Is Cloudflare Mcp safe to use?

Cloudflare Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.

How do I install Cloudflare Mcp?

Cloudflare Mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What can Cloudflare Mcp do?

Cloudflare Mcp provides 2 tools: search, execute. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Cloudflare Mcp?

Cloudflare Mcp is compatible with claude-desktop, cursor, claude-code. It uses sse and http transport.

Is Cloudflare Mcp actively maintained?

Cloudflare Mcp is less actively maintained — last commit was 167 days ago. It has 128 GitHub stars.

Cloudflare Mcp

Name: Cloudflare Mcp
Author: mattzcarey

by mattzcarey

unofficial mcp server for cloudflare api

128 2 tools GitHub

No known CVEs

Apache-2.0 license

Maintained

Last commit 167d ago

Works with most clients

Transport: sse, http

2 tools · ~185 tok

Grade A · 0.1% of 200K ctx

Edit this pageView history

Cloud

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopsse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "cloudflare-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/cloudflare-mcp)](https://mcppedia.org/s/cloudflare-mcp)

Read me

What Cloudflare Mcp does

A smol MCP server for the complete Cloudflare API.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (2)

Click any tool to inspect its schema.

~185 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Cloudflare Mcp safe to use?: Cloudflare Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install Cloudflare Mcp?: Cloudflare Mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What can Cloudflare Mcp do?: Cloudflare Mcp provides 2 tools: search, execute. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Cloudflare Mcp?: Cloudflare Mcp is compatible with claude-desktop, cursor, claude-code. It uses sse and http transport.
Is Cloudflare Mcp actively maintained?: Cloudflare Mcp is less actively maintained — last commit was 167 days ago. It has 128 GitHub stars.

Similar servers

Others in cloud

View all →

Sink95

⚡ A Simple / Speedy / Secure Link Shortener with Analytics, 100% run on Cloudflare.

6.9k 3

Observability Mcp94

MCP Server for GCP environment for interacting with various Observability APIs.

846 10

Mcp Server Kubernetes92

MCP Server for kubernetes management commands

1.4k 22

Iam Policy Autopilot90

IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.

376 1

MCP Security Weekly

Get CVE alerts and security updates for Cloudflare Mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Cloud

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopsse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "cloudflare-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/cloudflare-mcp)](https://mcppedia.org/s/cloudflare-mcp)

Read me

What Cloudflare Mcp does

A smol MCP server for the complete Cloudflare API.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

cloudflare-mcp

A smol MCP server for the complete Cloudflare API.

Uses codemode to avoid dumping too much context to your agent.

Get Started

Create API Token

Create a Cloudflare API token with the permissions you need.

Both user tokens and account tokens are supported:

Token Type	Description	Requirements
User Token	Created at user level, can access multiple accounts	Requires `account_id` parameter on each execute call
Account Token	Scoped to single account	`account_id` auto-detected, no parameter needed

For account tokens, include the Account Resources : Read permission so the server can auto-detect your account ID.

Add to Agent

MCP URL: https://cloudflare-mcp.mattzcarey.workers.dev/mcp Bearer Token: Your Cloudflare API Token

Claude Code

CLI

export CLOUDFLARE_API_TOKEN="your-token-here"

claude mcp add --transport http cloudflare-api https://cloudflare-mcp.mattzcarey.workers.dev/mcp \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

OpenCode

opencode.json

Set your API token as an environment variable:

export CLOUDFLARE_API_TOKEN="your-token-here"

Then add to your opencode.json:

{
  "mcp": {
    "cloudflare-api": {
      "type": "remote",
      "url": "https://cloudflare-mcp.mattzcarey.workers.dev/mcp",
      "headers": {
        "Authorization": "Bearer {env:CLOUDFLARE_API_TOKEN}"
      }
    }
  }
}

The Problem

The Cloudflare OpenAPI spec is 2.3 million tokens in JSON format. Even compressed to TypeScript endpoint summaries, it's still ~50k tokens. Traditional MCP servers that expose every endpoint as a tool, or include the full spec in tool descriptions, leak this entire context to the main agent.

This server solves the problem by using code execution in a codemode pattern - the spec lives on the server, and only the results of queries are returned to the agent.

Tools

Two tools where the agent writes code to search the spec and execute API calls. Akin to ACI.dev's MCP server but with added codemode.

Tool	Description
`search`	Write JavaScript to query `spec.paths` and find endpoints
`execute`	Write JavaScript to call `cloudflare.request()` with the discovered endpoints

Token usage: Only search results and API responses are returned. The 6MB spec stays on the server.

Agent                         MCP Server
  │                               │
  ├──search({code: "..."})───────►│ Execute code against spec.json
  │◄──[matching endpoints]────────│
  │                               │
  ├──execute({code: "..."})──────►│ Execute code against Cloudflare API
  │◄──[API response]──────────────│

Supported Products

Workers, KV, R2, D1, Pages, DNS, Firewall, Load Balancers, Stream, Images, AI Gateway, Vectorize, Access, Gateway, and more. See the full Cloudflare API schemas.

Usage

Once configured, just ask your agent to do things with Cloudflare:

"List all my Workers"
"Create a KV namespace called 'my-cache'"
"Add an A record for api.example.com pointing to 192.0.2.1"

The agent will search for the right endpoints and execute the API calls. Here's what happens behind the scenes:

// 1. Search for endpoints
search({
  code: `async 

... [View full README on GitHub](https://github.com/mattzcarey/cloudflare-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Inventory

Tools (2)

Click any tool to inspect its schema.

~185 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Cloudflare Mcp safe to use?: Cloudflare Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install Cloudflare Mcp?: Cloudflare Mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What can Cloudflare Mcp do?: Cloudflare Mcp provides 2 tools: search, execute. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Cloudflare Mcp?: Cloudflare Mcp is compatible with claude-desktop, cursor, claude-code. It uses sse and http transport.
Is Cloudflare Mcp actively maintained?: Cloudflare Mcp is less actively maintained — last commit was 167 days ago. It has 128 GitHub stars.