Which integrations are available for this server?

Provides tools for managing DNS records, zone settings, Cloudflare Tunnels, WAF rules, Zero Trust applications, and security event analytics via the Cloudflare API.

mcp-cloudflare

GitHub release License: AGPL-3.0 CalVer Node.js TypeScript

Slim Cloudflare MCP Server for managing DNS, zones, tunnels, WAF, Zero Trust, and security via Cloudflare API v4.

No SSH. No shell execution. API-only. 3 runtime dependencies.

Features

Tools across 6 domains:

DNS — Record management (A, AAAA, CNAME, MX, TXT, SRV, CAA, NS), batch operations
Zones — Zone listing, settings, SSL/TLS configuration, cache management
Tunnels — Cloudflare Tunnel creation, configuration, and ingress management
WAF — Ruleset management, custom firewall rules, rate limiting
Zero Trust — Access applications, policies, identity providers, Gateway status
Security — Security event analytics, IP access rules, DDoS configuration

Quick Start

npm install
cp .env.example .env   # Edit with your Cloudflare API token
npm run build
node dist/index.js     # stdio transport for MCP

Claude Code Integration

Add to .mcp.json in your project root:

{
  "mcpServers": {
    "cloudflare": {
      "command": "node",
      "args": ["/path/to/mcp-cloudflare/dist/index.js"],
      "env": {
        "CLOUDFLARE_API_TOKEN": "your-api-token-here",
        "CLOUDFLARE_ACCOUNT_ID": "your-account-id"
      }
    }
  }
}

Configuration

Variable	Required	Default	Description
`CLOUDFLARE_API_TOKEN`	Yes	—	Cloudflare API Token (with appropriate permissions)
`CLOUDFLARE_ACCOUNT_ID`	No	—	Cloudflare Account ID (required for account-level operations)
`CLOUDFLARE_TIMEOUT`	No	`30000`	Request timeout in milliseconds

API Token Permissions

Create an API Token at dash.cloudflare.com/profile/api-tokens with the following permissions based on what you need:

DNS: Zone > DNS > Edit
Zone settings: Zone > Zone Settings > Edit
Tunnels: Account > Cloudflare Tunnel > Edit
WAF: Zone > Firewall Services > Edit
Zero Trust: Account > Access: Apps and Policies > Edit
Security events: Zone > Analytics > Read

Multi-Zone Support

All zone-scoped tools accept a zone_id parameter that can be either:

A 32-character hex zone ID (e.g., 00000000000000000000000000000001) — used directly
A zone name / domain (e.g., example.com) — resolved automatically via the Cloudflare API

This allows managing multiple zones by name without needing to look up IDs manually.

Tools

Tools documentation is coming in v1 as tool modules are implemented. See docs/api-reference.md for the planned API endpoint mapping.

Skills

Claude Code skills compose MCP tools into higher-level workflows. See .claude/skills/README.md for detailed documentation.

Skill	Slash Command	Description
cloudflare-health	`/cf-health`	Zone health dashboard — DNS, security, tunnels, WAF, DDoS status
cloudflare-live-test	`/cf-test`	Live integration test — read + safe writes with cleanup
cloudflare-dns-management	—	DNS record management — add, list, update, delete across zones
cloudflare-incident-response	—	DDoS/attack emergency response — detect, assess, mitigate, monitor
cloudflare-security-audit	—	Security posture audit — WAF, events, IP access, DDoS analytics
cloudflare-tunnel-management	—	Tunnel management — create, configure ingress, monitor connections
cloudflare-waf-management	—	WAF management — custom rules, rulesets, IP access, Under Attack
cloudflare-zero-trust	—	Zero Trust — access apps, policies, identity providers, gateway

Development

npm run build      # Compile TypeScript
npm test           # Run unit tests (vitest)
npm run typecheck  # Type check only (no emit)

See CONTRIBUTING.md for contribution guidelines.

License

This project is dual-licensed:

Open Source: GNU Affero General Public License v3.0 (AGPL-3.0) — free for open-source and non-commercial use
Commercial: Available for proprietary integrations — see COMMERCIAL_LICENSE.md

If you use mcp-cloudflare in a proprietary product or SaaS offering, a commercial license is required. Support development by sponsoring us on GitHub.