Cloudflare MCP Server: Setup, Code Mode and Security (Oct 2026)

Q: What's the URL?

https://mcp.cloudflare.com/mcp. On Cloudflare's older product servers, the /sse endpoints are retired and now point you to /mcp.

Q: Can I make it read-only?

Yes. Choose the Read only template on the consent page, or use an API token with read permissions only.

On this page

Cloudflare MCP Server: Setup, Code Mode and Security (Oct 2026)

The Cloudflare MCP server is Cloudflare's official server for its whole API. It lives at https://mcp.cloudflare.com/mcp, and through it an agent can find and call any of about 2,500 Cloudflare API endpoints (Workers, DNS, R2, D1, KV, firewall and more). TrustedMCP grades it A. Use it, but pick the read-only permission set when you sign in unless you really need the agent to make changes.

Which Cloudflare MCP server?

Search "cloudflare mcp" and you will find two generations of servers.

The new Cloudflare API MCP server (repo cloudflare/mcp). Cloudflare's docs call it "the only MCP server you need to work with Cloudflare."
The older per-product servers in cloudflare/mcp-server-cloudflare. That README lists these as deprecated: AI Gateway, Audit Logs, AutoRAG, DNS Analytics, GraphQL, Logpush, Observability, Radar, Workers Bindings and Workers Builds. It says: "Please migrate to the Cloudflare API MCP Server at your earliest convenience."

A few product servers are still active, including Documentation, Container, Browser Run, Digital Experience Monitoring and Cloudflare One CASB. Cloudflare calls them optional and says most people should just use the API server.

How it works: search, execute and code mode

Cloudflare's full OpenAPI spec is about 2 million tokens. Exposing every endpoint as its own tool would still cost about 244,000 tokens of context, per the README. So the server uses code mode instead. It has four tools:

search: the agent writes JavaScript that looks through the API spec to find the right endpoints.
execute: the agent writes JavaScript that calls those endpoints with cloudflare.request().
docs: searches Cloudflare's developer docs.
whoami: returns which user or account you are connected as.

The spec stays on the server and only the result comes back, so the tool list costs about 1,000 tokens. Results from search and execute are capped at about 6,000 tokens each.

The agent's code runs in isolated Workers created on demand through Cloudflare's Worker Loader API. Cloudflare's code mode blog post describes a V8 sandbox "with no file system, no environment variables to leak through prompt injection." The repo's developer notes add that execute can only send requests to Cloudflare API URLs, and that your API token never enters the sandbox where the agent's code runs.

You can turn code mode off with ?codemode=false. That registers one tool per endpoint and raises the cost to about 244,000 tokens. Cloudflare says to do this only if your client already runs its own code mode.

Setup

You have two ways to sign in: OAuth (recommended) or a Cloudflare API token.

OAuth. This JSON comes from the cloudflare/mcp README:

{
  "mcpServers": {
    "cloudflare-api": {
      "type": "http",
      "url": "https://mcp.cloudflare.com/mcp"
    }
  }
}

Cloudflare's MCP servers page shows the same server without the type field, which is the shape Cursor uses in ~/.cursor/mcp.json:

{
	"mcpServers": {
		"cloudflare-api": {
			"url": "https://mcp.cloudflare.com/mcp"
		}
	}
}

On first use you are sent to Cloudflare to sign in and choose permissions.

API token. For CI/CD or if you prefer your own tokens, the README says to create a Cloudflare API token with the permissions you need and send it as a Bearer token with the MCP URL https://mcp.cloudflare.com/mcp. User and account tokens both work. Account tokens also need Account Resources : Read so the server can find your account ID. Tokens with Client IP Address Filtering are not supported yet.

Cloudflare's docs don't give a client-specific command for Claude Code, so we haven't included one. Any client that supports remote HTTP MCP servers can use the URL above.

Security notes

The access is real. With write permissions, the agent can add or change DNS records, deploy or delete Workers, edit firewall rules and more. A bad prompt or a confused agent can take a site offline.

You choose the permission set at sign-in. The repo's developer notes say the consent page offers three templates:

Minimal (the default): only identity, account and refresh-token scopes. When a call needs more, clients that support it ask you to re-authorize with that one extra scope.
Read only: every read scope in Cloudflare's catalog.
Full access: everything.

An "Advanced" section lets you edit the scope list by hand.

How to limit the risk:

Pick Read only unless the task needs writes. Use Full access only for a specific job, then disconnect.
Read step-up prompts carefully. On Minimal, a re-authorize request is the agent asking for more power. Approve only the scope you expected.
For automation, use a scoped API token. Give it only the permissions and zones the job needs.
Keep tool approval on in your client, and read the code execute is about to run before you approve it.

See the 5-minute safety check for the general version of this process.

Cloudflare MCP server vs MCP server portals and gateway

The Cloudflare MCP server is for managing your Cloudflare account. MCP server portals do something different: they front your own MCP servers. Cloudflare's portal docs say a portal "centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint." Users sign in through Cloudflare Access, admins choose which tools each portal exposes, and requests are logged. Portals sit in Cloudflare One (Zero Trust > Access controls) and can also use code mode. The code mode blog calls this a single gateway with unified auth, which is what people usually mean by "Cloudflare MCP gateway."

If you want to build and host your own server, Cloudflare has a separate guide to deploying remote MCP servers on Workers.

Why it grades A

Authentication: 30 of 30. OAuth starts with minimal scopes, you can choose read-only or full access, and scoped API tokens are an option.
Maintenance: 25 of 25. Open source and actively maintained by Cloudflare.
Known CVEs: 25 of 25. None on record.
Transport: 20 of 20. Hosted over HTTPS, and agent code runs in a sandbox that can only reach the Cloudflare API.

Full breakdown on the Cloudflare MCP listing; the method is in how TrustedMCP scores servers.

Frequently asked questions

Is the Cloudflare MCP server free?

Cloudflare doesn't list a separate charge for connecting. The agent works on your own account, so what it creates is billed under your normal Cloudflare plan, and some features need a paid plan.

What's the URL?

https://mcp.cloudflare.com/mcp. On Cloudflare's older product servers, the /sse endpoints are retired and now point you to /mcp.

Can I make it read-only?

Yes. Choose the Read only template on the consent page, or use an API token with read permissions only.

What happened to the Bindings, Observability and Radar servers?

They are deprecated, along with AI Gateway, Audit Logs, AutoRAG, DNS Analytics, GraphQL, Logpush and Workers Builds. Cloudflare asks users to move to the API server, which covers the same APIs.

What is an MCP server portal?

A Cloudflare One feature that puts several MCP servers behind one URL, with Cloudflare Access sign-in, tool curation and logging. It is for your own servers, not a replacement for the Cloudflare API server.

Does it use a lot of context?

No. Code mode keeps the tool list to about 1,000 tokens. See why MCP servers eat your context window.

More: MCP security best practices · Cloud & Hosting category