stackgate.ai
All integrations

Cloudflare

Connect Claude, ChatGPT or Cursor to Cloudflare via MCP. OAuth or API token — manage zones, DNS, cache purge, Workers, KV, R2, D1, and Pages.

Manual setup 50 tools

Overview

Connect Cloudflare so AI clients can manage your zones, DNS records, cache, Workers, KV, R2, D1, Pages, load balancers, and related account resources through MCP.

This integration uses the Cloudflare API v4 (https://api.cloudflare.com/client/v4). Connect with OAuth (recommended when the hub app is configured) or paste a long-lived API token. stackgate.ai stores credentials encrypted and never asks AI clients to pass them as tool arguments.

Prerequisites

  • A Cloudflare account with access to the zones/accounts you want to manage
  • A stackgate.ai account

Option A — Connect with OAuth

  1. Open My Integrations → Cloudflare.
  2. Click Connect Cloudflare and sign in to Cloudflare.
  3. Choose the account(s) to authorize and review the requested permissions.
  4. Optionally save a Default account ID on the setup form so account-scoped tools do not need it on every call.

OAuth access tokens can expire; stackgate.ai refreshes them automatically when a refresh token is present.

Option B — Add with API token

  1. Sign in to the Cloudflare dashboard.
  2. Go to My Profile → API Tokens and choose Create Token.
  3. Prefer a Custom token with least-privilege permissions for the tools you need. Common groups:
    • Zone → Zone → Read and Zone → DNS → Edit — list zones and manage DNS
    • Zone → Cache Purge → Purge — cache purge
    • Zone → Zone Settings → Edit — zone settings / SSL mode
    • Account → Workers Scripts → Edit, Workers KV Storage → Edit — Workers and KV
    • Account → Workers R2 Storage → Edit, D1 → Edit, Account → Cloudflare Pages → Read — R2, D1, Pages
    • Account → Account Settings → Read — list accounts / members
  4. Restrict the token to specific accounts and zones when possible.
  5. Copy the token once (Cloudflare shows it only at creation time).
  6. Optionally note your Account ID from any zone overview sidebar in the dashboard.
  7. In stackgate.ai, open My Integrations → Cloudflare, expand Add with API token (or API token), paste the token, and optionally the default account ID.

See the Cloudflare API token documentation for permission details.

Using with AI clients

  • Dedicated endpoint: POST /mcp/cloudflare with a Sanctum bearer token
  • Private gateway: one config for all integrations — use cloudflare__* namespaced tools

Typical flow:

  1. verify_token — confirm an API token is active (may not apply to OAuth access tokens)
  2. list_accounts / list_zones — find account_id and zone_id
  3. list_dns_records → create/update/delete DNS as needed
  4. purge_cache — purge by everything, files, tags, hosts, or prefixes
  5. Workers / KV / R2 / D1 / Pages tools — use account-scoped tools (default account ID applies when set)

Key tools by area

The full tool list (name + description for every MCP tool) is shown in Available tools below this guide. Highlights:

  • Accounts & zones — verify_token, list_accounts, list_zones, get_zone, create-zone-tool, delete-zone-tool
  • DNS — list_dns_records, get_dns_record, create_dns_record, update_dns_record, delete_dns_record
  • Cache & settings — purge_cache, list_zone_settings, update_zone_setting
  • SSL & rulesets — get-ssl-setting-tool, list-ssl-verification-tool, list-zone-rulesets-tool, get-zone-ruleset-tool, update-zone-ruleset-tool
  • Workers & KV — list/get Workers scripts and routes; create/update/delete routes; KV namespaces plus get/put/delete values
  • R2, D1 & Pages — bucket and database CRUD, query-d1-database-tool, Pages projects and deployments
  • Load balancing & email — load balancers, pools, monitors; Email Routing rules
  • Account members — list-account-members-tool

MCP clients paginate tools/list (often ~15 tools per page) — request the next page or raise per_page to see the full set.

See Documentation for HTTP authentication and private gateway setup.

Troubleshooting

  • 422 integration not configured — activate Cloudflare in My Integrations via Connect Cloudflare or an API token.
  • 401 Unauthorized — reconnect with OAuth or regenerate the API token and update credentials.
  • 403 Forbidden — the token is missing a permission or resource scope for that action. Edit the token or re-authorize OAuth with the required scopes.
  • 429 Too many requests — Cloudflare limits Client API calls to about 1200 per 5 minutes per token; wait and paginate with page / per_page instead of tight polling.
  • Missing account_id — pass account_id on the tool call, or save a default account ID in My Integrations.

Available tools

  • verify_token

    Verify that the connected Cloudflare API token is valid and active.

  • list_accounts

    List Cloudflare accounts accessible to the connected token. Uses /accounts, or /memberships when OAuth returns 403 on /accounts.

  • list_zones

    List Cloudflare zones (domains). Filter by name, status, or account.

  • get_zone

    Get details for a Cloudflare zone by zone ID.

  • create_zone

    Create a Cloudflare zone for a domain on an account.

  • delete_zone

    Delete a Cloudflare zone. This is destructive.

  • list_dns_records

    List DNS records for a zone. Filter by type, name, or content.

  • get_dns_record

    Get a single DNS record by ID.

  • create_dns_record

    Create a DNS record in a zone.

  • update_dns_record

    Update an existing DNS record (PATCH).

  • delete_dns_record

    Delete a DNS record from a zone.

  • purge_cache

    Purge cached content for a zone. Provide purge_everything=true, or one of files, tags, or hosts.

  • list_zone_settings

    List all configurable settings for a zone.

  • update_zone_setting

    Update a single zone setting by setting ID (e.g. ssl, always_use_https, minify).

  • get_ssl_setting

    Get the zone SSL/TLS encryption mode setting.

  • list_ssl_verification

    List SSL certificate pack verification status for a zone.

  • list_zone_rulesets

    List rulesets configured for a zone (WAF, redirects, custom rules phases).

  • list_account_rulesets

    List account-level rulesets.

  • get_zone_ruleset

    Get a zone ruleset by ID, including rules.

  • update_zone_ruleset

    Update a zone ruleset (PUT). Pass the full rules array and optional metadata fields.

  • list_workers_scripts

    List Workers scripts in an account.

  • get_workers_script_settings

    Get Workers script settings/metadata (bindings, compatibility date, etc.).

  • list_workers_routes

    List Workers routes configured on a zone.

  • create_workers_route

    Create a Workers route on a zone.

  • update_workers_route

    Update a Workers route on a zone.

  • delete_workers_route

    Delete a Workers route from a zone.

  • list_kv_namespaces

    List Workers KV namespaces in an account.

  • create_kv_namespace

    Create a Workers KV namespace.

  • delete_kv_namespace

    Delete a Workers KV namespace.

  • list_kv_keys

    List keys in a Workers KV namespace.

  • get_kv_value

    Read a Workers KV value by key (returns text content).

  • put_kv_value

    Write a Workers KV value by key (text body).

  • delete_kv_value

    Delete a Workers KV key.

  • list_r2_buckets

    List R2 buckets in an account.

  • create_r2_bucket

    Create an R2 bucket.

  • delete_r2_bucket

    Delete an R2 bucket (must be empty).

  • list_d1_databases

    List D1 databases in an account.

  • create_d1_database

    Create a D1 database.

  • delete_d1_database

    Delete a D1 database.

  • query_d1_database

    Run a SQL query against a D1 database. Can mutate data — use carefully.

  • list_pages_projects

    List Cloudflare Pages projects in an account.

  • get_pages_project

    Get a Cloudflare Pages project by name.

  • list_pages_deployments

    List deployments for a Cloudflare Pages project.

  • list_load_balancers

    List load balancers for a zone.

  • list_load_balancer_pools

    List account load balancer pools.

  • list_load_balancer_monitors

    List account load balancer monitors.

  • list_email_routing_rules

    List Email Routing rules for a zone.

  • create_email_routing_rule

    Create an Email Routing rule for a zone.

  • delete_email_routing_rule

    Delete an Email Routing rule.

  • list_account_members

    List members of a Cloudflare account.

MCP endpoint: https://stackgate.ai/mcp/cloudflare (HTTP) or via the private gateway.

Create account Documentation