helbertparanhos/cloudflare-mcp-pro

> MCP server for the **Cloudflare REST API v4** — **69 tools** across DNS, Zones, Workers, KV, R2, D1, Pages, Queues, Tunnels, SSL, WAF, Email Routing, Logpush and Workers AI in a **single local stdio server** authenticated by API token.
Unlike the official Cloudflare MCP offering (13 separate remote, OAuth-based servers), cloudflare-mcp-pro runs locally over stdio, authenticates with a single **API token**, and consolidates the most-used Cloudflare operations into one server with consistent verb_object tool names — ideal for Claude Code, CI, and scripted automation.
Features
- **DNS** — list/create/update/delete records, DNSSEC, BIND zone-file export
- **Zones** — list/get/create/delete, settings (SSL mode, HTTPS, min TLS…), cache purge, GraphQL analytics
- **Workers** — deploy (ES module), routes, secrets, cron triggers, list/get/delete
- **KV / R2 / D1** — namespaces + key CRUD, bucket management, databases + SQL queries
- **Pages / Queues / Tunnels** — list/get projects, queue management, tunnel inspection
- **Security** — WAF rulesets, IP/ASN/country access rules, page rules, SSL certificate packs, custom hostnames (SaaS), Turnstile widgets
- **Email Routing** — rules + destination addresses
- **Logpush** — list/create jobs (zone or account scoped)
- **Workers AI** — model catalog + inference (text generation, embeddings, classification)
- **Human-approval gate** — every mutating tool requires confirm: true; without it the tool returns a non-executing preview (with secrets redacted) instead of acting (see below)
- **MCP annotations** — every tool carries readOnly/destructive/idempotent hints so clients can gate dangerous actions
- **Auto-pagination** — fetch_all: true on list tools follows every page
- Single API-token auth, automatic retry + rate-limit (429/5xx) handling, and actionable error messages
Installation
Or run directly once published:
Configuration
Copy .env.example to .env and fill in:
| Variable | Required | Description |
|----------|----------|-------------|
| CLOUDFLARE_API_TOKEN | ✅ | API token from https://dash.cloudflare.com/profile/api-tokens |
| CLOUDFLARE_ACCOUNT_ID | optional | Default account ID used when a tool doesn't receive account_id |
| CLOUDFLARE_API_BASE | optional | Override the API base URL |
**Token scopes** depend on what you use, e.g.: Zone:Read, DNS:Edit, Workers Scripts:Edit, Workers KV Storage:Edit, Workers R2 Storage:Edit, D1:Edit, Pages:Edit, Account Analytics:Read. Run the verify_token tool to confirm your token works.
Testing
Run the automated test suite (no network — fetch is mocked):
It covers the human-approval gate, secret redaction, the security validations (hex IDs, path-segment encoding, model-id allowlist, purge mutual-exclusion, analytics hour-alignment), the API client (query serialization, 429 retry, error mapping, pagination + clamp, GraphQL non-JSON guard) and the Zod→JSON-Schema converter.
Interactive testing with the MCP inspector:
Add to Claude Code
In .claude/settings.json → mcpServers:
Add to Claude Desktop
- **Mac:** ~/Library/Application Support/Claude/claude_desktop_config.json
- **Windows:** %APPDATA%\Claude\claude_desktop_config.json