Cloudflare MCP

Core Philosophy

1. Readonly by default — All write operations blocked until you explicitly grant permission. Ask before making live changes.
2. Natural language control — Describe what you want; the server translates to Cloudflare API calls.
3. Confirm before write — Always summarize the change and ask for confirmation before applying.
4. Zone-scoped — Operations target specific zones (domains); validate zone exists before acting.
5. Reversible where possible — Prefer non-destructive operations; warn when action is irreversible.

Quick-Start: Common Problems

"Show me my websites"

Ask: "List all my Cloudflare zones"

• Returns zone names, status, and plan

"Add a DNS record"

1. Check readonly mode status first — "Is readonly mode enabled?"
2. Ask user to disable: "I need to add a DNS record to example.com. Please disable readonly mode."
3. After permission: create the A/CNAME/MX/TXT record

"Purge the cache for example.com"

1. Confirm readonly is off
2. Purge by URL list or purge everything
3. Confirm success

"Block IP / set firewall rule"

1. Verify zone
2. Describe the rule (IP, country, User-Agent match)
3. Set action: block / challenge / allow
4. Confirm before writing

Decision Trees

Reference Index