Cloudflare MCP Server

Cloudflare API endpoints accessed with token-efficient code mode.

Data last scanned yesterday · Reviewed 3 weeks ago

28 1 dangerous tool3 tools★ 722TypeScriptApache-2.0

Overview

The Cloudflare MCP server provides a streamlined interface for interacting with the entire Cloudflare API ecosystem. By utilizing Code Mode, it manages access to over 2,500 API endpoints while maintaining a minimal token footprint of approximately 1,100 tokens. This approach significantly reduces the context window consumption compared to loading full OpenAPI specifications into your AI agent. Users can connect via OAuth for scoped permission management or authenticate using manual API tokens for CI/CD and automation scenarios. If your specific workflow requires direct endpoint mapping, the server also offers a non-code mode configuration that exposes individual API endpoints as distinct tools.

Our verdict

This server carries a high risk level with a security score of 58/100. A primary concern is that every installation defaults to full write access, as there is no read-only mode implemented. Furthermore, the repository is community-maintained rather than being supported by the official vendor. This tool is best suited for experienced developers who can carefully manage their API token permissions and understand the implications of providing broad access to their Cloudflare infrastructure.

Supports OAuth for secure, permission-scoped authentication
Extremely low token consumption via specialized Code Mode
Provides access to over 2,500 distinct Cloudflare API endpoints
Minimal supply-chain surface area with only four direct dependencies

Lacks a read-only mode, defaulting to full write access
Not maintained or officially supported by Cloudflare
API tokens with IP filtering enabled are currently unsupported

Setup

Claude Desktop

{
  "mcpServers": {
    "cloudflare-mcp": {
      "args": [
        "-y",
        "cloudflare-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
docs	Search Cloudflare developer documentation	low
search	Write JavaScript to query spec.paths and find endpoints	low
execute	Write JavaScript to call cloudflare.request() with the discovered endpoints	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What authentication methods does the server support?

You can use either OAuth via the server URL or a manually managed Cloudflare API token. OAuth is recommended for simplicity, while API tokens are supported for CI/CD or automated environments.

›Are there specific requirements for Cloudflare API tokens?

Yes, tokens must not have Client IP Address Filtering enabled. If you use an account token, you must include the 'Account Resources : Read' permission to allow the server to auto-detect your account ID.

›How can I disable Code Mode if necessary?

You can disable Code Mode by appending the '?codemode=false' query parameter to the MCP URL. Note that this increases token consumption significantly from approximately 1k to 244k tokens.

›What happens when Code Mode is disabled?

Each of the approximately 2,500 Cloudflare API endpoints is registered as an individual tool instead of using code execution. The 'docs' tool remains available, and path parameters like 'account_id' are auto-resolved where possible.