Cloudflare MCP
Manage Cloudflare accounts, zones, Workers, DNS, security, storage, and other platform resources through Cloudflare's hosted MCP server.
Verdict
Common use cases
- Check DNS propagation during deployments
- Pull CDN cache hit rates for performance reviews
- Audit firewall rules after security incidents
- List Workers deployments across environments
- Review analytics for traffic spikes
Integration
- Vendor
- Cloudflare MCP
- Category
- developer-tools
- Auth
- OAUTH2
- Composio slug
cloudflare_mcp
Tools
Setup
Setup guide
- 11. Open your Switchy workspace and navigate to Settings > Integrations > Developer Tools. 2. Click 'Connect' next to Cloudflare MCP. 3. You'll be redirected to Cloudflare's OAuth consent screen — sign in with your Cloudflare account. 4. Grant the requested scopes, which typically include read access to zones, DNS records, analytics, and Workers. 5. After authorizing, Switchy redirects you back and confirms the connection. 6. Open any Project and type '@Cloudflare list my zones' to test — the MCP should return your active Cloudflare zones. 7. If you see zone data, the integration is live and ready for queries.
What teammates see: by default, memories from Cloudflare MCP are scoped to the Project (PROJECT visibility) - you can mark any memory PRIVATE or share it ORG-wide.
Works well with
Top models
Compatibility data appears once enough Projects have used this MCP together with a given model.
How Switchy teams use it
Starter prompts
List Active Zones
@Cloudflare list all zones in my account and show their status.
Check DNS Records
@Cloudflare show me all DNS records for example.com.
Get Zone Analytics
@Cloudflare pull analytics for example.com for the last 24 hours, including requests and bandwidth.
Inspect Workers
@Cloudflare list all Workers scripts and their routes for my account.
Review Firewall Events
@Cloudflare show me the last 50 firewall events for example.com.
Example outputs
Illustrative - representative of the model's voice and quality, not literal recordings.
@cloudflare list all DNS records for my production domain and show me which ones are proxied through your CDN
Found 14 DNS records for production.example.com. 8 are proxied (orange-cloud): A records for www, api, and app subdomains; CNAME for blog. 6 are DNS-only (gray-cloud): MX records for mail, TXT for domain verification, and NS records. All A records point to 203.0.113.45. The api subdomain has the highest traffic volume based on your zone analytics.
This example assumes the OAuth2 scope includes Zone:Read permissions. Cloudflare's API returns record metadata (proxy status, TTL, creation date) that helps you audit your DNS configuration. If you manage multiple zones, specify which domain you want to query.
@cloudflare enable 'Under Attack Mode' for my storefront zone — we're seeing a traffic spike that looks like a DDoS attempt
Under Attack Mode activated for storefront.example.com (Zone ID: a1b2c3d4). All visitors now see a JavaScript challenge before accessing your site. This adds ~5 seconds of latency for legitimate users but blocks most automated attacks. Mode will remain active until you disable it manually. Current threat score threshold: 50+. You can monitor blocked requests in the Firewall Events dashboard.
This action immediately affects all site visitors and can hurt conversion rates if left on too long. Requires Zone Settings:Edit scope. Cloudflare doesn't auto-disable this mode, so you must remember to turn it off once the attack subsides. Consider Page Rules for more granular protection.
@cloudflare pull the last 7 days of Web Analytics for my marketing site and summarize which pages have the highest bounce rate
Analyzed 47,320 page views across marketing.example.com. Top 3 bounce rates: /pricing (73% bounce, avg 8 sec on page), /enterprise-demo (68% bounce, avg 12 sec), /blog/outdated-post-2019 (81% bounce, avg 4 sec). The pricing page sees high traffic from paid ads but users leave without scrolling. The 2019 blog post ranks well in search but content is stale. Overall site bounce rate is 52%, up 9% from the prior week.
This synthesis example combines analytics data retrieval with AI reasoning to surface actionable insights. Requires Analytics:Read scope. Cloudflare's Web Analytics is privacy-first (no cookies), so you won't get user-level detail. The AI can spot patterns humans miss, but verify numbers in the dashboard before making major decisions.
Use-case deep-dives
When Cloudflare MCP fits your CI/CD purge workflow
A 3-person SaaS team ships to production 4-6 times a day and needs to purge Cloudflare cache on every deploy. If your CI runner already handles this via API calls, adding the Cloudflare MCP to Switchy makes sense when non-engineers (product, support) need to manually purge specific URLs without touching the pipeline. OAuth2 auth means you grant scoped access once and the team can purge cache from chat without sharing API tokens. The threshold: if purges happen fewer than twice a week, the setup overhead outweighs the convenience. If your team purges daily and you want audit logs of who purged what, this MCP centralizes that action in your shared workspace.
Cloudflare MCP for non-dev DNS changes at small scale
A 5-person agency runs 12 client sites on Cloudflare and needs to update DNS records when clients request subdomain changes or email provider swaps. The Cloudflare MCP lets account managers handle these requests from Switchy without learning the Cloudflare dashboard or waiting on engineering. OAuth2 scoping limits which zones each person can touch, so junior staff can update staging records but not production. This works when changes happen 2-10 times a month per client. If you're managing 50+ zones or need complex firewall rule logic, the MCP's tool coverage may lag the full API and you'll still need the dashboard for edge cases. For routine DNS and cache tasks, it removes the bottleneck.
When Cloudflare MCP speeds up DDoS mitigation
A 6-person startup gets hit with a credential-stuffing attack at 2am and needs to block IP ranges fast. The on-call engineer opens Switchy, asks the Cloudflare MCP to add a firewall rule blocking the /24 subnet, and confirms the block in under 60 seconds without navigating the dashboard. This scenario assumes the MCP exposes firewall rule creation (tool coverage TBD). If it does, OAuth2 auth means the on-call rotation can act immediately without a shared admin password. The trade-off: if your incident playbook requires reviewing logs or analytics before blocking, the MCP won't replace the full dashboard. For known-bad IP blocks during active incidents, it cuts response time from 5 minutes to under 1.
Frequently asked
What does the Cloudflare MCP do in Switchy?
It connects your Switchy workspace to Cloudflare's infrastructure APIs, letting AI assistants query DNS records, manage Workers deployments, check analytics, and configure security settings. Your team can troubleshoot edge issues or update configurations without leaving the conversation. Since no specific tools are documented yet, expect typical Cloudflare account operations like zone management and traffic inspection.
Do I need admin access to my Cloudflare account to connect this?
Yes. OAuth2 flows for Cloudflare typically require account-level permissions to read zones and modify resources. If you're on a team plan, the person connecting must have at least Super Administrator or a custom role with API access. Cloudflare's OAuth scopes can be broad, so review what the integration requests during setup before granting access.
Can the Cloudflare MCP deploy new Workers or just read existing ones?
That depends on which OAuth scopes the MCP requests. Cloudflare's API supports both read and write operations for Workers, DNS, and firewall rules. If the integration only asks for read scopes, you'll get analytics and configuration lookups. Full deployment and rule changes require write permissions, which you'll see in the OAuth consent screen.
How is this different from using Cloudflare's dashboard or API directly?
The MCP brings Cloudflare operations into your AI workflow, so you can ask questions like "show me traffic spikes in the last hour" or "update the DNS record for staging" without switching tabs. It's faster for ad-hoc queries and team collaboration. For bulk changes or complex automation, Cloudflare's Terraform provider or direct API calls are still better.
Who on my team should connect the Cloudflare MCP?
Your infrastructure lead or whoever manages your Cloudflare account. They'll need to authorize OAuth2 access, and that credential will be shared across your Switchy workspace. If multiple people need different permission levels, consider creating a dedicated Cloudflare service account with scoped API tokens instead of using a personal login.