How to connect the Cloudflare MCP server

Quick answer

• URL: https://mcp.cloudflare.com/mcp. This server covers the whole Cloudflare API.
• Sign-in: OAuth. Your client opens Cloudflare in the browser and you choose which permissions to grant. For CI, send a Cloudflare API token as a Bearer header instead.
• Docs only: https://docs.mcp.cloudflare.com/mcp searches Cloudflare's documentation and needs no sign-in.
• Old `/sse` URLs now return 410 Gone. Replace them with the /mcp URL.

Which Cloudflare MCP server to use

The API server at mcp.cloudflare.com/mcp uses what Cloudflare calls Code Mode. Instead of one tool per API endpoint, it exposes a few tools: search to find endpoints, execute to run code against the API, docs and whoami. That covers about 2,500 endpoints in roughly a thousand tokens of tool definitions. Cloudflare recommends it for most account work: Workers, DNS, KV, R2, zones and so on.

Cloudflare also runs product servers at <name>.mcp.cloudflare.com/mcp:

• docs: searches the Cloudflare docs. No sign-in needed.
• browser: Browser Run, which fetches pages, takes screenshots and converts pages to markdown.
• containers: a sandbox container for running code.
• Others for Cloudflare One (dex, casb) and the Cloudflare blog.

Cloudflare's README marks several older servers as deprecated in favour of the API server, including observability, bindings, builds, logs, GraphQL, Radar and AI Gateway. If a tutorial tells you to add one of those, use mcp.cloudflare.com/mcp instead. The full list of servers and what each does is on the Cloudflare MCP listing.

Connect it to your client

Claude Code

claude mcp add --transport http cloudflare-api https://mcp.cloudflare.com/mcp

claude mcp list will show "Needs authentication" at first. That is expected. Run /mcp inside Claude Code, pick cloudflare-api and sign in in the browser. If it stays stuck, see fixing "needs authentication" in Claude Code.

Cursor

{
  "mcpServers": {
    "cloudflare-api": {
      "url": "https://mcp.cloudflare.com/mcp"
    }
  }
}

Open Customize → MCPs. Cursor offers to sign in when the server needs OAuth. More: how to add an MCP server to Cursor.

VS Code (GitHub Copilot)

{
  "servers": {
    "cloudflare-api": {
      "type": "http",
      "url": "https://mcp.cloudflare.com/mcp"
    }
  }
}

When the server starts, VS Code asks you to sign in to Cloudflare. Accept the prompt and finish the sign-in in the browser. More: how to add an MCP server to VS Code.

Codex

codex mcp add cloudflare-api --url https://mcp.cloudflare.com/mcp
codex mcp login cloudflare-api   # if the sign-in did not start on its own

Codex may start the browser sign-in straight away when you add the server. codex mcp list shows "Not logged in" until you finish it. More: how to add an MCP server to Codex.

Claude Desktop and claude.ai

Add https://mcp.cloudflare.com/mcp as a custom connector and sign in when asked. Don't put the URL in claude_desktop_config.json, which is for local servers. Steps: how to add an MCP server to Claude Desktop.

Clients that only support local (stdio) servers

Use the community mcp-remote package as a bridge. It runs locally, connects to the remote URL and handles the OAuth sign-in:

{
  "mcpServers": {
    "cloudflare-api": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.cloudflare.com/mcp"]
    }
  }
}

Only use it when your client can't connect to remote servers directly. Every client above can.

OAuth or an API token?

Cloudflare recommends OAuth for people. You choose permissions on Cloudflare's consent screen, and nothing secret is stored in your config file. If you later ask for something your grant doesn't cover, the server asks you to sign in again with the extra permission. In Claude this shows as a 403 insufficient_scope challenge; Codex and ChatGPT show it in the tool result.

Use an API token for CI and scripts, where no one can click through a browser sign-in. Create one in the Cloudflare dashboard with only the permissions the job needs. Both user tokens and account tokens work. Account tokens also need the Account Resources : Read permission so the server can find the account ID. Tokens with Client IP Address Filtering aren't supported.

Send the token as a Bearer header. Keep it in an environment variable, not in the file:

# Claude Code: the shell fills in the variable now, so the token is saved in ~/.claude.json
claude mcp add --transport http cloudflare-api https://mcp.cloudflare.com/mcp \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

# Codex: reads the variable each time it connects
codex mcp add cloudflare-api --url https://mcp.cloudflare.com/mcp --bearer-token-env-var CLOUDFLARE_API_TOKEN

{
  "mcpServers": {
    "cloudflare-api": {
      "url": "https://mcp.cloudflare.com/mcp",
      "headers": { "Authorization": "Bearer ${env:CLOUDFLARE_API_TOKEN}" }
    }
  }
}

Once a client sends an Authorization header, it won't also try OAuth. A bad token fails with HTTP 401. Claude Code reports it as "Server rejected the configured Authorization header (HTTP 401)" and notes that OAuth fallback is disabled. Remove the header to go back to signing in.

Optional: one tool per endpoint

Adding ?codemode=false to the URL (https://mcp.cloudflare.com/mcp?codemode=false) registers a separate tool for every API endpoint. Cloudflare puts that at about 244,000 tokens of tool definitions, which is more than many models' whole context. Stick with the default unless your client needs plain tools.

MCP server portals (teams)

An MCP server portal is a Cloudflare One (Zero Trust) feature that puts several remote MCP servers behind one URL, with Cloudflare Access deciding who can use which servers and tools. It suits teams that want one approved endpoint instead of every developer adding servers on their own. You need a domain on Cloudflare and an identity provider set up in Zero Trust.

1. In the Cloudflare One dashboard, go to Zero Trust → Access controls → MCP Portals.
2. On the MCP servers tab, add each server with a name and its HTTP URL (for example https://docs.mcp.cloudflare.com/mcp), attach Access policies, then save and connect. The status changes to Ready once Cloudflare can reach it.
3. Add a portal: give it a name and a custom domain on one of your zones, choose its servers and the tools and prompts to expose, and attach Access policies.
4. Point clients at https://<subdomain>.<your-domain>/mcp. Users sign in through Access the first time they connect.

Limits to know: portals only work with remote HTTP servers, not stdio-only ones. A portal holds up to 80 servers. Some Access features, such as independent MFA and purpose justification, aren't enforced through a portal. A portal policy also doesn't stop someone who has a server's direct URL, so lock down the servers themselves too. For automation, Access service tokens let a machine connect without a browser sign-in.

Check that it works

Ask the agent "Which Cloudflare account am I connected to?", which should call whoami. Then try something read-only, such as "List my Workers". To test the connection outside any client, list the docs server's tools with the MCP Inspector CLI:

npx -y @modelcontextprotocol/inspector --cli https://docs.mcp.cloudflare.com/mcp --transport http --method tools/list

The output should include search_cloudflare_documentation. The API server returns 401 to the Inspector until you sign in, which is expected.

The API server can change real settings: DNS records, Workers, firewall rules. Start with read-only requests, grant only the permissions you need, and read each execute call before you approve it.

Troubleshooting

• 410 Gone: you're using an old /sse URL. Cloudflare retired SSE. Change the URL to end in /mcp.
• 401 Unauthorized: you haven't signed in yet, or the token is wrong. Finish the OAuth sign-in (/mcp in Claude Code, codex mcp login in Codex), or check the token and the Bearer prefix.
• 403 or "insufficient scope": your grant doesn't include what you asked for. Accept the re-authorization prompt, or add the permission to your API token.
• The server can't find your account: an account token is missing Account Resources : Read. Add it, or use a user token.
• A token that works in curl fails here: it may have Client IP Address Filtering, which the server doesn't support.
• "Claude's response was interrupted": usually the context filled up. Results are capped at about 6,000 tokens and marked --- TRUNCATED ---, so ask a narrower question, such as one zone instead of all of them.
• A feature returns an error on a free account: some products need a paid Workers plan.

Related: Cloudflare skills and building your own server

Cloudflare also publishes agent skills for its platform. In Claude Code, add them with /plugin marketplace add cloudflare/skills, or install them with npx skills add https://github.com/cloudflare/skills (see how to create agent skills). To build and host your own MCP server on Workers, the Cloudflare MCP listing has the starter template command.

FAQ

Do I need a paid Cloudflare plan?

You need a Cloudflare account. Anything you create or run through the server is billed like any other use of your account, and Cloudflare's README notes that some features need a paid Workers plan.

What is the difference between cloudflare/mcp and cloudflare/mcp-server-cloudflare?

cloudflare/mcp is the repository for the Code Mode API server at mcp.cloudflare.com/mcp. cloudflare/mcp-server-cloudflare holds the product servers, such as docs, Browser Run and containers, plus the deprecated ones.

Can I run the Cloudflare MCP server locally?

You don't need to. The servers are hosted, and clients connect over HTTP. If your client only runs local servers, use mcp-remote as shown above.

Does it work with ChatGPT?

Cloudflare's docs mention ChatGPT alongside Claude and Codex. Any client that can connect to a remote MCP server with OAuth can use it.