Setting up the Cloudflare MCP Server

Cloudflare runs a central API MCP server plus around a dozen product-specific MCP servers, all hosted and secured via OAuth.

Connecting the central API server

Register the remote server in your MCP client:

{
  "mcpServers": {
    "cloudflare-api": { "url": "https://mcp.cloudflare.com/mcp" }
  }
}

On the first call, Cloudflare's OAuth dialog opens. Select the permissions the agent should receive there — grant only what's actually needed for the task at hand.

Adding product-specific servers

For targeted tasks, a focused server is often more useful than the broad API server, for example the documentation server (https://docs.mcp.cloudflare.com/mcp) for lookup questions, the observability server (https://observability.mcp.cloudflare.com/mcp) for logs and analytics, or the Radar server (https://radar.mcp.cloudflare.com/mcp) for Internet traffic data. Each product-specific server runs under its own subdomain and is registered by URL the same way.

Setting up with the Skills plugin

For Claude Code, Cursor, OpenCode, OpenAI Codex, and other agents with Agent Skills support, the cloudflare/skills plugin bundles the MCP servers with matching skills and slash commands. In Claude Code:

/plugin marketplace add cloudflare/skills

For automation: API token instead of OAuth

For CI/CD pipelines or recurring automated workflows, instead of interactive OAuth sign-in you can create a Cloudflare API token with narrowly scoped permissions and pass it as a bearer token in the Authorization header. Both user and account tokens are supported.

Keeping permissions tight

Within the granted permissions, the agent can access real production infrastructure — including DNS records, Workers deployments, and firewall and Zero Trust rules. For automated workflows, use a narrowly scoped token and try write actions against a staging environment before running them against production zones.

Verifying the setup

After connecting, test with a harmless, read-only task, such as "List my DNS records for domain X" or "Show me traffic analytics from the last 24 hours." Only allow write actions afterward.

Common setup issues

If the OAuth dialog doesn't open automatically, check whether the client is blocking pop-ups; the URL can usually be opened manually in that case. When installing the Skills plugin via the marketplace command, make sure Claude Code is updated to a current version, since older versions may not support the Agent Skills standard.

Combining multiple product-specific servers

For more complex workflows, several product-specific servers can be configured in parallel within the same client, for example the observability server for logs alongside the central API server for configuration changes. Each server needs its own unique name in the client configuration so the agent can clearly tell them apart.

Source: developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/ and github.com/cloudflare/mcp-server-cloudflare, checked on 2026-09-06.