M-Yamashita01/cloudflare-mcp-go

An MCP (Model Context Protocol) server for the Cloudflare API v4, written in Go.
It lets any MCP client (Claude, and other MCP-compatible tools) inspect and investigate your Cloudflare account through natural language: zones, DNS, WAF and firewall rules, rate limits, HTTP request logs, Security Center insights, and threat intelligence. The server is read-focused and geared toward security triage and investigation workflows.
Quick start
Requires a Cloudflare API token and Go 1.25+.
Add it to Claude Code with a single command:
That is all — no manual clone or build required. CLOUDFLARE_ACCOUNT_ID is optional and only needed by a few tools (accounts, audit logs, KV, intel).
Tools
117 read-only tools grouped by domain, plus optional write tools (marked below) that are registered only when CLOUDFLARE_MCP_ENABLE_WRITE=true.
Zones & DNS
| Tool | Description |
|------|-------------|
| list_zones | List zones in your account (ID, name, status, plan). |
| get_zone | Get details of a specific zone. |
| get_zone_settings | Get a zone's configuration settings (SSL mode, min TLS, cache level, security level). |
| purge_cache | Purge a zone's cache: everything, or by file/tag/host/prefix (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| list_dns_records | List DNS records for a zone (type, name, content, TTL, proxy status). |
| get_dns_record | Get a single DNS record by ID (type, name, content, TTL, proxy status, comment). |
| get_dns_analytics | DNS query analytics: query counts, response codes, query type distribution. |
| get_dns_analytics_bytime | DNS query analytics grouped by time interval (time-series). |
| export_dns_records | Export all DNS records for a zone as a BIND zone file. |
| get_dns_record_usage | DNS record usage counts for a zone (toward plan limits). |
| get_dns_settings | Get a zone's DNS settings (Foundation DNS, multi-provider, nameservers, zone mode). |
| get_dnssec | Get DNSSEC details for a zone (status, DS record, digest, key tag, algorithm). |
| list_dnssec_zsk | List DNSSEC Zone Signing Keys (ZSKs) for a zone (multi-signer DNSSEC). |
| list_scanned_dns_records | List DNS records discovered by a scan, pending review. |
| create_dns_record | Create a DNS record (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| update_dns_record | Update a DNS record, partial fields (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| delete_dns_record | Delete a DNS record by ID (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| overwrite_dns_record | Overwrite (fully replace) a DNS record by ID (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| batch_dns_records | Apply a batch of DNS record changes atomically (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| import_dns_records | Import DNS records from a BIND zone file (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| scan_dns_records | Scan a zone for DNS records at common names (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| trigger_dns_record_scan | Trigger an async DNS record scan (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| review_scanned_dns_records | Accept/reject DNS records found by a scan (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| update_dns_settings | Update a zone's DNS settings (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| edit_dnssec | Edit a zone's DNSSEC status (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| delete_dnssec | Delete a zone's DNSSEC records (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
Firewall, WAF & rate limiting
| Tool | Description |
|------|-------------|
| list_ip_access_rules | IP access rules that block, challenge, or allow IPs, CIDRs, ASNs, or countries. |
| create_ip_access_rule | Create an IP access rule (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| update_ip_access_rule | Update an IP access rule's mode/notes (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| delete_ip_access_rule | Delete an IP access rule by ID (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |
| list_waf_managed_rulesets | WAF managed rulesets entrypoint and which managed rulesets are enabled. |
| list_firewall_rules | Custom firewall rules with expressions, actions, and priorities. |
| get_firewall_rule | Full configuration of a specific firewall rule by ID. |
| list_rulesets | All rulesets for a zone (metadata only). |
| get_ruleset | A specific ruleset with all its rules. |
| create_ruleset | Create a ruleset (write; requires CLOUDFLARE_MCP_ENABLE_WRITE=true). |