# MCP Cloudflare [Health: Active]

**Category:** ☁️ Cloud Platforms  
**Repository:** https://github.com/crunchtools/mcp-cloudflare  
**GitHub Stars:** 0  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcp-cloudflare

## Description
Secure MCP server for Cloudflare DNS, Transform Rules, and Page Rules

## Tools
Capabilities this server exposes over MCP:

- **list_zones_tool** — List all Cloudflare zones accessible by the API token.
- **get_zone_tool** — Get Cloudflare zone details by ID or name.

Provide either zone_id or zone_name, not both.
- **list_dns_records_tool** — List DNS records for a Cloudflare zone.
- **get_dns_record_tool** — Get a single DNS record by ID.
- **create_dns_record_tool** — Create a new DNS record.
- **update_dns_record_tool** — Update an existing DNS record.
- **delete_dns_record_tool** — Delete a DNS record.
- **list_request_header_rules_tool** — List request header modification rules.
- **set_request_header_rules_tool** — Set request header modification rules (replaces all existing rules).

Each rule should have:
- expression: Filter expression (e.g., "true" for all requests)
- description: Human-readable description
- action: "rewrite"
- action_parameters: {"headers": {"Header-Name": {...}}}
- **list_response_header_rules_tool** — List response header modification rules.
- **set_response_header_rules_tool** — Set response header modification rules (replaces all existing rules).

Each rule should have:
- expression: Filter expression (e.g., "true" for all responses)
- description: Human-readable description
- action: "rewrite"
- action_parameters: {"headers": {"Header-Name": {...}}}
- **list_url_rewrite_rules_tool** — List URL rewrite rules.
- **set_url_rewrite_rules_tool** — Set URL rewrite rules (replaces all existing rules).

Each rule should have:
- expression: Filter expression
- description: Human-readable description
- action: "rewrite"
- action_parameters: {"uri": {"path": {"value": "..."}, "query": {"value": "..."}}}
- **list_page_rules_tool** — List all page rules for a zone.
- **create_page_rule_tool** — Create a new page rule.
- **update_page_rule_tool** — Update an existing page rule.
- **delete_page_rule_tool** — Delete a page rule.
- **purge_cache_tool** — Purge cached content from Cloudflare's edge.

Use one of: purge_everything, files, tags, hosts, or prefixes.
Every method works on every plan, Free included. Prefer hosts, prefixes,
tags or files over purge_everything when only part of a zone is stale.
- **get_zone_analytics_tool** — Get zone traffic analytics summary.

Returns total requests, unique visitors, bandwidth, cache ratio,
and status code breakdown for the given date range.

Provide either zone_id or zone_name, not both.
- **get_top_pages_tool** — Get top pages by request count.

Provide either zone_id or zone_name, not both.
- **get_traffic_by_country_tool** — Get traffic breakdown by country.

Provide either zone_id or zone_name, not both.
- **get_security_events_tool** — Get security/firewall events grouped by action and source.

Provide either zone_id or zone_name, not both.
- **list_waf_rules_tool** — List all WAF custom rules for a zone.

Provide either zone_id or zone_name, not both.
- **create_waf_rule_tool** — Create a new WAF custom rule.

Free plans support up to 5 custom rules.
Provide either zone_id or zone_name, not both.
- **update_waf_rule_tool** — Update an existing WAF custom rule.

Provide either zone_id or zone_name, not both.
- **delete_waf_rule_tool** — Delete a WAF custom rule.

Provide either zone_id or zone_name, not both.
- **get_access_organization_tool** — Get the Zero Trust organization behind a zone's Access applications.
- **list_access_apps_tool** — List the Access applications on a zone.
- **get_access_app_tool** — Get one Access application, including its audience tag (aud).
- **create_access_app_tool** — Put a hostname behind a Cloudflare Access login.

A new application has no policy and admits no one until
create_access_policy adds one.
- **delete_access_app_tool** — Delete an Access application, leaving its hostname with no Access login.
- **list_access_policies_tool** — List the policies on an Access application.
- **create_access_policy_tool** — Add a policy to an Access application.

Each rule is an object with exactly one key:
{"email": "user@example.com"}, {"email_domain": "example.com"},
{"ip": "203.0.113.0/24"} or {"everyone": true}.
- **delete_access_policy_tool** — Delete a policy from an Access application.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "mcp-cloudflare": {
    "command": "uvx",
    "args": ["mcp-cloudflare-crunchtools"],
    "env": {
      "CLOUDFLARE_API_TOKEN": ""
    }
  }
}
```

**Requires environment variables:** `CLOUDFLARE_API_TOKEN` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What MCP Cloudflare does

The MCP Cloudflare MCP server exposes Cloudflare account and zone operations as MCP tools. It can list accessible zones and retrieve a zone by ID or domain name. For DNS, it supports listing and filtering records, retrieving individual records, and creating, updating, or deleting A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA records.

The server also manages three groups of Cloudflare rules. Transform Rule tools cover request-header changes, response-header changes, and URL path or query rewrites. Page Rule tools list, create, update, and delete rules for functions such as redirects, cache settings, and SSL modes. A cache tool can purge by URL, tag, host, prefix, or all cached content.

## How it works

The MCP Cloudflare MCP server communicates with an MCP client through local standard input and output. The client starts the Python command or container, and the server sends Cloudflare API requests using the token provided in `CLOUDFLARE_API_TOKEN`. The documented container image is `quay.io/crunchtools/mcp-cloudflare`.

Its security controls include environment-only token handling, secret-type storage, removal of tokens from errors, Pydantic input models, allowlisted record types and actions, strict identifier validation, a fixed Cloudflare API endpoint, TLS verification, request timeouts, and response-size limits. It is intended to run on Linux, macOS, and Windows.

## Setup and configuration

Install with `uvx mcp-cloudflare-crunchtools` or install the `mcp-cloudflare-crunchtools` package with pip. A container deployment can pass the token to Podman and use the published image. The server requires a Cloudflare API token; the repository documents separate permission sets for read-only access, DNS-only administration, and full management.

For full feature access, the token needs zone read permission, DNS edit permission, Page Rules edit permission, Transform Rules edit permission, and Cache Purge access for the relevant zones. The token can be limited to all zones or selected zones, and Cloudflare also provides optional client-IP filtering.

Claude Code can register the command with `claude mcp add`, passing the token as an environment value and launching either the `uvx` command or the container. The token is shown only when created in Cloudflare, so it should be copied at that point and supplied through the environment rather than a file or command argument.

## Tools and capabilities

The MCP Cloudflare MCP server provides 18 tools across five areas:

- Zone management: `list_zones` and `get_zone`.
- DNS records: list, get, create, update, and delete operations.
- Transform Rules: list and set tools for request headers, response headers, and URL rewrites.
- Page Rules: list, create, update, and delete operations.
- Cache management: `purge_cache` with URL, tag, host, prefix, or full-cache targets.

The tool inputs are validated before requests are sent. DNS creation supports the record types documented by the project, while rule tools apply to the specific request-header, response-header, URL-rewrite, and Page Rule operations exposed by the server.

## Limitations and notes

Operations are limited by the permissions and zone scope of the supplied Cloudflare token. A read-only token cannot perform DNS, rule, or purge mutations. The server is designed for local stdio use; the material does not describe a hosted deployment or third-party service relay. The project also publishes a container image and uses an AGPL-3.0-or-later license.

The repository describes automated dependency and CVE monitoring, but those checks do not replace careful token scoping. Grant only the Cloudflare permissions required for the agent's tasks.

_Full upstream README: https://allmcps.com/mcp/mcp-cloudflare/readme_