How to Connect Cloudflare to Cursor via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Cloudflare, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Cloudflare + Cursor

Let your AI manage your Cloudflare zones: review and change DNS records, purge the cache, read zone settings, redirect, transform and cache rules, check traffic analytics, and list Workers and R2 buckets. With an API token limited to what it should touch.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

CLOUDFLARE_API_TOKEN

Step 1 — Get credentials

1. In the Cloudflare dashboard open My Profile → API Tokens (https://dash.cloudflare.com/profile/api-tokens), click Create Token, then Create Custom Token at the bottom. You can also start from the Read all resources template and add the two write permissions below.
2. Name the token (for example "AnythingMCP") and add these permissions:
   • Zone → Zone → Read, DNS → Edit (Read for a read-only setup), Cache Purge → Purge
   • Zone → Zone Settings, Page Rules, Analytics and Workers Routes → Read
   • For rules: Zone → Single Redirect, Transform Rules, Cache Rules, Origin Rules, Config Rules and Zone WAF → Read (each kind of rule needs its own permission)
   • Account → Account Settings, Workers Scripts, Workers R2 Storage and Account Analytics → Read
3. Under Zone Resources choose Include → All zones from an account, or Specific zone to limit the AI to some of your domains. Under Account Resources include your account. If you like, restrict Client IP Address Filtering and set a TTL.
4. Click Continue to summary → Create Token, copy the token (Cloudflare shows it only once) and paste it into CLOUDFLARE_API_TOKEN without the word Bearer, then install the connector. Do not use the Global API Key.
5. Start with cloudflare_list_zones: it shows which zones (domains) the token can see, with their status and plan.

Account-owned tokens: a token created under Manage Account → Account API Tokens works too, except for Page Rules: with it cloudflare_list_page_rules cannot read them.

Read-only setup: give DNS only Read, leave out Cache Purge, and switch off cloudflare_create_dns_record, cloudflare_update_dns_record and cloudflare_purge_cache. Zone settings, rules, analytics, Workers and R2 are read-only in this connector anyway.

Switched off at install: cloudflare_delete_dns_record and cloudflare_purge_everything. A deleted record stops whatever relied on it (a website, mail delivery, a domain verification) within seconds, so export the zone first with cloudflare_export_dns_records. Purging everything sends every visitor's next request to your origin, which can overload a busy site; cloudflare_purge_cache with specific URLs is usually enough.

DNS changes: changes go live within seconds, so a wrong record can take a website or its email offline at once. The AI reads the record first and shows you the old and new values before it changes anything. A CNAME cannot share its name with any other record, and Cloudflare refuses an identical record.

Cache purges: cloudflare_purge_cache removes up to 100 URLs, cache tags, hostnames or prefixes per call, on every plan. Free plans allow 5 purge requests per minute by tag, host or prefix.

Analytics: cloudflare_get_zone_traffic gives daily requests, bandwidth, cached traffic, threats, page views and unique visitors, with breakdowns by status code and country. For anything else (top paths, firewall events, Worker invocations) the AI uses cloudflare_graphql_analytics. How far back you can look depends on your plan; the Free plan covers recent weeks.

Workers and R2: cloudflare_get_worker_settings shows a Worker's bindings but never secret values. R2 must be enabled on the account (Storage & databases → R2, the free tier is enough) before cloudflare_list_r2_buckets answers; otherwise it fails with 403 "NotEntitled".

Limits: Cloudflare allows 1,200 API requests per 5 minutes per token, dashboard use included. Over it Cloudflare answers 429 and blocks every call for 5 minutes: wait and try again. Analytics queries have their own limit of about 300 per 5 minutes.

Common errors: 400 with code 6003 usually means the Global API Key was pasted instead of an API token. 401 means the token is wrong, expired, disabled or limited to other client IP addresses: check it under My Profile → API Tokens. 403 (codes 10000 or 9109) means the token lacks a permission for that call or zone: edit the token and add it, for example Zone Read or DNS Read. 404 is an unknown zone, record or ruleset; from cloudflare_get_phase_rules it simply means the zone has no rules of that kind. "An identical record already exists" or "A CNAME record with that host already exists" names the record that is in the way.

The connector does not edit rulesets, Page Rules or zone settings, and does not handle SSL/TLS certificates, deploying or deleting Workers, KV, D1 or R2 objects, Zero Trust, the registrar or billing.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Cursor

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Cursor reads MCP servers from ~/.cursor/mcp.json. Add this entry:

{
  "mcpServers": {
    "anythingmcp": {
      "url": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart Cursor.
3. Open Cursor → Settings → MCP and check that anythingmcp is listed and connected.
4. Start chatting: the agent can now call the Cloudflare tools.

Available tools

Example prompts

• "Show me all DNS records of acme.com and tell me which ones are not proxied through Cloudflare."
• "Which redirect rules are set up on acme.com, and where does /blog end up?"
• "How much traffic did acme.com get each day last week, and which countries sent the most requests?"
• "Point the A record for shop.acme.com to 198.51.100.24, keep it proxied, and show me the old value before you change it."

FAQ

Does Cursor support custom MCP servers on the free tier? Yes, MCP is available on Hobby, Pro and Business plans.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Gemini
• Connect to Meta Muse