Cloudflare

@cloudflare list all DNS records for example.com and show me which ones point to our staging environment

Found 47 DNS records in the example.com zone. 8 records appear to point to staging infrastructure: staging.example.com (A → 203.0.113.45), api-staging.example.com (CNAME → staging-lb.example.com), and 6 additional subdomains with 'staging' or 'dev' prefixes. All staging A records resolve to the 203.0.113.0/24 block. The remaining 39 records include production services, MX records, and TXT verification entries.

This example demonstrates read-only zone enumeration. Requires API token with Zone:Read permission for the target domain. Cloudflare returns paginated results for zones with hundreds of records; the MCP handles pagination automatically but may take several seconds for large zones.

@cloudflare create a new A record for beta.example.com pointing to 198.51.100.10 with proxy enabled

Created DNS record successfully. beta.example.com now resolves to 198.51.100.10 with Cloudflare proxy enabled (orange-clouded). The record ID is a3f8c2e1b4d9... and propagation typically completes within 60 seconds globally. With proxying active, visitors will connect through Cloudflare's edge network, enabling WAF protection and caching for this subdomain.

This write operation requires Zone:DNS:Edit permission and immediately modifies live DNS configuration. The 'proxy enabled' flag routes traffic through Cloudflare's CDN; disabling it exposes the origin IP directly. Always verify the target IP before creating records in production zones to avoid outages.

@cloudflare review our WAF lists across all accounts and tell me which ones haven't been updated in over 90 days

Analyzed WAF lists across 3 accessible accounts. Found 12 total lists: 4 are actively maintained (updated within 30 days), 5 were last modified 31-90 days ago, and 3 are stale (no updates in 90+ days). The stale lists are 'legacy-blocklist' (147 days), 'temp-geoblock' (203 days), and 'old-bot-ips' (312 days). None of these stale lists are currently referenced by active firewall rules, suggesting they may be safe to archive or delete.

This synthesis example combines list enumeration with AI reasoning to surface maintenance issues. Requires Account:Firewall Services:Read across multiple accounts. The MCP cannot determine business context (whether a stale list is intentionally dormant), so human review is essential before deleting lists that might be referenced in disaster recovery runbooks.

When Cloudflare MCP handles launch-day DNS changes

A 6-person startup is launching a new product subdomain and needs to coordinate DNS records, WAF rules, and zone setup across engineering and ops. The Cloudflare MCP wins here because it surfaces zone IDs and record creation in the same context where the team is discussing the launch checklist. One person can create the zone, another can add the DNS entries, and a third can set up the WAF list without switching to the Cloudflare dashboard or Slack-pinging for credentials. The threshold: if your launch involves more than 3 zones or complex traffic routing, the MCP's 16-tool scope starts to feel narrow—you'll want Terraform or the full API. For a single-zone launch with straightforward DNS and basic WAF setup, this MCP keeps the launch thread moving without context-switching.

Why this MCP works for fast WAF list updates

A 10-person SaaS team detects a spike in malicious traffic from a known IP range during a customer support call. The on-call engineer needs to create a WAF blocklist and add entries without leaving the incident Slack channel. The Cloudflare MCP handles this well: the create and delete WAF list tools let the engineer confirm the account ID, spin up the list, and verify no filters reference it before cleanup—all in the same AI thread where the team is triaging. The trade-off: if your incident response involves bulk IP imports (500+ entries) or cross-zone policy changes, the MCP's manual tool calls get tedious. For sub-50 IP blocklists and single-account scopes, this MCP keeps your incident response in one place.

When Cloudflare MCP simplifies account member review

A 15-person agency runs quarterly access audits to confirm which team members have Cloudflare permissions across 4 client accounts. The compliance lead needs to list account members, cross-check against the HR roster, and document findings for SOC 2. The Cloudflare MCP works here because it exposes the list accounts and list members tools in a shared workspace where the compliance lead and IT admin can review together. One person pulls the member lists, another flags the discrepancies, and the audit log lives in the same thread. The boundary: if your audit spans more than 10 accounts or requires role-level permission diffs, the MCP's output gets verbose and hard to parse. For small-to-mid client rosters with straightforward member enumeration, this MCP turns a 2-hour dashboard crawl into a 20-minute AI-assisted review.