Cloudflare MCP servers: inspect first, approve configuration changes

Cloudflare MCP servers let an agent search Cloudflare documentation and, with authorized account access, inspect configuration or call Cloudflare APIs. The main remote endpoint is https://mcp.cloudflare.com/mcp; for documentation questions, start with https://docs.mcp.cloudflare.com/mcp. Keep DNS and firewall changes behind a human decision, because the API connection can also make changes when its permissions allow them. Official overview, checked 30 Oct 2026.

What it can do

Begin with a question whose answer you can verify. For example, ask an agent to find the documentation explaining a Workers binding, then identify which configuration fields you should inspect. The public documentation server requires no authentication and exposes search_cloudflare_documentation; it searches reference material rather than your account. Documentation server README.

For account work, the API server uses search to discover endpoints and execute to call them through generated JavaScript; docs searches developer documentation. That makes an inventory or configuration comparison possible within the granted permissions. Treat these as separate tasks: finding the relevant API, reading the selected resource, and proposing a change. API server repository.

A useful inspection brief specifies the account, zone, resource and expected evidence. Ask for the current DNS records in an authorized zone, their relevant fields, and the documentation needed to interpret them. Ask the agent to label observations separately from hypotheses. A configuration difference is evidence to investigate; it does not establish the cause of an incident.

For background, see what MCP connects and the remote versus local server guide. This article belongs to MCP servers for apps.

Which Cloudflare MCP servers exist

As of 30 Oct 2026, Cloudflare recommends the main API server for broad access. Alongside the documentation endpoint, its official catalogue lists these focused options:

The official product-specific repository also lists Cloudflare Blog and Demo Day servers. It marks the older AI Gateway, Audit Logs, AutoRAG, DNS Analytics, GraphQL, Logpush, Observability, Radar, Workers Bindings and Workers Builds servers as deprecated and directs users to the main API MCP server. Check the current catalogue before copying an older setup.

Select the server for the question. A Browser Run connection is not evidence that you have inspected your zone configuration. Likewise, documentation search cannot establish which settings are currently enabled in your account.

How to connect it safely

1. Define the first task. Start with documentation retrieval or a narrowly scoped inventory. Write down the permitted resource and the evidence you expect. Use the MCP security checklist to prepare the access review.

2. Add the documentation endpoint in the editor. In VS Code, run MCP: Add Server from the Command Palette, choose HTTP, enter https://docs.mcp.cloudflare.com/mcp, and give the server a distinct ID. Select the configuration destination appropriate to your agent session. Review trust prompts. The VS Code setup guide explains the current destinations; other editor clients use their own configuration format.

3. Verify an actual tool call. Ask the agent to use that server to find the documentation for your selected Cloudflare feature and return the reference links. Inspect the tool output in the conversation. A plausible answer without a call to the intended server does not prove the connection works.

4. Add account access only when needed. Connect a separate entry to https://mcp.cloudflare.com/mcp and follow its OAuth authorization flow, reviewing the permissions requested. The official connection instructions also support an API token in an Authorization bearer header. Keep credentials out of chat, screenshots and committed configuration.

5. Scope permissions to the inspection. Cloudflare documents Zone DNS Read restricted to a selected zone as an example. Choose Read rather than Edit where appropriate, select only the intended resources, and set a suitable expiry. These API-token permissions are not a universal OAuth scope string: check the selected operation and consent screen. Token creation and resource restrictions.

6. Review before expanding access. Compare the returned resource identity and fields with the dashboard. If an operation fails, investigate its required permission before granting more. For a later DNS or firewall proposal, require the exact target, current state, proposed state, reason, verification and rollback plan. A human approves that concrete change before any write-capable execution.

Why configuration changes need a gate

For an inspection session, enforce the boundary with permissions as well as instructions. A prompt asking for read-only behavior is useful task context, but the credential should also exclude unwanted mutations.

For example, an agent may propose replacing a DNS record after comparing it with an application configuration. The reviewer should check that the hostname belongs to the intended environment, that the proposed destination is authorized, and that dependent services have been considered. For a firewall proposal, review the matching conditions and intended action together. Approving a diagnosis does not approve a later rule edit.

Keep a small review record: the observed state, its collection time, the proposal and the human decision. After an authorized change, collect fresh evidence. Do not treat the agent's completion message as confirmation that the intended production state exists.

When this does not work

Old endpoints fail. The product-specific repository documents retired /sse URLs returning 410 Gone; use the published /mcp endpoints. Authentication can still fail with a valid token: the main API server currently does not support tokens with Client IP Address Filtering. Account tokens need Account Resources : Read for automatic account identification. These are documented constraints as of 30 Oct 2026. Product-specific repository · API server authentication notes.

Missing access is not an empty environment. Investigate authorization when expected resources are absent or a call requests additional consent. Do not broaden permissions merely to make a diagnostic prompt succeed. A narrow result is not a complete audit: specify the resource coverage and time window, and record anything you did not inspect.

If your organization restricts editor MCP access, review that policy before changing settings. The VS Code troubleshooting guidance covers configuration scope, sign-in and unavailable tools. See also MCP in VS Code.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension provides an editor entry for questions with selected context. Use it to discuss redacted configuration excerpts or documentation evidence. TvijoCode is a test build with the extension embedded. Neither description establishes a ready Cloudflare integration.

Tvijo MCP makes Tvijo consultation available to a compatible MCP client. Its prepared diff-review functionality awaits publication in the documented release status; editor integration and safe delegation remain planned stages. Connecting Tvijo MCP does not automatically let Tvijo execute another server's Cloudflare tools. Begin with inspection and documentation questions; DNS and firewall changes remain human decisions.

At dsh.tvijo.com, as of 30 Oct 2026, Try costs $0 and ends at whichever comes first: 5 tasks, 50,000 tokens or $0.05 of sponsored usage, subject to a shared $1 daily pool funded by TVIJO. Service credit is shown as $10 for requested prepaid credit, with metered provider usage plus an 8% service markup. Payment collection is not activated; an order is not a charge.

FAQ

Do I need a Cloudflare token for documentation search?

The public documentation endpoint does not require authentication. Account inspection is a separate connection with its own authorization. Documentation server README.

Can an agent change DNS or firewall settings?

The main server can call the Cloudflare API within granted permissions. Keep inspection credentials narrow and require a human decision before granting or using change access. Official overview.

Do I need to deploy my own remote MCP server?

For the managed endpoints described here, configure a compatible client to connect to the published URL. Hosting a custom server is a separate implementation choice. Official server repository.

Cloudflare is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.