Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 4
- 4 6
- 3 0
- 2 0
- 1 0
Trust in production
- Trust it - 80%
- With caveats - 20%
- Wouldn't - 0%
100% would recommend this server
How reviewers scored it
- Setup & docs 4.3
- Auth experience 4.4
- Reliability 4.3
- Maintainer responsiveness 4.3
Why it got an A
Cloudflare's own server, open source and hosted over HTTPS. OAuth starts with minimal scopes, you pick a read-only or full-access grant, and it asks for more only when a call needs it. Agent code runs in an isolated sandbox, created on demand, that can only reach the Cloudflare API. It earns full marks, but it can change DNS, deploy or delete Workers and edit firewall rules, so choose read-only at sign-in unless you need writes. The older Bindings, Observability and Radar servers are deprecated in favour of this one.
How to connect
// ~/.cursor/mcp.json (hosted, OAuth; Cloudflare's documented config)
{ "mcpServers": { "cloudflare-api": { "url": "https://mcp.cloudflare.com/mcp" } } }Is Cloudflare API MCP Server safe?
Is Cloudflare API MCP Server safe to use?
Cloudflare API MCP Server grades A: all four checks are at full marks. Strong public trust signals. It is still not a full audit, so give it the narrowest access that works.
Does Cloudflare API MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Cloudflare API MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Cloud & Hosting
- A AWS MCP ServerAWS's managed remote server for calling any AWS API, running sandboxed scripts, and searching AWS docs.
- A Netlify MCP ServerNetlify's official MCP server, hosted at mcp.netlify.com or run from npm, to create and deploy projects and manage env vars and secrets, forms, extensions and access controls.
- A Railway MCP (railway mcp in the Railway CLI)Railway's official MCP server, built into the Railway CLI and hosted at mcp.railway.com, to list projects and services, redeploy, and manage feature flags.
- A Render MCP ServerRender's official MCP server, hosted at mcp.render.com or run locally, to create services and databases, read logs and metrics, update environment variables and trigger deploys.
- B Argo CD MCP Server (argocd-mcp)The Argo CD MCP server from argoproj-labs, run from npm or Docker, to list, create, sync and delete Argo CD applications and read resource trees, events and workload logs.
Embed this badge
[](https://trustedmcp.io/servers/cloudflare-mcp)<a href="https://trustedmcp.io/servers/cloudflare-mcp"><img src="https://trustedmcp.io/badge/cloudflare-mcp.svg" alt="TrustedMCP grade A" height="80"></a>Community reviews
Set it up once, forgot about it
Tried it on a side project first, then rolled it out at work. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Filed an issue and got a reply within two days.
Used for Managing preview environments
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Easy win for our agent setup
Set this up for our team after comparing a few options. Updates land regularly, and nothing broke when I upgraded. Sign-in flow was painless and I never had to paste a key into a config file. I would use it in prod, but only with a human approving writes.
Used for Managing preview environments
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Solid and well behaved
Hooked Cloudflare API MCP Server into Claude Code and it worked on the first try. Scoped the token to just what the agent needs and it respected that. Read-only mode is the first thing I enable, and it covers most of what I need.
Used for Spinning up test resources
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Clean integration, sensible permissions
Replaced a homegrown script with Cloudflare API MCP Server and have not looked back. Hosted endpoint means no local process to babysit. The scope options are worth reading carefully, the defaults are broader than I wanted. Recommended, with sensible guardrails.
Used for Checking deploy status from chat
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Our team uses it every day
Started with it as an experiment, now it is a fixture. You can tell it is actively maintained, the rough edges keep getting fixed. Sign-in flow was painless and I never had to paste a key into a config file. Easy recommendation.
Used for Checking deploy status from chat
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Exactly what I needed from Cloudflare API
Clear tool names, sensible outputs, very few surprises. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Would recommend without hesitation.
Used for Reading logs during incidents
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Installed it on a Friday, it was part of my workflow by Monday. Being official from Cloudflare counts for a lot when I pitch it to security. Auth is handled properly, and revoking access later was one click. Good choice if you need Cloudflare API in your agent.
Used for Inventory of what is running where
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Better than the DIY script it replaced
Our agents call this dozens of times a day. Releases come often and the changelog is clear. Read-only mode is the first thing I enable, and it covers most of what I need. Scoped the token to just what the agent needs and it respected that. Happy to run it in production.
Used for Reading logs during incidents
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Surprisingly polished
I use this almost daily. Auth is handled properly, and revoking access later was one click. It is in our production agent and I sleep fine.
Used for Cost checks across projects
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Quietly reliable
Of the Cloudflare API integrations I tried, this one is the most predictable. Scoped the token to just what the agent needs and it respected that. Happy to run it in production.
Used for Cost checks across projects
- Setup & docs 5/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.