Add Cloudflare to your AI agent

Create a Cloudflare Pages project for a production branch.

Create a Turnstile challenge widget for selected domains.

Create a user API token carrying supplied grants. Secure the one-time `result.value`; without `not_before` it is active immediately.

Create a beta Worker resource and configure its observability, previews, subdomain, tags, and tail consumers.

Deploy existing Worker versions immediately to live traffic by percentage. `force` can bypass rollback blocks after secret changes.

Upload code, assets, and configuration as a new Worker version without deploying it to production traffic. Bindings and settings are NOT copied from earlier versions. Pass every binding again, or pass {name, type: "inherit"} to carry an existing binding forward.

Create a Cloudflare DNS zone for a domain, optionally specifying the account and zone setup mode.

Permanently and irreversibly revoke an account-owned Cloudflare API token. Use only the specifically intended token ID; a revoked token cannot be restored.

Tool to delete a DNS record within a specific zone. Deletion is immediate and irreversible. Use only after confirming both zone and record IDs. Requires write privileges on the zone. Example: "Delete DNS record 372e6795... from zone 023e105f4ecef..."

Tool to delete a WAF list. Use when you need to remove a list after verifying no filters reference it. Example: DELETE_LIST(account_id="<account_id>", list_id="<list_id>")

Delete a selected non-production Cloudflare Pages deployment.

Permanently revoke one user-owned Cloudflare API token.

Permanently delete a beta Worker and its versions and deployments.

Delete a classic Worker script. Forced deletion may break service bindings and deletes its Durable Object namespaces.

Tool to delete a zone. Use after confirming the zone identifier to permanently remove a DNS zone and all its DNS records from your Cloudflare account. Example: DELETE_ZONE(zone_identifier="023e105f4ecef8ad9ca31a8372d0c353")

Upload or replace a JavaScript module Worker script and create its latest version.

Upload static assets, create a Worker version, and deploy all traffic to it. Destructive: the new version replaces the live one for 100% of traffic. Only binding types listed in `keep_bindings` (secrets by default) and bindings passed in `bindings` survive; every other existing binding (KV, D1, R2, vars, services, ...) is dropped. List those types in `keep_bindings` to preserve them. Asset routing (`asset_config`) and compatibility flags are not inherited either and must be passed again on each deploy.

Download the raw source or multipart module bundle for a Worker script.

Execute SQL against one Cloudflare D1 database. SQL may read, write, or permanently delete database data or schema.

Retrieve one Cloudflare account by its exact account ID.

Return whether an account has exhausted its Worker build minutes and when they refresh.

Retrieve the identity, roles, policies, and status of an account member.

Retrieve metadata and policies for one account-owned API token.

Tool to retrieve a zone's Bot Management configuration (Bot Fight Mode / Super Bot Fight Mode / Enterprise Bot Management). Use after identifying the correct zone_id (e.g., via CLOUDFLARE_LIST_ZONES). This tool is the canonical way to audit bot-related configuration; firewall rules are adjacent controls but not equivalent to Bot Management settings.

Retrieve identity and account-membership details for the current user.

Get details for one D1 database, optionally selecting response fields.

Retrieve metadata for one Cloudflare Workers KV namespace.

Retrieve a key's value from a Workers KV namespace. The response contains decoded text or base64-encoded binary content, along with its content type and any expiration.

Fetch WAF lists for a Cloudflare account without their items.

Retrieve one Access AI Controls MCP server and its synchronization state.

Retrieve one Cloudflare Pages deployment and its current build status.

Retrieve build log lines for one Cloudflare Pages deployment.

Retrieve one Cloudflare Pages project and its configuration.

Request a short-lived JWT for Cloudflare Pages Direct Upload assets.

Retrieve the current configuration of a remotely managed Cloudflare Tunnel.

Retrieve metadata and policies for one user-owned API token.

Retrieve one beta Worker resource by its exact ID or name.

Retrieve a specific or latest deployment for a Worker Preview.

Retrieve a Worker script's metadata and runtime configuration.

Inspect workers.dev and preview URL availability for a Worker script.

Retrieve detailed information for one classic Worker script version.

Retrieve one beta Worker version; optional code modules may add megabytes.

Retrieve the input and output JSON Schemas for a Workers AI model.

Return the workers.dev subdomain configured for a Cloudflare account.

Retrieve one Workflow's configuration, metadata, schedules, and counts.

Retrieve logs, status, and execution details for one Workflow instance.

Retrieve one Cloudflare zone and its configuration, status, and metadata.

Retrieve the latest active zone entrypoint ruleset for a Rulesets phase.

Fetch one setting for a Cloudflare zone by setting name.

Return one page each of KV namespaces, Workflows, and D1 databases.

List a page of Cloudflare account members with their user details, roles, permissions, status, and access policies when available. Supports filtering by membership status and sorting and pagination.

List billing subscriptions and plan details for one Cloudflare account.

List account-owned API token metadata and policies with pagination.

List all Cloudflare accounts you have ownership or verified access to. Retrieves a paginated list of accounts with their details including account ID, name, type, settings, and creation date. An empty or partial result may indicate insufficient API token scope or permissions, not the absence of accounts. When multiple accounts are returned, confirm the intended account_id before performing any write operations to avoid acting on unintended environments. Use this when you need to: - Discover available accounts before performing account-specific operations - Find an account ID for other API calls that require an account identifier - Audit account configurations and settings - Filter accounts by name or paginate through large account lists

List one page of D1 databases in an account. Increment `page` until `result_info` shows all matching databases have been retrieved.

List and search one page of DNS records in a Cloudflare zone, including record IDs and properties. When both exact and substring filters are supplied for a name or content, the substring filter takes precedence; use pagination to retrieve further results.

List one page of Email Routing destination addresses configured for an account, optionally filtering by verification status. Use pagination to retrieve further results.

List one page of firewall rules for a specific DNS zone for auditing. Use pagination to retrieve further rules.

List key names and metadata in a Cloudflare Workers KV namespace.

List Cloudflare Access AI Controls MCP portals with pagination and search.

Tool to list all load-balancer monitors in a Cloudflare account. Use after creating or updating monitors to retrieve a paginated list. Response includes `result_info.total_pages` to determine when all pages have been fetched.

List production or preview deployments for a Cloudflare Pages project. Use `environment` to filter by deployment type and `page` with `per_page` to traverse results; inspect `result_info.total_pages` to determine whether another page is available.

List custom domains attached to a Cloudflare Pages project, including their validation and verification state.

List Pages projects in a Cloudflare account. Use `page` and `per_page` to traverse results and inspect `result_info.total_pages` for additional pages.

Tool to list all load balancer pools in a Cloudflare account. Use after confirming account ID to discover pool IDs. Paginate using `page` and `per_page`; check `result_info.total_pages` in the response to determine if additional pages exist.

List domains registered through Cloudflare Registrar.

List entries in one Cloudflare account rule list.

List Cloudflare Web Analytics sites for an account. Use `order_by` to sort by hostname or creation time and `page` with `per_page` to traverse results; inspect `result_info.total_pages` to determine whether another page is available.

List Cloudflare Tunnel (cloudflared) tunnels in an account to discover tunnel IDs, names, and statuses. Use when you need to find a tunnel_id before performing tunnel operations like routing, DNS configuration, or debugging.

List Turnstile widgets configured for a Cloudflare account, returning widget summaries without secret keys.

List one page of metadata for API tokens created by the connected Cloudflare user without returning token secrets.

List Workers Builds trigger configurations associated with one Worker tag.

List one page of Workers CI builds associated with an immutable Worker tag.

List one page of deployment history for a classic Worker script.

List Worker route patterns and script assignments for a Cloudflare zone.

List classic Worker script versions, optionally filtering to deployable versions. The first item is the latest version. Use `page` and `per_page` to paginate unless `deployable` is true, in which case Cloudflare ignores pagination.

List uploaded classic Worker scripts, optionally filtering by tag rules.

List the names and types of secrets bound to one Worker script.

List unique values observed for a Workers telemetry field.

List paginated versions of a Cloudflare Worker. Use `page` and `per_page` to traverse results; version objects are preserved as returned so provider-added fields remain available.

List account Workers with optional sorting and page-based pagination.

List Workers Builds authentication token metadata for an account, with optional pagination.

List custom domains routed to Workers in a Cloudflare account.

List Workflow executions with state, UTC date, and cursor filters.

List and search account Workflows. Use page and per_page to traverse results.

List, search, sort, and filter accessible Cloudflare zones. Use page and per_page to paginate results; result_info includes the page, per-page count, and total count.

Get a Worker's Cron Triggers, or replace all triggers when schedules is supplied.

Execute a parameterized Cloudflare Analytics SQL SELECT statement.

Run a read-only query against Cloudflare's GraphQL Analytics API.

Run a saved or ad-hoc Workers Observability telemetry query.

Replace every item in a Rules List and poll for the bulk operation outcome. If the wait times out, the operation is not cancelled and may still be running.

Trigger a fresh activation check for a pending Cloudflare zone. Cloudflare allows one check every five minutes on paid plans and once per hour on free plans.

Irreversibly rotate an Account Owned API token secret. This destructive credential rotation immediately invalidates the current secret and returns its replacement only once. Confirm the token and update dependent integrations.

Promote a previous successful Pages deployment back to production.

Run a Workers AI model and return non-streaming JSON; streaming is unsupported.

Render a URL or supplied HTML and return elements matching CSS selectors.

Register a Worker static-asset manifest and return a one-hour JWT and hash buckets for later asset-upload calls; this action does not upload asset bytes.

Tool to update an existing DNS record within a specific zone. Use after confirming both zone and record identifiers; only provided fields are modified. Updates to records used by active tunnels take effect immediately and can disrupt live traffic.

Tool to update the description of a WAF list (cannot update items). Use after confirming list metadata.

Rename a Pages project or update its production branch, build configuration, deployment environments, or source repository settings.

Tool to update a remotely-managed Cloudflare Tunnel's configuration (ingress rules and routing). Use when you need to programmatically configure hostname-to-origin mappings for a tunnel. WARNING: This operation REPLACES the entire configuration - incorrect configuration can break routing and make services unreachable. Best practice: fetch current configuration first (if patching) to preserve existing rules. At least one ingress rule is required, and the last rule should typically be a catch-all (hostname='*' or omitted) with service='http_status:404'.

Create a new Preview deployment by merge-patching bindings or annotations on an existing Preview deployment.

Patch Worker configuration and metadata, creating a new version.

Enable or disable a Worker script and its previews on workers.dev.

Tool to update properties of an existing zone; changes apply immediately to the live zone. Confirm zone ID and intended change with the user before calling. Only one field can be modified per call.

Replace a zone phase entrypoint ruleset. WARNING: this is a full replacement, not a patch; omitted body fields may reset existing configuration.

Upload static assets and register their hashes for a Pages deployment.

Upload one bucket of base64-encoded Worker static assets.

Upload a module-syntax classic Worker version without deploying it. Warning: a new version does not inherit the previous version's bindings. Only binding types in metadata.keep_bindings (secrets by default) are kept; every other binding (KV, D1, R2, services, vars, ...) must be passed in metadata.bindings, for example as {"type": "inherit", "name": "MY_KV"}, or it is missing once this version is deployed.

Add or replace one secret binding, creating a new Worker version.

Create or replace a UTF-8 value in a Cloudflare Workers KV namespace.

Retrieve the deployed content of one Cloudflare Worker script.

Retrieve deployed content for a legacy Worker service environment.

List Workers KV namespaces in a Cloudflare account. Sort by namespace `id` or `title` with `order` and `direction`, and paginate with `page` and `per_page`. The response preserves additional namespace fields returned by Cloudflare.

List queues owned by a Cloudflare account.