What it is
Cloudflare's recommended MCP server, at https://mcp.cloudflare.com/mcp, covers the entire Cloudflare API with four tools: docs, search, execute and whoami. Instead of one tool per endpoint, the agent writes small JavaScript functions that search the OpenAPI spec and then call the API. Cloudflare calls this code mode, and the code runs in isolated Workers on Cloudflare's side.
The older product servers in the mcp-server-cloudflare repository are being wound down. Ten of them, including AI Gateway, Audit Logs, DNS Analytics, GraphQL, Observability, Radar and Workers Builds, are now listed as deprecated in favour of the API server. Docs, containers, Browser Run, Digital Experience Monitoring, CASB and the Cloudflare Blog keep their own servers. Every server now answers only at /mcp; the old /sse URLs return 410 Gone, although the official MCP registry entry still lists them.
Install
https://mcp.cloudflare.com/mcpOur review
Code mode is the reason to use this server, and Cloudflare's own numbers make the case. Exposing all 2,594 endpoints as tools would cost 1,170,523 tokens of schemas, or 244,047 with only required parameters, according to the README. The four code-mode tools cost about 1,100. The spec stays on the server, the agent searches it with JavaScript, and only the result of its code comes back, capped at about 6,000 tokens by default.
That design moves risk rather than removing it. A single execute call can loop over every zone or delete a Worker if the grant allows it, and the README describes no server-side read-only mode. OAuth lets you pick scopes on Cloudflare's consent screen, and API tokens can be cut down to read permissions, but API tokens with client IP address filtering are not supported, which rules out one control security teams commonly use. When a call fails for lack of scope, the server asks the client to re-authorise with that scope added, which is convenient and worth watching.
The practical ceiling is Cloudflare's API limit rather than the MCP layer. The limit is 1,200 requests per five minutes per user, shared with the dashboard and any other tokens, and breaching it blocks all API calls for five minutes. An agent writing a loop inside execute can burn through that faster than one making one tool call per request, so bulk jobs need batching.
The deprecations are the other thing to plan for. Teams that wired up the Observability or GraphQL servers last year are being moved to the API server, which can do the same work but asks more of the model: writing correct JavaScript against an OpenAPI spec is a harder task than filling in a typed tool, and smaller models fail at it more often.
Where it earns its place
A platform engineer managing 200 zones on Cloudflare
Audit DNS records and WAF settings across every zone and report drift
A read-only account token lets the agent write one execute function that pages through zones and returns a summary. At 1,200 requests per five minutes, a full sweep of 200 zones with several calls each needs to be spread over a few windows.
A two-person team shipping a SaaS app on Workers, D1 and R2
Create KV namespaces, bindings and DNS records from the coding agent instead of the dashboard
Connect over OAuth from Claude Code or Cursor and ask in plain language; the agent finds the endpoint and calls it. The server is free, but a write-scoped grant means a mistaken prompt can delete production resources.
A head of infrastructure deciding whether to let agents near production Cloudflare accounts
Set a policy for which credentials agents may use
The safe default is separate read-only tokens for analysis and short-lived OAuth grants for changes, reviewed by a person. Because IP-filtered tokens are not supported, network restrictions cannot be the main guard.
Before you commit
- Setup
- Add https://mcp.cloudflare.com/mcp as an HTTP server and sign in with OAuth, or pass a user or account API token as a bearer header for CI; account tokens need Account Resources Read so the server can find the account ID.
- Integrations
- Four tools in code mode (docs, search, execute, whoami); ?codemode=false registers one tool per endpoint instead, about 2,500 tools and roughly 244,000 tokens. Covers Workers, KV, R2, D1, Pages, DNS, firewall, AI Gateway, Vectorize, Access and the GraphQL Analytics API.
- Data and privacy
- Agent code runs in isolated Workers on Cloudflare and acts with whatever the OAuth grant or token allows, read and write. Results can include content from your account, such as log lines from public traffic, so treat them as untrusted input. No security advisories are published for the repository.
- Cost at scale
- The server is free. The bill is whatever the agent provisions, and the binding limit is 1,200 API requests per five minutes per user (GraphQL analytics capped at 320 per five minutes), with a five-minute block on breach.
- Limits
- Results are truncated at about 6,000 tokens unless you add ?truncateToolResult=false; some list endpoints return empty rather than refusing when a scope is missing, which the server now treats as a refusal.
What's good
- Whole Cloudflare API for about 1,100 tokens of tool definitions
- Hosted, with OAuth scopes chosen at sign-in or a bearer API token
- Results capped at about 6,000 tokens and kept as valid JSON
- Also serves Cloudflare's agent skills, synced every six hours
What's not
- execute can make any call the grant allows; no server-side read-only mode
- API tokens with IP address filtering are not supported
- Ten product servers deprecated, so older setups need migrating
- Code mode needs a model that writes reliable JavaScript
Best for
Teams running sites, Workers or DNS on Cloudflare who want an agent to inspect and change configuration.
Alternatives
Cloudflare MCP Server: common questions
- Is Cloudflare MCP Server worth it?
- A clever answer to MCP's context problem that hands an agent the whole Cloudflare API, which is exactly why the token you give it matters more than the server. We rate it 4.5 out of 5.
- How much does Cloudflare MCP Server cost?
- Free to connect. Calls act on your Cloudflare account and count against its API rate limits; products the agent touches bill as normal.
- What are the downsides of Cloudflare MCP Server?
- execute can make any call the grant allows; no server-side read-only mode; aPI tokens with IP address filtering are not supported; ten product servers deprecated, so older setups need migrating; code mode needs a model that writes reliable JavaScript.
- Who is Cloudflare MCP Server best for?
- Teams running sites, Workers or DNS on Cloudflare who want an agent to inspect and change configuration.
- How much does Cloudflare MCP Server cost for a team or in production?
- The server is free. The bill is whatever the agent provisions, and the binding limit is 1,200 API requests per five minutes per user (GraphQL analytics capped at 320 per five minutes), with a five-minute block on breach.
- Is Cloudflare MCP Server safe for company data?
- Agent code runs in isolated Workers on Cloudflare and acts with whatever the OAuth grant or token allows, read and write. Results can include content from your account, such as log lines from public traffic, so treat them as untrusted input. No security advisories are published for the repository.
- What are the best Cloudflare MCP Server alternatives?
- The closest alternatives we have reviewed are Vercel MCP, Netlify MCP Server and AWS MCP Server.
Answers checked Oct 22, 2026.
Make Cloudflare MCP Server? Show this rating on your site
