Cloudflare MCP Go README

cloudflare-mcp-go

An MCP (Model Context Protocol) server for the Cloudflare API v4, written in Go.

It lets any MCP client (Claude, and other MCP-compatible tools) inspect and investigate your Cloudflare account through natural language: zones, DNS, WAF and firewall rules, rate limits, HTTP request logs, Security Center insights, and threat intelligence. The server is read-focused and geared toward security triage and investigation workflows.

Quick start

Requires a Cloudflare API token and Go 1.25+.

Add it to Claude Code with a single command:

Terminal

claude mcp add cloudflare \
  -e CLOUDFLARE_API_TOKEN=your-api-token \
  -- go run github.com/M-Yamashita01/cloudflare-mcp-go@latest

That is all — no manual clone or build required. CLOUDFLARE_ACCOUNT_ID is optional and only needed by a few tools (accounts, audit logs, KV, intel).

Tools

117 read-only tools grouped by domain, plus optional write tools (marked below) that are registered only when CLOUDFLARE_MCP_ENABLE_WRITE=true.

Zones & DNS

Tool	Description
`list_zones`	List zones in your account (ID, name, status, plan).
`get_zone`	Get details of a specific zone.
`get_zone_settings`	Get a zone's configuration settings (SSL mode, min TLS, cache level, security level).
`purge_cache`	Purge a zone's cache: everything, or by file/tag/host/prefix (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`list_dns_records`	List DNS records for a zone (type, name, content, TTL, proxy status).
`get_dns_record`	Get a single DNS record by ID (type, name, content, TTL, proxy status, comment).
`get_dns_analytics`	DNS query analytics: query counts, response codes, query type distribution.
`get_dns_analytics_bytime`	DNS query analytics grouped by time interval (time-series).
`export_dns_records`	Export all DNS records for a zone as a BIND zone file.
`get_dns_record_usage`	DNS record usage counts for a zone (toward plan limits).
`get_dns_settings`	Get a zone's DNS settings (Foundation DNS, multi-provider, nameservers, zone mode).
`get_dnssec`	Get DNSSEC details for a zone (status, DS record, digest, key tag, algorithm).
`list_dnssec_zsk`	List DNSSEC Zone Signing Keys (ZSKs) for a zone (multi-signer DNSSEC).
`list_scanned_dns_records`	List DNS records discovered by a scan, pending review.
`create_dns_record`	Create a DNS record (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`update_dns_record`	Update a DNS record, partial fields (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`delete_dns_record`	Delete a DNS record by ID (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`overwrite_dns_record`	Overwrite (fully replace) a DNS record by ID (write; requires ).

Firewall, WAF & rate limiting

Tool	Description
`list_ip_access_rules`	IP access rules that block, challenge, or allow IPs, CIDRs, ASNs, or countries.
`create_ip_access_rule`	Create an IP access rule (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`update_ip_access_rule`	Update an IP access rule's mode/notes (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`delete_ip_access_rule`	Delete an IP access rule by ID (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`list_waf_managed_rulesets`	WAF managed rulesets entrypoint and which managed rulesets are enabled.
`list_firewall_rules`	Custom firewall rules with expressions, actions, and priorities.
`get_firewall_rule`	Full configuration of a specific firewall rule by ID.
`list_rulesets`	All rulesets for a zone (metadata only).
`get_ruleset`	A specific ruleset with all its rules.
`create_ruleset`	Create a ruleset (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`update_ruleset`	Update a ruleset's name/description/rules (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`delete_ruleset`	Delete a ruleset by ID (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`list_rate_limits`	Rate limiting rules: thresholds, match criteria, actions.
`get_rate_limit`	Full configuration of a specific rate limiting rule by ID.
`create_rate_limit`	Create a rate limit rule (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`update_rate_limit`	Update a rate limit rule (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`delete_rate_limit`	Delete a rate limit rule by ID (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).

Security events & logs

Tool	Description
`query_security_events`	Query security events via the GraphQL Analytics API for triage.
`get_log_by_rayid`	Look up an HTTP request log entry by Cloudflare Ray ID.
`list_received_logs`	Retrieve HTTP request logs for a time range (max 1h, data ≥5min old).
`list_log_fields`	List available HTTP request log fields.
`list_logpush_jobs`	List Logpush jobs for a zone (dataset, destination, enabled).
`get_logpush_job`	Get a specific Logpush job in a zone by ID.
`list_logpush_dataset_jobs`	List Logpush jobs for a specific dataset in a zone.
`list_logpush_dataset_fields`	List available Logpush fields for a dataset in a zone.
`list_instant_logs_jobs`	List Instant Logs (edge) jobs for a zone.
`get_log_retention_flag`	Get a zone's log retention flag.
`list_log_datasets`	List Logs Explorer datasets for a zone.
`list_available_log_datasets`	List available Logs Explorer datasets for a zone.
`get_log_dataset`	Get a Logs Explorer dataset for a zone by ID.
`query_logs_sql`	Run a Logs Explorer SQL query for a zone (GET).
`list_account_logpush_jobs`	List Logpush jobs for an account.
`get_account_logpush_job`	Get a specific Logpush job in an account by ID.
`list_account_logpush_dataset_jobs`	List Logpush jobs for a dataset in an account.
`list_account_logpush_dataset_fields`	List available Logpush fields for a dataset in an account.
`list_account_logpush_transformers`	List Logpush transformers for an account.
`get_account_logpush_transformer`	Get a Logpush transformer in an account by ID.
`get_account_logpush_transformer_content`

Security Center

Tool	Description
`list_security_insights`	Security Center insights with severity, type, and classification.
`list_account_security_insights`	Security Center insights for an account (account scope).
`get_account_insight_counts`	Account insight counts by dimension (class/severity/type).
`get_account_insights_audit_log`	Account Security Center insights audit log.
`get_account_partner_insight_count`	Account partner-provided insight count.
`get_account_recent_scans`	Recent Security Center scans for an account.
`get_account_issue_audit_log`	Audit log for an account Security Center insight.
`get_account_insight_context`	Context (affected resources) for an account insight.
`get_partner_integration_settings`	Partner integration settings for an account.
`list_partner_shadow_zones`	Partner-discovered shadow zones for an account.
`list_partner_shadow_zone_hosts`	Hosts in a partner-discovered shadow zone.
`get_account_security_center_state`	Security Center state for an account.
`get_zone_insights_audit_log`	Zone Security Center insights audit log.
`get_zone_partner_insight_count`	Zone partner-provided insight count.
`get_zone_recent_scans`	Recent Security Center scans for a zone.
`get_zone_issue_audit_log`	Audit log for a zone Security Center insight.
`list_zone_partner_shadow_hosts`	Partner-discovered shadow hosts for a zone.
`get_securitytxt`	Get a zone's security.txt configuration.
`update_account_insight_classification`	Update an account insight classification (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`dismiss_account_insight`

Threat intelligence

Tool	Description
`get_ip_intel`	Threat intelligence for an IP: geolocation, ASN, infrastructure, threat categories.
`get_domain_intel`	Security intelligence for a domain: risk scores, categories, DNS info.
`get_domain_intel_bulk`	Threat intelligence for multiple domains at once.
`get_domain_history`	Historical threat data and classifications for a domain.
`list_passive_dns`	Domains that have resolved to a given IP (passive DNS).
`get_whois`	WHOIS registration data for a domain.
`get_asn_intel`	ASN overview and subnet allocations.
`list_attack_surface_issue_types`	Security Center attack-surface issue types.
`list_attack_surface_issues`	Security Center attack-surface issues (misconfigurations, exposures).
`get_attack_surface_issue_counts_by_class`	Attack-surface issue counts by class.
`get_attack_surface_issue_counts_by_severity`	Attack-surface issue counts by severity.
`get_attack_surface_issue_counts_by_type`	Attack-surface issue counts by type.
`get_ip_lists`	Available threat-intelligence IP lists for an account.
`get_bulk_domain_details`	Threat intel details for multiple domains (GET bulk).
`get_url_intel`	Threat intelligence for a URL (risk, categories).
`list_indicator_feeds`	List indicator feeds owned by an account.
`list_indicator_feed_permissions`	List indicator feed view permissions for an account.
`get_indicator_feed`	Get indicator feed metadata by ID.
`get_indicator_feed_data`	Get raw indicator feed data by ID (STIX/CSV).
`download_indicator_feed_data`	Download latest indicator feed snapshot by ID.

Account & audit

Tool	Description
`list_accounts`	Cloudflare accounts accessible with the current token.
`get_account_details`	Get details of a specific account by ID.
`list_account_members`	List members of an account (user, roles, status).
`get_account_member`	Get an account member by ID (user, roles, policies).
`list_account_roles`	List roles available in an account.
`get_account_role`	Get an account role by ID (name, permissions).
`list_account_subscriptions`	List subscriptions for an account.
`get_account_subscription`	Get an account subscription by ID.
`get_subscription_cancel_reason`	Get a subscription's cancellation reason.
`list_account_tokens`	List account-owned API tokens.
`list_token_permission_groups`	List permission groups for account API tokens.
`verify_account_token`	Verify the account API token is valid and active.
`get_account_token`	Get an account API token by ID (name, policies, status).
`create_account`	Create a new account (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`update_account`	Update an account (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`delete_account`	Delete an account by ID (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`add_account_member`	Add a member to an account (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`update_account_member`	Update an account member (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).
`remove_account_member`	Remove a member from an account (write; requires `CLOUDFLARE_MCP_ENABLE_WRITE=true`).

Usage examples

Once connected, ask your MCP client things like:

"List the DNS records for example.com."
"A request was blocked with Ray ID 8f1c2d3e4f5a6b7c — why?"
"Show me the high-severity Security Center insights for this zone."
"Is IP 203.0.113.10 known to be malicious? What domains resolve to it?"
"Which firewall rules are currently challenging traffic?"

Configuration

The server communicates over stdio and can be connected from any MCP client.

Variable	Required	Purpose
`CLOUDFLARE_API_TOKEN`	Yes	Authenticates all Cloudflare API calls.
`CLOUDFLARE_ACCOUNT_ID`	No	Needed by account, audit log, KV, and intel tools.
`CLOUDFLARE_MCP_ENABLE_WRITE`	No	Enables write (mutation) tools when set to exactly `true`. Unset or empty keeps them disabled (default); any other value is rejected (logged to stderr) and the server stays read-only.

Claude Code

Terminal

claude mcp add cloudflare \
  -e CLOUDFLARE_API_TOKEN=your-api-token \
  -- go run github.com/M-Yamashita01/cloudflare-mcp-go@latest

Or, if you have the repository cloned locally:

Terminal

claude mcp add cloudflare -e CLOUDFLARE_API_TOKEN=your-api-token -- go run .

Claude Desktop / other MCP clients

Build the binary and point your client's MCP config at it. On macOS the Claude Desktop config lives at ~/Library/Application Support/Claude/claude_desktop_config.json:

bash

go build -o cloudflare-mcp-go .

config.json

{
  "mcpServers": {
    "cloudflare": {
      "command": "/path/to/cloudflare-mcp-go",
      "env": {
        "CLOUDFLARE_API_TOKEN": "your-api-token"
      }
    }
  }
}

Any MCP-compatible client can connect via stdio transport using the same pattern.

Build & run manually

server.ts

go build -o cloudflare-mcp-go .
export CLOUDFLARE_API_TOKEN="your-api-token"
./cloudflare-mcp-go

Project structure

Code

main.go                  # Entry point
internal/
  cfapi/                 # Shared Cloudflare API client
  tool/
    zone/                # Zone management tools
    dns/                 # DNS record & analytics tools
    account/             # Account management tools
    audit/               # Audit log tools
    kv/                  # Workers KV tools
    security/            # Firewall, WAF & rate limiting tools
    securitycenter/      # Security Center insight tools
    intel/               # Threat intelligence tools
    logs/                # HTTP request log tools
doc/
  architecture.md        # Architecture documentation

See doc/architecture.md for detailed design documentation.