare API authentication, the active account id, masked token state, zone mapping and which product capabilities are reachable. |
| cf_d1_queryA | Execute a SQL statement (SELECT/INSERT/UPDATE/DDL) against a named D1 database or database id. Returns columns, rows, rows_affected and duration. Supports positional parameter binding on the REST path. |
| cf_d1_list_databasesA | List all D1 (serverless SQLite) databases in the account with ids, creation timestamps and local wrangler bindings. |
| cf_d1_schemaA | Inspect the table and view DDL of a D1 database (optionally a single table), so an agent can write valid SQL without a full schema dump. |
| cf_list_workersB | List deployed Cloudflare Workers with environments, routes, deployment history and modified dates. |
| cf_kv_getB | Read one key (value + metadata + expiration) from a Workers KV namespace by namespace id or namespace title. |
| cf_kv_setB | Write one key/value pair into a Workers KV namespace. Optional ttl in seconds (max 604800) and JSON metadata; set is_json when the value is a JSON document that should be validated before write. |
| cf_r2_list_bucketsB | List R2 buckets in the account with creation time, location and storage class. Pass cursor for the next page. |
| cf_dns_listB | List DNS records of a zone (optional type/name filter) with content, TTL and proxy status. Zone may be a domain or an id in CLOUDFLARE_ZONE_MAP. |
| cf_dns_upsertB | Create or update a DNS record in a zone (idempotent by type + name). Set type/name/content plus optional ttl (1=automatic), proxied flag and comment. |
| cf_search_docsA | On-demand search over Cloudflare configuration/architecture guidance. Returns targeted snippets and code samples only - use this instead of loading manuals or guessing wrangler/wrangler-free API syntax. |
| cf_email_routing_rulesB | List Cloudflare Email Routing rules for a zone (matchers, forward actions, enabled status and priorities). Useful to inspect inbound routing for domains. |
| cf_email_destinationsA | List verified destination email addresses for Cloudflare Email Routing under the active account. |
| cf_ai_modelsA | List or search Cloudflare Workers AI models (e.g. '@cf/meta/llama-3', embeddings, text generation, vision). Returns model metadata and capabilities. |
| cf_vectorize_list_indexesA | List Cloudflare Vectorize vector database indexes (dimensions, metric, creation timestamp, description). |
| cf_tunnels_listB | List Cloudflare Zero Trust Tunnels (cloudflared connectors), their active status, tunnel id, connectors and configuration. |
| cf_access_apps_listA | List Cloudflare Access protected applications (domains, session durations, identity provider bindings). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 17 tools
Each tool targets a distinct Cloudflare resource and action (KV, DNS, D1, R2, tunnels, Access, email routing, AI, Vectorize), so misselection risk is low. The only mild friction is that read-only list tools interleave with read/write pairs, but purposes remain clear.
All tools share a consistent cf_ prefix and snake_case style. However the ordering is mixed: cf_kv_get / cf_dns_list (resource_verb) alongside cf_tunnels_list / cf_vectorize_list_indexes (resource_list) and cf_list_workers (verb_resource), a minor deviation from a single pattern.
17 tools for the very broad Cloudflare domain (DNS, KV, D1, R2, Workers, Zero Trust, email, AI) is reasonable and each tool maps to a meaningful capability. It sits at the upper end of comfortable but is not bloated.
Large lifecycle gaps exist: KV has get/set but no delete or list, DNS lacks delete, and most products (R2, Workers, Vectorize, tunnels, Access, email) are read/list-only with no create or delete operations. Agents will hit dead ends for mutation workflows beyond DNS upsert and D1 SQL.