Verified MCP server: Cloudflare
The short answer
Last verified 2026-08-03
Cloudflare does not ship one MCP server, it ships seventeen, and knowing which is which saves an afternoon. Sixteen are domain servers at addresses like observability.mcp.cloudflare.com and bindings.mcp.cloudflare.com, and a seventeenth, the Code Mode server at mcp.cloudflare.com, reaches the whole Cloudflare API. All of those ask you to sign in to Cloudflare with OAuth, or to send a Cloudflare API token, before they will do anything. Exactly one takes no credential at all: the documentation server at docs.mcp.cloudflare.com, which searches every page of the Cloudflare developer docs. That is the one we verified, because it is the one anybody can try in a minute. We spoke the protocol to it from this Mac, enumerated the tools it returns, ran a real documentation search, and then deliberately broke it four ways, including pointing a client at one of the account servers with no credential to see exactly what that refusal looks like. All of the raw output is on this page. [3][4][11][1]
Verification
Method
The server we verified is the one Cloudflare hosts at https://docs.mcp.cloudflare.com/mcp, so there is no local process and no startup banner to read. We spoke raw JSON-RPC over Streamable HTTP to it from this Mac: initialize, then notifications/initialized, then tools/list, then one real documentation search. No credential was used and none was needed, which is the whole point of this particular endpoint. We then ran four failure probes on purpose: an invented tool name, a call with the required argument missing, the same address with a trailing slash, and an anonymous handshake against bindings.mcp.cloudflare.com, one of the account servers, to capture what its refusal actually says. Finally we repeated the handshake through the npx mcp-remote bridge, the path stdio-only clients take, and it returned the same two tools. The tool table below is the tools/list response, word for word. Two of those probes failed at the HTTP layer rather than inside MCP, so their entries in the troubleshooting section are printed the way curl -i prints a response: the status line, then the www-authenticate header where the server sent one, then the body. Every piece is exactly as the run banked it, and only the assembly into one block is ours.
Startup banner
event: message
data: {"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":true},"prompts":{"listChanged":true}},"serverInfo":{"name":"docs-ai-search","version":"0.4.10"}},"jsonrpc":"2.0","id":1}One real tool call
tools/call search_cloudflare_documentation {"query": "How do I set a cache TTL with Cache Rules?"}<result> <url>https://developers.cloudflare.com/changelog/39/</url> <title>39</title> <text> #### How it works Using the `cf` object in `fetch()`, you can override specific Cache Rules settings by:
Real lines from the captured result: enough to prove the call answered.
Tools
The server answered tools/list with 2 tools on 2026-08-03. The names, descriptions and parameters below are its own words, copied from that response and never edited.
| Tool | What it does |
|---|---|
| search_cloudflare_documentationquery* | Search the Cloudflare documentation. This tool should be used to answer any question about Cloudflare products or features, including: - Workers, Pages, R2, Images, Stream, D1, Durable Objects, KV, Workflows, Hyperdrive, Queues - AI Search, Workers AI, Vectorize, AI Gateway, Browser Run - Zero Trust, Access, Tunnel, Gateway, Browser Isolation, WARP, DDOS, Magic Transit, Magic WAN - CDN, Cache, DNS, Zaraz, Argo, Rulesets, Terraform, Account and Billing Results are returned as semantically similar chunks to the query. |
| migrate_pages_to_workers_guide | ALWAYS read this guide before migrating Pages projects to Workers. |
Parameters marked with * are required.
Setup
Copy the block for the app you use. Each one is the configuration this server was verified with.
Open the file ~/Library/Application Support/Claude/claude_desktop_config.json (in Claude Desktop: Settings, then Developer, then Edit Config) and add:
{
"mcpServers": {
"cloudflare-docs": {
"command": "npx",
"args": [
"mcp-remote",
"https://docs.mcp.cloudflare.com/mcp"
]
}
}
}That npx line is the mcp-remote bridge, which turns a hosted server into the local command older clients expect. We ran this exact bridge during verification and it returned the same two tools. If your Claude Desktop has the Connectors page, there is a shorter route with no JSON and no bridge: Settings, then Connectors, then Add custom connector, and paste the address on its own. There is no token to add either way. [12][15][10]
One command in your terminal, with no token and no bridge:
claude mcp add --transport http cloudflare-docs https://docs.mcp.cloudflare.com/mcp
The project file equivalent is an .mcp.json entry with "type": "http" next to the "url". Claude Code treats a url with no type as a configuration error, so do not leave it out. Cloudflare also publishes a plugin that wires up its whole server family at once: /plugin marketplace add cloudflare/skills, then /plugin install cloudflare@cloudflare. [14][13]
Add to ~/.cursor/mcp.json for every project, or to .cursor/mcp.json inside one project:
{
"mcpServers": {
"cloudflare-docs": {
"url": "https://docs.mcp.cloudflare.com/mcp"
}
}
}The url key is what marks the entry as remote, so there is no command to run and nothing to install. This server needs no headers block, because it accepts anonymous calls. The account servers do need one, and that is where a Cloudflare API token would go. Cursor picks the file up on restart. [16][11]
No JSON file and no terminal. In Routines: Settings, then Assistant, then Connections, then Add MCP Server. The form already opens in URL (SSE/HTTP) mode, which is the mode this server needs:
Name Cloudflare Docs Server URL https://docs.mcp.cloudflare.com/mcp Bearer token (leave empty)
Leave the Command (stdio) toggle alone: this server is a web address, not a command. The Bearer token field stays empty for the documentation server, and it is the field you would fill with a Cloudflare API token if you were connecting one of the account servers instead. Click Test Connection first, which opens the connection and reports the tool count without saving anything. [17][11]
No terminal needed
If you have never opened Terminal and never want to, this is your path, and this particular server is the gentlest one in the directory: there is no account to make and no token to copy. Routines is a Mac app that connects MCP servers for you: paste one web address once, and this server's tools are available to your AI in chat and in scheduled routines.
01
Download the app from getroutines.ai/download, drag it to Applications, and sign in.
02
Click your account at the bottom of the sidebar and choose Settings. Open the Assistant section, then the Connections tab, scroll to MCP Servers, and click Add MCP Server.
03
The form opens in URL mode already, which is what a hosted server needs, so leave the Command (stdio) toggle alone. Name: Cloudflare Docs. Server URL: https://docs.mcp.cloudflare.com/mcp. No trailing slash: we tested one and the endpoint answered 404.
04
The Bearer token field stays blank. The documentation server accepts anonymous calls, which is why it is the one Cloudflare server you can connect without a Cloudflare account at all.
05
Click Test Connection: Routines opens the connection and reports how many tools it found, two for this one. Then click Add Server.
06
The tools work in chat right away, so you can ask a Cloudflare question and get an answer with links to the exact doc pages. To let a scheduled routine use them, open the routine, find the Tools & connections card, and tick the server under Apps.
Routine ideas
Once the server is connected, a scheduled routine can use its tools while you are away. Copy a prompt, paste it into Routines, and pick a time.
Every Monday at 9:00, search the Cloudflare documentation for the current limits, quotas and pricing notes on Workers, KV, R2 and D1, and save what you find as cloudflare-limits.md with a link to each documentation page you used.
Every Friday at 15:00, read the questions I wrote into cloudflare-questions.md this week, look each one up in the Cloudflare documentation, and write the answers with a source link per answer into cloudflare-answers.md.
On the first Tuesday of each month at 10:00, search the Cloudflare documentation for the current recommended way to cache and purge assets, compare it against my cdn-setup.md notes, and list anything that no longer matches so I can fix the notes.
Troubleshooting
Real errors captured during the verification run, printed exactly as the server returned them.
What you see
{"jsonrpc":"2.0","id":4,"error":{"code":-32602,"message":"Tool search_docs not found"}}The fix
There is no search_docs on this server. The documentation tool is called search_cloudflare_documentation, and the only other one is migrate_pages_to_workers_guide. When you see this, name the tool in your prompt rather than describing it, and the model stops guessing.
What you see
Input validation error: Invalid arguments for tool search_cloudflare_documentation: query: Invalid input: expected string, received undefined
The fix
The tool takes exactly one argument, query, and it is required. We produced this by calling it with an empty argument object. It usually happens when a prompt asks the assistant to search Cloudflare without saying what for, so put the actual question in the request: ask for the cache TTL settings, not for a Cloudflare search.
What you see
404 Not Found Not Found
The fix
This is what a trailing slash gets you: https://docs.mcp.cloudflare.com/mcp works and https://docs.mcp.cloudflare.com/mcp/ does not. The other address that works is the older /sse path on the same host, which Cloudflare keeps as a plain alias for the same handler rather than as a separate transport, and we confirmed it answers the identical handshake. Copy the address without the trailing slash and test again.
What you see
401 Unauthorized
www-authenticate: Bearer realm="OAuth", resource_metadata="https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token"
{"error":"invalid_token","error_description":"Missing or invalid access token"}The fix
We aimed an anonymous handshake at bindings.mcp.cloudflare.com to capture this. Every Cloudflare server except the documentation one is gated: your client has to complete a Cloudflare OAuth sign-in, which happens in the browser, or send a Cloudflare API token as a bearer header, which is the path Cloudflare documents for automation. The resource_metadata address in that reply is the record OAuth-capable clients read to start the sign-in.
The fix
This only affects the mcp-remote route, the one older clients use to reach a hosted server. The npx command belongs to Node.js, so if Node is not installed on your Mac the client fails at the spawn step before anything is contacted. Install Node from nodejs.org, restart your MCP client, and try again. Clients that speak remote HTTP natively, Claude Code, Cursor and Routines among them, skip the bridge and skip this problem.
FAQ
It is a family rather than a single thing. Cloudflare runs seventeen Model Context Protocol servers of its own, all hosted by Cloudflare and reached over HTTPS. Sixteen are domain servers, one per area: Workers bindings, observability, Radar, browser rendering, AI Gateway, logs, DNS analytics, CASB and the rest. The seventeenth, the Code Mode server at mcp.cloudflare.com, reaches the wider Cloudflare API. The one this page verified is the documentation server at docs.mcp.cloudflare.com, which searches the Cloudflare developer docs and asks for no credential. [11][3][2]
The documentation server answered tools/list with 2 tools on the day of this run: search_cloudflare_documentation, which takes a single query string and returns matching chunks of the developer docs with their page URLs, and migrate_pages_to_workers_guide, which takes no arguments and returns the Pages to Workers migration guide. The table above is that response, word for word. The account servers each carry their own set, which you only see after signing in to Cloudflare. [11]
Not the documentation server. Cloudflare states plainly that this one requires no authentication, and our run is the proof: we called it with no header of any kind and it answered. Every other server in the family does need one, either a Cloudflare OAuth sign-in in the browser on first use, or a Cloudflare API token sent as a bearer header for automated setups. We captured the exact refusal one of them gives an anonymous client, and it is printed in the troubleshooting section above. [4][11]
For the documentation server the answer is unusually simple: it only reads public Cloudflare documentation, both its tools are marked read-only by the server itself, and it holds nothing of yours because you gave it nothing. The caution belongs to the rest of the family. Once you authorize an account server, its tools act on your real Cloudflare account, and the Workers bindings server exists specifically to manage storage and compute. Grant those the narrowest scopes you can, and check what a tool does before you let a scheduled job call it. [4][11]
No, and the name collision is genuinely confusing. That npm package stops at version 0.2.0, published in March 2025, and it is the old local server you ran on your own machine after npx wrangler login. npm does not flag it deprecated and it still pulls tens of thousands of downloads a week, almost certainly from tutorials written before Cloudflare moved to the hosted family. The current monorepo carries the same package name internally, at version 1.0.0 and marked private, so it is never published. Point your client at a mcp.cloudflare.com address instead of installing anything. [8][9][7][11]
Both numbers are real and we captured both. The documentation server is a Cloudflare Worker, not an npm package, so the only version number in the source is the one in its own package.json, currently 0.4.11. Over MCP, the endpoint that is actually deployed introduced itself as docs-ai-search 0.4.10. The gap is simply the newest commit not being live yet, and it is the sort of thing you only notice when you speak to the server instead of reading its repository. [5][6]
Any MCP client that can talk to a remote HTTP server: Claude Code, Cursor and Routines connect to the address directly, and Claude Desktop connects either as a custom connector or through the npx mcp-remote bridge, which we tested. The exact configuration for each is above. Cloudflare also ships a Claude Code plugin that adds its whole server family in one step. [14][16][15][17][13]
Sources
Anything on this page we did not observe in the run is linked here, with the date we read it. The run itself is the receipt for the rest.
[1]
4,019 stars, Apache-2.0, last push 2026-07-30, not archived, owner cloudflare, at access time.
[2]
The separate Code Mode server behind mcp.cloudflare.com: 692 stars, Apache-2.0, last push 2026-07-31, not archived.
[3]
The table of sixteen domain servers with their addresses, and the note that /sse is kept as a URL alias for the same stateless handler rather than the old SSE transport.
[4]
States verbatim: "This public documentation server does not require authentication." Names the single search tool and the https://docs.mcp.cloudflare.com/mcp address.
[5]
Name docs-ai-search, version 0.4.11, private true: never published to npm.
[6]
The 0.4.10 entry records the move to a stateless SDK and keeping /sse as a URL alias only.
[7]
Name @cloudflare/mcp-server-cloudflare, version 1.0.0, private true, Apache-2.0: the same name as the old published npm artifact, which is where the confusion comes from.
[8]
Latest version 0.2.0, published 2025-03-14, not flagged deprecated: the old local server that required npx wrangler login.
[9]
55,812 downloads for the week ending 2026-08-01, on a package whose last release is dated 2025-03-14.
[10]
Latest version 0.1.38, published 2026-02-05. The bridge that lets a stdio-only client reach a hosted server.
[11]
The full list of endpoints, the OAuth-on-connect statement, and the Cloudflare API token as a bearer header for automated setups.
[12]
Shows the Claude Desktop JSON that runs npx mcp-remote against a hosted address.
[13]
The server table including the documentation address, and the /plugin marketplace add cloudflare/skills install path.
[14]
The claude mcp add --transport http syntax, and the rule that an .mcp.json entry with a url needs a type field.
[15]
Settings, then Connectors, then Add custom connector: the no-JSON path for a hosted server.
[16]
The mcp.json shape for a remote server, a url key with an optional headers object, and the file locations.
[17]
How Routines runs one-click OAuth connectors and any MCP server.
This page describes Cloudflare as it behaved in one dated run on one Mac. Versions move: if something here no longer matches what you see, the capture date at the top says how old the reading is.
Behind this directory
Routines, the app behind this directory, connects MCP servers like this one without a terminal: see how connectors work. The notes it writes stay markdown files on your Mac, and there is no cloud bill. Download Routines