MCP Cloudflare

Frequently asked questions

What does the MCP Cloudflare MCP server do?

MCP Cloudflare CrunchTools A secure MCP (Model Context Protocol) server for Cloudflare DNS, Transform Rules, Page Rules, and cache management. Overview This MCP server is designed to be: Secure by default - Threat modeling, input validation, and token protection No third-party services - Runs locally via stdio, your API token never leaves your machine Cross-platform - Works on Linux, macOS, and Windows Automatically updated - GitHub Actions monitor for CVEs and update dependencies Containerized - Available at quay.io/crunchtools/mcp-cloudflare built on Hummingbird Python base image Naming Convention Component Name ----------- ------ GitHub repo crunchtools/mcp-cloudflare Container quay.io/crunchtools/mcp-cloudflare Python package (PyPI) mcp-cloudflare-crunchtools CLI command mcp-cloudflare-crunchtools Module import mcp cloudflare crunchtools Why Hummingbird? The container image is built on the Hummingbird Python base image from Project Hummingbird, which provides: Minimal CVE exposure - Hummingbird images are built with a minimal package set, dramatically reducing the attack surface compared to general-purpose images Regular updates - Security patches are applied promptly, keeping CVE counts low Optimized for Python - Pre-configured Python environment with uv package manager for fast, reproducible builds Production-ready - Designed for production workloads with proper signal handling and non-root user defaults This means your MCP server runs in a hardened environment with fewer vulnerabilities than typical Python container images Features Zone Management (2 tools) list zones - List all zones accessible by your API token get zone - Get zone details by ID or domain name DNS Records (5 tools) list dns records - List DNS records with filtering get dns record - Get a single DNS record create dns record - Create A, AAAA, CNAME, MX, TXT, NS, SRV, CAA records update dns record - Update existing records delete dns record - Delete records Transform Rules (6 tools) list request header rules / set request header rules - Modify request headers list response header rules / set response header rules - Modify response headers list url rewrite rules / set url rewrite rules - URL path/query rewrites Page Rules (4 tools) list page rules - List all page rules create page rule - Create redirects, cache settings, SSL modes update page rule - Modify existing rules delete page rule - Remove rules Access (8 tools) get access organization - The Zero Trust organization and its team login domain list access apps / get access app - Applications on a zone, with their audience tags create access app / delete access app - Put a hostname behind an Access login, or take it out list access policies - Who an application admits create access policy / delete access policy - Allow, deny or bypass by email, email domain, IP or everyone Cache Management (1 tool) purge cache - Purge by URL, tag, host, prefix, or everything Installation With uvx (Recommended) With pip With Container Configuration Creating a Cloudflare API Token Navigate to API Tokens Go to Click "Create Token" Click "Get started" next to "Create Custom Token" Configure Token Name Enter: mcp-cloudflare-crunchtools Configure Permissions The Permissions section has three dropdowns per row: First dropdown : Resource type ( Account or Zone ) Second dropdown : Specific permission category Third dropdown : Access level ( Read or Edit ) Click "+ Add more" to add each permission row. For full management, add: Resource Permission Access ---------- ------------ -------- Zone Zone Read Zone DNS Edit Zone Page Rules Edit Zone Transform Rules Edit Zone Cache Purge Purge Account Access: Apps and Policies Edit Account Access: Organizations, Identity Providers, and Groups Read Configure Zone Resources First dropdown: Select "Include" Second dropdown: Select "All zones" or "Specific zone" Configure Client IP Address Filtering (Optional) Click "Use my IP" button to restrict token to your current IP Create and Copy Token Click "Continue to summary" → "Create Token" IMPORTANT: Copy the token immediately - it's only shown once! Add to Claude Code Or for the container version: Permission Sets by Use Case Read-Only (viewing only) Resource Permission Access ---------- ------------ -------- Zone Zone Read Zone DNS Read DNS Management Only Resource Permission Access ---------- ------------ -------- Zone Zone Read Zone DNS Edit Full Management (all features) Resource Permission Access ---------- ------------ -------- Zone Zone Read Zone DNS Edit Zone Page Rules Edit Zone Transform Rules Edit Zone Cache Purge Purge Usage Examples List Your Zones Create a DNS Record Add Security Headers Purge Cache Security This server was designed with security as a primary concern. See SECURITY.md for: Threat model and attack vectors Defense in depth architecture Token handling best practices Input validation rules Audit logging Key Security Features Token Protection Stored as SecretStr (never accidentally logged) Environment variable only (never in files or args) Sanitized from all error messages Input Validation Pydantic models for all inputs Allowlist for record types, actions Strict format validation for IDs API Hardening Hardcoded API base URL (prevents SSRF) TLS certificate validation Request timeouts Response size limits Automated CVE Scanning GitHub Actions scan dependencies weekly Automatic PRs for security updates Dependabot alerts enabled Development Setup Run Tests Lint and Type Check Build Container License AGPL-3.0-or-later Contributing Contributions welcome! Please read SECURITY.md before submitting security-related changes. Links Cloudflare API Documentation FastMCP Documentation MCP Specification crunchtools.com

How do I install MCP Cloudflare?

Run the install command shown above, then paste the config for your client (Claude Desktop, Claude Code, Cursor, VS Code or Windsurf) into its MCP settings and restart the client.

Is MCP Cloudflare free to use?

The MCP server itself is free to install. The source is public on https://github.com/crunchtools/mcp-cloudflare. Any third-party service it calls may require its own API key and account.

Which clients support MCP Cloudflare?

Any MCP-compatible client can use it, including Claude Desktop, Claude Code, Cursor, VS Code, Windsurf and custom agents.