"cloudflare" matching MCP tools:

• get_cloudflare_connectionA

  Porkbun (official)A

  Check whether this Porkbun account is connected to a Cloudflare account, and which one. THIS IS THE POLL TARGET for the connect flow. Connecting is a HUMAN action: Cloudflare's consent screen must be completed in a browser and the authorization is bound to the Porkbun web session that starts it, so it cannot be driven over the API. When `connected` is false the response includes a `connectUrl` — show that URL to the user, ask them to authorize, then call this tool again every few seconds until `connected` is true. Everything else in the Cloudflare flow is fully automatable once this is true.

  ConnectorOAuth

• uichemy_deploy_to_cloudflareA

  UiChemy AI Website CreatorB

  Put a project ONLINE on the user's OWN Cloudflare account (a Cloudflare Worker at https://<name>.<their-subdomain>.workers.dev), built as a static site from the same pages as the Astro export. This is PUBLIC: only call it when the user asks to deploy or publish to Cloudflare, and tell them the address. The first time, the account is not connected yet: this returns a link the user must open to approve UiChemy on Cloudflare; after they have, call this again. If their Cloudflare login has several accounts, this lists them: ask which one and pass its `accountId`. Calling it again for a deployed project UPDATES the same site (its pages are replaced with the current design). Every deploy is a numbered version; uichemy_site_versions lists them and uichemy_restore_site_version puts an earlier one back online. Only generated pages are deployed.

  Connector

  Destructive

  OAuth

• uichemy_publish_emdashA

  UiChemy AI Website CreatorB

  Put a project ONLINE as an Astro site WITH the EmDash CMS on the user's OWN Cloudflare account (a Worker at https://<name>.<their-subdomain>.workers.dev, plus a D1 database and login storage in their account). The site's pages, sections and blog posts become editable content in its admin at /_emdash/admin. This is PUBLIC: only call it when the user asks to publish, deploy or go live with EmDash or a CMS on Cloudflare, and tell them the address. The first time, the account is not connected: this returns a link the user must open to approve UiChemy on Cloudflare; after they have, call this again. If their Cloudflare login has several accounts, this lists them: ask which one and pass its `accountId`. Calling it again for a published project UPDATES the same site and keeps its CMS content and users. After the FIRST publish the CMS is locked behind a one-time setup link: give it to the user. Publishing takes about a minute; this waits up to 40 seconds, then returns a jobId for uichemy_emdash_status. Only generated pages are published. For a plain static site without a CMS use uichemy_deploy_to_cloudflare.

  Connector

  Destructive

  OAuth

• connections_cloudflare_deploy_ticketA

  ConnectionsB

  Use this when you must deploy to Cloudflare (wrangler deploy, upload a website to Cloudflare, publish a Worker with static assets, push a Pages build) and this chat has only the remote Connections MCP, no local tools. When the vault holds the Cloudflare account, NEVER ask the human for a Cloudflare or wrangler sign-in (wrangler login, a browser Allow click, an API token): Connections deploys with the vaulted credential and the chat never sees it. Mints a ONE-TIME deploy ticket bound to one account + one Worker script (or one Pages project): single use, expires in minutes (default 10, at most 15), grants nothing else. Reply: a URL and a curl recipe. Build the site, then POST the JSON bundle (modules, static assets, wrangler.jsonc text, bindings) to that URL with curl; Connections creates or updates the Worker server-side, inherits its existing bindings, and answers with the live workers.dev URL. Find accountId with connections_accounts { service: 'cloudflare' }. About 5 MB of base64 per ticket. With local tools use the local cloudflare_deploy tool instead (one call, reads wrangler.jsonc from disk).

  Connector

  Destructive

  OAuth

• uichemy_restore_site_versionA

  UiChemy AI Website CreatorB

  Put an earlier version of a project's static site on the user's own Cloudflare back ONLINE (PUBLIC): Cloudflare serves that version again within a minute, with no rebuild, and it is recorded as a new version ("restored version N"). Only the person who published the site can. The project's design in UiChemy is NOT changed, so the next publish (uichemy_deploy_to_cloudflare) puts the current design back online. Get the number from uichemy_site_versions, and confirm with the user first, naming the version and the address. Not for EmDash (CMS) sites.

  Connector

  Destructive

  OAuth

• check_custom_domainA

  shiplyA

  Check whether a custom domain's subdomains are live: re-polls Cloudflare cert status + probes DNS/TLS/HTTPS on each subdomain. Poll this after connect_provider / add_subdomain to confirm the domain is serving. Returns per-subdomain status + tls + http + ready.

  ConnectorNo auth

• get_cloudflare_recordsA

  Porkbun (official)A

  List a domain's LIVE DNS records as Cloudflare holds them, each with its orange-cloud (`proxied`) state and whether it is `proxiable` at all. Once a domain has moved to Cloudflare THIS is the authoritative record set — list_dns_records reads the Porkbun zone, which is no longer answering queries for it. Returns ZONE_NOT_READY if the zone does not exist yet.

  ConnectorOAuth

• delete_cloudflare_dns_recordA

  AnkraB

  Delete a DNS record from one of the organisation's Cloudflare domains. The record belongs to the customer and lives in their own Cloudflare account: Ankra cannot restore it, and removing a record that live traffic depends on takes the hostname down immediately. Always read the record with list_cloudflare_dns_records and show the user exactly which record (name, type and content) will be removed before calling. Deleting a record Ankra did not create (managed_by 'external') is especially worth confirming - something outside Ankra put it there.

  Connector

  Destructive

  OAuth

• read_pdfA

  x402 Web ToolsA

  Fetch a public PDF (max 10 MB) and convert it to Markdown with Cloudflare Workers AI toMarkdown. Returns title (if detected), url, markdown, word_count. Same URL safety rules as read_url. Failed conversions are not charged. Costs $0.006 USDC per call via x402.

  ConnectorNo auth

• get_vendor_statusA

  Merlonix MonitoringA

  Get the current status plus 30-day status history of one monitored vendor by slug (e.g. "cloudflare"). Use list_vendor_status to discover valid slugs.

  ConnectorNo auth

• connect_domains_to_cloudflareA

  Porkbun (official)A

  Queue domains to move into the customer's own Cloudflare account: Porkbun creates the zone there, copies over the DNS records it holds, and repoints the registry nameservers at Cloudflare. ASYNCHRONOUS — a successful call means QUEUED, never connected; the work runs in the background over the next few minutes, so poll get_cloudflare_queue afterwards. Results are PER DOMAIN: each name comes back under `queued`, `skipped` or `alreadyQueued` with its own reason. A non-empty `skipped` is a NORMAL outcome (DNSSEC live, custom nameservers, already connected), NOT a failed call — report the reasons rather than calling the whole thing an error. Eligibility is re-checked right before each domain is acted on, so a queued domain can still be skipped later. Requires the Cloudflare account to be connected first (see get_cloudflare_connection). Use dry_run to preview verdicts without queueing. Max 500 domains per call.

  Connector

  Destructive

  OAuth

• set_cloudflare_zone_settingsA

  Porkbun (official)A

  Change Cloudflare zone settings for a moved domain. Only an allowlist is editable (ssl, always_use_https, automatic_https_rewrites, min_tls_version, development_mode, cache_level) — WAF/firewall/security controls are deliberately not exposed. Prefer ssl `full` over `flexible`: `flexible` makes Cloudflare fetch the origin over plain HTTP, a downgrade the visitor cannot see. CLOUDFLARE_REAUTHORIZE_REQUIRED means the stored authorization lacks this permission — surface the connectUrl and ask the customer to reconnect. Supports dry_run.

  Connector

  Destructive

  OAuth

• create_cloudflare_recordA

  Porkbun (official)A

  Create a DNS record in a domain's Cloudflare zone. IMPORTANT: for a domain that has been moved to Cloudflare this is the tool that changes what actually resolves — create_dns_record writes Porkbun's zone, which no longer answers for it. `name` accepts "@" for the apex or a bare label like "www". `ttl: 1` means Cloudflare-automatic. MX requires `priority`. `proxied` (orange cloud) applies to A/AAAA/CNAME only. Record types Cloudflare models as structured objects (SRV, CAA, …) need a `data` object instead of `content`. Supports dry_run.

  ConnectorOAuth

• list_registrar_connectionsA

  email-deliverabilityA

  List the registrar accounts (Cloudflare, Route 53, GoDaddy, Namecheap) connected to the org — provider, verification, last-used time — plus the supported providers. Use this to check whether the detect-and-fix loop (get_dns_fix_plan / apply_dns_fix) is available before attempting it.

  ConnectorNo auth

• drive_sandbox_execA

  AgentDriveB

  [EXPERIMENTAL] Run a shell command inside the per-workspace Linux sandbox. Captures stdout/stderr (64 KB cap), exit code, duration. Requires Cloudflare Containers; degrades to 503 otherwise.

  ConnectorNo auth

• drive_sandbox_readA

  AgentDriveB

  [EXPERIMENTAL] Read a file from the per-workspace sandbox filesystem (build artifacts, test output, logs). Requires Cloudflare Containers; degrades to 503 otherwise.

  ConnectorNo auth

• list_cloudflare_inventoryA

  Porkbun (official)A

  List every domain in the account with its Cloudflare eligibility: `state` is eligible / warn / blocked / connected / inprogress, each with a human-readable reason (DNSSEC live, custom nameservers, uses Porkbun hosting, etc). Read this BEFORE queueing so you can tell the user what will move and what won't. Works even when the Cloudflare account isn't connected yet, so you can plan while the user authorizes.

  ConnectorOAuth

• rollback_cloudflare_domainA

  Porkbun (official)A

  UNDO a completed Cloudflare move: point the domain's nameservers back at Porkbun, restoring the DNS Porkbun still holds. This changes authoritative DNS for a live domain, so confirm with the user first. The Cloudflare zone is deliberately LEFT IN PLACE — deleting a zone inside the customer's own Cloudflare account is their call. Fails if Porkbun never moved the domain, it is already back on Porkbun nameservers, or it is being worked on right now.

  Connector

  Destructive

  OAuth

• disconnect_cloudflareA

  Porkbun (official)A

  Remove this account's stored Cloudflare connection. Domains already moved stay on Cloudflare and keep resolving — this only stops Porkbun making further changes on the customer's behalf. Reconnecting requires the human browser authorization again, so confirm before calling.

  Connector

  Destructive

  OAuth

• delete_cloudflare_recordA

  Porkbun (official)A

  Delete a DNS record from a domain's Cloudflare zone. This changes live DNS for a domain Cloudflare is authoritative for, so confirm with the user first — deleting the wrong record can take a site or its mail offline. Get `record_id` from get_cloudflare_records. The record is read before deletion, so the response reports exactly what was removed. Supports dry_run.

  Connector

  Destructive

  OAuth

• list_cloudflare_domainsA

  AnkraB

  List the Cloudflare-hosted domains (zones) this organisation's connected Cloudflare credential can reach, with each domain's id, status and assigned nameservers. Call this first to resolve a domain name to the domain_id the DNS record tools take - pass 'name' when the user already named the domain, which resolves it in one lookup instead of a walk through every domain in the account. A domain whose status is not 'active' carries a warning: its nameservers are not live at Cloudflare yet, so records written into it will not resolve. If the organisation has connected no Cloudflare credential, this reports that and the user must connect one on the Credentials page. Read-only.

  ConnectorOAuth