Labsco
MCP SERVER · OFFICIAL PROJECT

Cloudflare API MCP Server

by cloudflare ↗

Describe what you want done in your Cloudflare account — a DNS record, a list of what is running, your traffic figures — and the agent finds the right API call and makes it.

Cloud Services✓ Popular vendor Official

This server also ships inside Cloudflare Skills — a plugin that installs it already configured.

LABSCO SUMMARY

An agent can work the whole Cloudflare account, not one product at a time.

What it takes off you is finding the call: you say what you want — add a DNS record, list what is running, pull the traffic figures — and it locates that operation in Cloudflare's API and runs it. execute works against the live account, so the permission set you pick on the authorization page is what decides how far the agent reaches; search and docs only read.

What it is

Cloudflare runs this one, so there is no server for you to install — you point your client at it and authorize over OAuth. Behind that one endpoint sits the entire Cloudflare API, over 2,500 endpoints across DNS, Workers, R2, Zero Trust and every other product, reached through two tools rather than one tool per endpoint: the agent writes JavaScript to find the operation it needs, then to run it. Cloudflare's other option is a set of narrower servers, one per product; this is the one that reaches everything.

What you get

  • The right API call found before anything is called: search runs the agent's code against Cloudflare's own API specification and hands back only the operations, parameters and schemas the task needs
  • The call then made against the live account: execute runs the agent's code with an authenticated request function, which covers reading configuration and changing it — creating and deleting real resources included
  • Cloudflare's GraphQL Analytics queries through the same tool, recognised and passed through by execute without a separate connection
  • Cloudflare's developer documentation searched from inside the same connection, touching no account data — docs
  • One connection covering DNS, Workers, R2, Zero Trust and the rest of the product line, instead of one connection per product
  • The generated JavaScript executed on Cloudflare's side, in an isolated Worker sandbox — nothing runs on your machine
  • A second way in for automation: a Cloudflare API token, user or account, sent as an Authorization bearer header instead of the browser flow

Requirements

A Cloudflare account, and an MCP client that can reach a remote endpoint. There is no key to paste on the normal path: the first connection opens Cloudflare's authorization page in your browser, where you choose what the agent may reach — Read only, Full access, or a Custom set with permissions switched on and off individually — and scope the grant to a single account. Cloudflare's own walkthrough is explicit about which account to point it at: use a demo account, because Full access lets the agent create and delete real resources.

Setup effort

Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen