Cloudflare MCP — Zones & DNS Management

7 tools for Cloudflare zone and DNS record management — list/inspect zones, and list/get/create/update/delete DNS records — for Claude Desktop, Claude Code, and any MCP client.

by Jan Ivan Simoy

What is this?

Cloudflare MCP is a Model Context Protocol server that gives AI assistants structured access to the Cloudflare API v4 — specifically zones (domains) and their DNS records.

It deliberately covers only zones and DNS. Cloudflare's REST API is enormous — Workers, KV/R2/D1, cache purging, zone settings, Analytics, Radar, and more — and Cloudflare already ships more than a dozen product-specific MCP servers of its own for that surface. This one stays narrow: read a zone, then read, create, update, or delete the DNS records in it. Cache purging and zone-settings edits are explicitly out of scope for v1 — they change how traffic is served for an entire domain and deserve their own deliberate tool design later, not a bolt-on here.

Supported platform: any MCP client on macOS, Linux, or Windows with Python 3.12+.

Tools

Category	Tools	What you can do
Zones	2	List zones (domains) visible to the token, fetch one by ID
DNS Records	5	List/filter, fetch, create, update, and delete DNS records within a zone

Tool	Description
`list_zones`	List zones visible to this API token, optionally filtered by name/status
`get_zone`	Fetch one zone's details by zone ID
`list_dns_records`	List DNS records in a zone, optionally filtered by type/name/content
`get_dns_record`	Fetch one DNS record's details by record ID
`create_dns_record`	Create a DNS record (A, AAAA, CNAME, MX, TXT, NS, CAA, SRV, etc.)
`update_dns_record`	Partially update an existing DNS record — only the fields you pass change
`delete_dns_record`	Delete a DNS record (irreversible)

Requirements

Requirement	Version
Python	3.12 or later
uv	any recent version
Cloudflare account	with at least one zone (domain) added
Cloudflare API token	scoped, created via the dashboard (see below)

Authentication

Cloudflare API tokens are simple bearer credentials — no OAuth flow, no refresh step. Setup:

Go to dash.cloudflare.com/profile/api-tokens and click Create Token.
Choose Create Custom Token.
Under Permissions, add:
- Zone → Zone → Read
- Zone → DNS → Edit
Under Zone Resources, scope it to Specific zone and pick the domain(s) this server should be able to touch — avoid "All zones" unless you actually need it. This is the principle of least privilege: a leaked token scoped to one zone can't touch the rest of the account.
Click Continue to summary, then Create Token. Copy it immediately — Cloudflare shows it once.
Put it in .env (see Installation).

CLOUDFLARE_ACCOUNT_ID is optional — only needed if the token has access to more than one Cloudflare account and you want list_zones scoped to a specific one. Find it on the right sidebar of any domain's Overview page in the dashboard.

If the token is ever exposed, revoke it from the same API Tokens page — this immediately invalidates it account-wide.

Installation

git clone https://github.com/jimsimoy/cloudflare-mcp.git
cd cloudflare-mcp
uv sync
cp .env.example .env   # fill in CLOUDFLARE_API_TOKEN (and CLOUDFLARE_ACCOUNT_ID if needed)

Run directly:

uv run cloudflare-mcp

Client Setup

{
  "mcpServers": {
    "cloudflare": {
      "command": "uv",
      "args": ["--directory", "/path/to/cloudflare-mcp", "run", "cloudflare-mcp"],
      "env": {
        "CLOUDFLARE_API_TOKEN": "...",
        "CLOUDFLARE_ACCOUNT_ID": "..."
      }
    }
  }
}

Restart your MCP client after saving. The 7 Cloudflare tools will appear automatically.

Usage Examples

See what's in the account

List my Cloudflare zones, then list the DNS records for the first one

Point a subdomain at a new IP

Create an A record for api.example.com pointing to 203.0.113.10 in zone
<zone_id>, not proxied, TTL automatic

Update an existing record

Update DNS record <record_id> in zone <zone_id> to change its content to
203.0.113.20

Clean up a stale record

Delete DNS record <record_id> from zone <zone_id>

Security

The credential (CLOUDFLARE_API_TOKEN) is read from the environment only — .env and .env.* (except .env.example) are gitignored.
A Cloudflare API token is a long-lived credential. Scope it to specific zones and only the permissions listed above; treat it like a password and revoke it at dash.cloudflare.com/profile/api-tokens if it's ever exposed.
create_dns_record, update_dns_record, and delete_dns_record make real changes to live DNS — a wrong delete_dns_record call can take a subdomain offline. There's no confirmation step in the server itself; that judgment call belongs to whatever is driving the MCP client.
Cache purging, zone settings (SSL mode, security level, page rules, etc.), and anything outside zones/DNS are out of scope for this server by design — see What is this?.

Project Structure

src/cloudflare_mcp/
  server.py  # MCP server entry point and tool definitions
  client.py  # Cloudflare API client (bearer auth, pagination, error unwrapping)
  config.py  # Credential loading from the environment

The server communicates over stdio using JSON-RPC 2.0, the standard MCP transport.

A note on testing

This was built directly from Cloudflare's official REST API v4 reference (zone and DNS record endpoints, request/response shapes, and the success/errors/result/result_info envelope), with pagination and error handling covered by manual verification of the client against that reference. It has not been exercised against a live Cloudflare account — no API token was available in this environment at build time. Before relying on it, run it against a real account starting with the read-only tools (list_zones, list_dns_records) and confirm the shapes match what you expect before trying create_dns_record / update_dns_record / delete_dns_record.

License

MIT — free to use, modify, and distribute.

Report a Bug · Request a Feature

cloudflare-mcp