README.md
Slim Cloudflare MCP Server for managing DNS, zones, tunnels, WAF, and security.
mcp-cloudflare
Slim Cloudflare MCP Server for managing DNS, zones, tunnels, WAF, Zero Trust, and security via Cloudflare API v4.
No SSH. No shell execution. API-only. 3 runtime dependencies.
Features
75 tools across 11 domains:
- DNS — Record management (A, AAAA, CNAME, MX, TXT, SRV, CAA, NS), batch operations
- Zones — Zone listing, settings, SSL/TLS configuration, cache management
- Tunnels — Cloudflare Tunnel creation, configuration, and ingress management
- WAF — Ruleset management, custom firewall rules, rate limiting
- Zero Trust — Access application CRUD (create/delete), policies (create/delete), identity providers (create/delete), Gateway status
- Security — Security event analytics, IP access rules, DDoS configuration, Security Center insights
- Workers KV — Namespace management, key-value read/write/delete, key listing
- Workers — Script deployment, route management
- Worker Secrets — Secret management (names only, values never exposed)
- Worker Analytics — Invocation metrics, CPU time, error rates via GraphQL
- R2 Storage — Bucket management, object listing and metadata, custom domains, location hints
Quick Start
npm install
cp .env.example .env # Edit with your Cloudflare API token
npm run build
node dist/index.js # stdio transport for MCP
Claude Code Integration
Add to .mcp.json in your project root:
{
"mcpServers": {
"cloudflare": {
"command": "node",
"args": ["/path/to/mcp-cloudflare/dist/index.js"],
"env": {
"CLOUDFLARE_API_TOKEN": "your-api-token-here",
"CLOUDFLARE_ACCOUNT_ID": "your-account-id"
}
}
}
}
Configuration
| Variable | Required | Default | Description |
|---|---|---|---|
CLOUDFLARE_API_TOKEN |
Yes | — | Cloudflare API Token (with appropriate permissions) |
CLOUDFLARE_ACCOUNT_ID |
No | — | Cloudflare Account ID (required for account-level operations) |
CLOUDFLARE_TIMEOUT |
No | 30000 |
Request timeout in milliseconds |
API Token Permissions
Create an API Token at dash.cloudflare.com/profile/api-tokens with the following permissions based on what you need:
- DNS: Zone > DNS > Edit
- Zone settings: Zone > Zone Settings > Edit
- Cache purge: Zone > Cache Purge > Edit
- Tunnels: Account > Cloudflare Tunnel > Edit
- WAF: Zone > Firewall Services > Edit
- Zero Trust: Account > Access: Apps and Policies > Edit
- Security events: Zone > Analytics > Read
- Workers KV: Account > Workers KV Storage > Edit
- Workers: Account > Worker Scripts > Edit
- R2: Account > R2 Storage > Edit
Multi-Zone Support
All zone-scoped tools accept a zone_id parameter that can be either:
- A 32-character hex zone ID (e.g.,
00000000000000000000000000000001) — used directly - A zone name / domain (e.g.,
example.com) — resolved automatically via the Cloudflare API
This allows managing multiple zones by name without needing to look up IDs manually.
Tools
Tools documentation is coming in v1 as tool modules are implemented. See docs/api-reference.md for the planned API endpoint mapping.
Skills
Claude Code skills compose MCP tools into higher-level workflows. See `.claude/skills/README.md` for detailed documentation.
| Skill | Slash Command | Description |
|---|---|---|
| cloudflare-health | /cf-health |
Zone health dashboard — DNS, security, tunnels, WAF, DDoS status |
| cloudflare-live-test | /cf-test |
Live integration test — read + safe writes with cleanup |
| cloudflare-dns-management | — | DNS record management — add, list, update, delete across zones |
| cloudflare-incident-response | — | DDoS/attack emergency response — detect, assess, mitigate, monitor |
| cloudflare-security-audit | — | Security postur |
Environment Variables
CLOUDFLARE_API_TOKENrequiredCloudflare API Token (with appropriate permissions)CLOUDFLARE_ACCOUNT_IDCloudflare Account ID (required for account-level operations)CLOUDFLARE_TIMEOUTRequest timeout in millisecondsConfiguration
claude_desktop_config.json
{
"mcpServers": {
"cloudflare": {
"command": "node",
"args": ["/path/to/mcp-cloudflare/dist/index.js"],
"env": {
"CLOUDFLARE_API_TOKEN": "your-api-token-here",
"CLOUDFLARE_ACCOUNT_ID": "your-account-id"
}
}
}
}Try it
→List all DNS records for example.com and identify any missing A records.
→Create a new Cloudflare Tunnel for my local development server.
→Check the current security event analytics for my zone.
→Update the WAF rules to block traffic from a specific suspicious IP range.
→Deploy a new worker script and configure its route.