MCP Cloudflare CrunchTools

A secure MCP (Model Context Protocol) server for Cloudflare DNS, Transform Rules, Page Rules, and cache management.

Overview

This MCP server is designed to be:

• Secure by default - Comprehensive threat modeling, input validation, and token protection
• No third-party services - Runs locally via stdio, your API token never leaves your machine
• Cross-platform - Works on Linux, macOS, and Windows
• Automatically updated - GitHub Actions monitor for CVEs and update dependencies
• Containerized - Available at quay.io/crunchtools/mcp-cloudflare built on Hummingbird Python base image

Naming Convention

Why Hummingbird?

The container image is built on the Hummingbird Python base image from Project Hummingbird, which provides:

• Minimal CVE exposure - Hummingbird images are built with a minimal package set, dramatically reducing the attack surface compared to general-purpose images
• Regular updates - Security patches are applied promptly, keeping CVE counts low
• Optimized for Python - Pre-configured Python environment with uv package manager for fast, reproducible builds
• Production-ready - Designed for production workloads with proper signal handling and non-root user defaults

This means your MCP server runs in a hardened environment with fewer vulnerabilities than typical Python container images

Features

Zone Management (2 tools)

• list_zones - List all zones accessible by your API token
• get_zone - Get zone details by ID or domain name

DNS Records (5 tools)

• list_dns_records - List DNS records with filtering
• get_dns_record - Get a single DNS record
• create_dns_record - Create A, AAAA, CNAME, MX, TXT, NS, SRV, CAA records
• update_dns_record - Update existing records
• delete_dns_record - Delete records

Transform Rules (6 tools)

• list_request_header_rules / set_request_header_rules - Modify request headers
• list_response_header_rules / set_response_header_rules - Modify response headers
• list_url_rewrite_rules / set_url_rewrite_rules - URL path/query rewrites

Page Rules (4 tools)

• list_page_rules - List all page rules
• create_page_rule - Create redirects, cache settings, SSL modes
• update_page_rule - Modify existing rules
• delete_page_rule - Remove rules

Cache Management (1 tool)

• purge_cache - Purge by URL, tag, host, prefix, or everything

Installation

With uvx (Recommended)

uvx mcp-cloudflare-crunchtools

With pip

pip install mcp-cloudflare-crunchtools

With Container

podman run -e CLOUDFLARE_API_TOKEN=your_token \
    quay.io/crunchtools/mcp-cloudflare

Configuration

Creating a Cloudflare API Token

1. Navigate to API Tokens

   • Go to https://dash.cloudflare.com/profile/api-tokens
   • Click "Create Token"
   • Click "Get started" next to "Create Custom Token"

2. Configure Token Name

   • Enter: mcp-cloudflare-crunchtools

3. Configure Permissions

   The Permissions section has three dropdowns per row:

   • First dropdown: Resource type (Account or Zone)
   • Second dropdown: Specific permission category
   • Third dropdown: Access level (Read or Edit)

   Click "+ Add more" to add each permission row. For full management, add:

   Resource	Permission	Access
   Zone	Zone	Read
   Zone	DNS	Edit
   Zone	Page Rules	Edit
   Zone

... View full README on GitHub