Cloudflare

Cloudflare

This connector works with Cloudflare through the API v4 (https://api.cloudflare.com/client/v4) and the GraphQL Analytics API: zones and their settings, DNS records (list, export, create, change, delete), cache purges, rulesets (redirects, transform, cache, origin and WAF custom rules), legacy Page Rules, traffic analytics, Workers (scripts, settings, code, routes, custom domains) and R2 buckets. It authenticates with an API token, which you limit to the permissions and zones the AI should reach.

Setup (about 3 minutes)

1. Open https://dash.cloudflare.com/profile/api-tokens (My Profile → API Tokens) and click Create Token, then Create Custom Token at the bottom (or start from the Read all resources template and add the two write permissions below).
2. Name it (for example "AnythingMCP") and add these permissions:
   • Zone → Zone → Read; Zone → DNS → Edit (Read for a read-only setup); Zone → Cache Purge → Purge
   • Zone → Zone Settings → Read; Zone → Page Rules → Read; Zone → Analytics → Read; Zone → Workers Routes → Read
   • For rules: Zone → Single Redirect, Transform Rules, Cache Rules, Origin Rules, Config Rules and Zone WAF → Read (each phase needs its own permission)
   • Account → Account Settings → Read; Account → Workers Scripts → Read; Account → Workers R2 Storage → Read; Account → Account Analytics → Read
3. Under Zone Resources pick Include → All zones from an account (or Specific zone to limit the AI to some domains); under Account Resources include your account. Optionally restrict Client IP Address Filtering and set a TTL.
4. Continue to summary → Create Token, copy the token (Cloudflare shows it once) and paste it into CLOUDFLARE_API_TOKEN. Do not use the Global API Key.
5. An account-owned token (Manage Account → Account API Tokens) works too, except for Page Rules, which it cannot read.

Read-only setup: give DNS only Read, leave out Cache Purge, and switch off cloudflare_create_dns_record, cloudflare_update_dns_record and cloudflare_purge_cache. cloudflare_delete_dns_record and cloudflare_purge_everything are installed switched off.

Ids: zone ids and account ids are 32 hex characters; cloudflare_list_zones (filter by name) and cloudflare_list_accounts give them, and every zone carries its account.id. DNS record ids come from cloudflare_list_dns_records. Answers are wrapped as {success, errors, messages, result, result_info}.

DNS changes

• Look before you change: cloudflare_list_dns_records with name or type, and cloudflare_export_dns_records for a full BIND copy to keep before larger edits.
• Names are full names (www.example.com); ttl 1 means automatic; proxied (orange cloud) only applies to A, AAAA and CNAME records; MX and URI records need priority; SRV and CAA take data instead of content.
• A CNAME cannot share its name with any other record, and an identical record is refused. Changes go live within seconds, so a wrong record can take a website or its email offline at once: confirm each change with the user.

Cache: cloudflare_purge_cache takes exactly one of files (full URLs), tags, hosts or prefixes, up to 100 per call; every plan can use all four. Free plans allow 5 purge requests per minute by tag, host or prefix. cloudflare_purge_everything (switched off) empties the zone's whole cache and sends every next request to the origin.

Rules: modern rules live in rulesets, one entry point per phase. cloudflare_get_phase_rules reads the zone's rules for a phase: http_request_dynamic_redirect (single redirects), http_request_transform (URL rewrites), http_request_late_transform and http_response_headers_transform (header changes), http_request_cache_settings (cache rules), http_request_origin (origin rules), http_config_settings (configuration rules), http_request_firewall_custom (WAF custom rules), http_ratelimit. A 404 means the zone has no rules in that phase. Legacy Page Rules come from cloudflare_list_page_rules. Rules are read-only here.

Analytics: cloudflare_get_zone_traffic gives daily totals for a date range. For anything else, cloudflare_graphql_analytics runs a GraphQL query: for example httpRequestsAdaptiveGroups(limit: 20, filter: {datetime_geq: "...", datetime_leq: "..."}, orderBy: [count_DESC]) { count dimensions { clientRequestPath } } under viewer { zones(filter: {zoneTag: "<zone id>"}) }. How far back a dataset reaches depends on the plan; adaptive datasets keep at least 31 days. GraphQL errors (for example a range the plan does not allow) are reported as failed calls.

Workers and R2: cloudflare_list_workers, cloudflare_get_worker_settings (bindings; secret values are never shown) and cloudflare_get_worker_content (the deployed code) read Workers; cloudflare_list_worker_routes and cloudflare_list_worker_domains show where they run. R2 must be enabled (subscribed, free tier included) under Storage & databases → R2 before cloudflare_list_r2_buckets answers; otherwise it fails with 403 "NotEntitled". Nothing here deploys Workers or touches R2 objects.

Pagination: page-based lists take page and per_page and report result_info.total_count and total_pages; rulesets and R2 buckets page with a cursor from result_info.

Rate limits: 1,200 requests per 5 minutes per token (dashboard use counts too). Over it Cloudflare answers 429 and blocks every call for 5 minutes, so avoid tight loops over many zones. GraphQL has its own limit of about 300 queries per 5 minutes.

Errors: 400 with code 6003 usually means the Global API Key was pasted instead of a token. 401 or 403 with code 10000 or 9109 means the token is invalid or lacks the permission for that zone or account: edit the token and add it. 404 is an unknown zone, record or ruleset (or a phase without rules). A create answering 400 "An identical record already exists" or "A CNAME record with that host already exists" names the conflicting record.

Out of scope here: editing rulesets, Page Rules and zone settings, SSL/TLS certificates, deploying or deleting Workers, KV, D1 and R2 objects, Zero Trust, registrar and billing.