In-depth architectural comparison of the Cloudflare MCP Pro and MCP Pfsense MCP servers. Compare execution transports, security boundaries, tool capabilities, quality scores, and ready-to-paste client installation snippets for Claude, Cursor, Windsurf, and VS Code.
At a Glance & Executive Verdict
Cloudflare MCP Pro
Cloud Platforms · Local stdio
Quality: 60/100 (Good) | Auth: API Key required
MCP Pfsense
Cloud Platforms · Local stdio
Quality: 61/100 (Good) | Auth: other
Verdict Summary: Choose Cloudflare MCP Pro if you need specialized Cloud Platforms tools running via a local process. Choose MCP Pfsense if your workspace requires Cloud Platforms integration with local subprocess execution. Both servers can be configured concurrently in your client's mcpServers manifest.
Which MCP Server Should You Choose?
Choose Cloudflare MCP Pro when:
You need dedicated capabilities in the Cloud Platforms domain.
You prefer local stdio subprocess transport architecture.
Your security boundary fits: API Key required (BYOK (Pay Provider Direct)).
You have access to required keys: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_BASE.
The most complete Cloudflare MCP — 69 tools over the REST API v4 (DNS, Zones, Workers, KV, R2, D1, Pages, WAF, SSL, Email Routing, Logpush, Workers AI) in a single local stdio server, with a server-side human-approval gate on every mutation. npx -y cloudflare-mcp-pro.
Manage pfSense firewalls through AI assistants — firewall rules, DHCP leases/reservations, DNS overrides, gateway monitoring, ARP table, and service management. 17 tools with two-step confirmation for destructive operations.
Category & Scope
Tools & Capabilities Breakdown
Cloudflare MCP Pro Tools (69)
verify_token
Validate the configured Cloudflare API token and show its status/permissions.
list_accounts
List Cloudflare accounts accessible by the token.
list_zones
List zones (domains), optionally filtered by name or status.
get_zone
Get details of a single zone by ID.
create_zone
Add a new domain (zone) to an account. Requires confirm:true (human-approval gate); without it returns a preview only.
delete_zone
Delete a zone by ID. Requires confirm:true (human-approval gate); without it returns a preview only.
Ready-to-Paste Client Configurations
Paste either (or both) of these JSON server blocks into your client config file (e.g. claude_desktop_config.json or ~/.cursor/mcp.json).
Cloudflare MCP Pro is categorized under Cloud Platforms and uses a local stdio subprocess. In contrast, MCP Pfsense belongs to Cloud Platforms using local stdio subprocess. Select Cloudflare MCP Pro when you need capabilities focused on cloud platforms and MCP Pfsense when you require tools for cloud platforms.
Purge a zone's cache — everything, or by files/tags/hosts/prefixes. Requires confirm:true (human-approval gate); without it returns a preview only.
get_zone_analytics
Get HTTP traffic analytics for a zone over a time range (via GraphQL).
get_zone_setting
Get a single zone setting (e.g. ssl, always_use_https, min_tls_version).
update_zone_setting
Update a single zone setting (e.g. set ssl=full, always_use_https=on). Requires confirm:true (human-approval gate); without it returns a preview only.
list_dns_records
List DNS records of a zone, optionally filtered by type/name.
create_dns_record
Create a DNS record (A, AAAA, CNAME, TXT, MX, etc). Requires confirm:true (human-approval gate); without it returns a preview only.
+57 more tools listed on main page
MCP Pfsense Tools (19)
get_system_status
Get pfSense system status including version, CPU, memory, uptime, and temperature.
get_interfaces
List all network interfaces with status and configuration.
list_firewall_rules
List firewall rules, optionally filtered by interface.
add_firewall_rule
Add a firewall rule. Type is 'pass', 'block', or 'reject'.
The rule is staged (not active) until apply_changes('firewall') is called
or apply=true is passed here.
delete_firewall_rule
Delete a firewall rule by its ID (the `id` from list_firewall_rules). Requires confirm=true.
Staged until apply_changes('firewall') is called or apply=true is passed.
list_firewall_aliases
List firewall aliases (IP groups, port groups, URL lists).
list_dhcp_leases
List active DHCP leases showing IP, MAC, hostname, and lease times.
list_dhcp_static_mappings
List DHCP static mappings (IP reservations), optionally filtered by interface.
Each mapping carries `parent_id` (its DHCP server / interface) — pass that as
`interface` to delete_dhcp_static_mapping.
add_dhcp_static_mapping
Create a DHCP static mapping (IP reservation) for a MAC address.
Staged until apply_changes('dhcp') is called or apply=true is passed.
delete_dhcp_static_mapping
Delete a DHCP static mapping. Requires confirm=true.
`interface` is the mapping's DHCP server — the `parent_id` value returned by
list_dhcp_static_mappings; `mapping_id` is its `id` there. Staged until
apply_changes('dhcp') is called or apply=true is passed.
list_dns_host_overrides
List DNS Resolver host overrides (local DNS entries).
add_dns_host_override
Create a DNS host override entry in Unbound DNS Resolver.
Staged until apply_changes('dns') is called or apply=true is passed.