GPT-5.6 (Sol / Terra / Luna) is now evaluated on TrustVector โ€” with day-1 independent verification, incl. METR's benchmark-cheating findings.

Read the evaluation
Evaluation record ยท mcp-server-cloudflare

MCP Cloudflare Server

v2026.7 (managed remote servers)

Cloudflare

MCPcloudflarecdnmcpmodel-context-protocol
80
Strong
About This MCP

Official Cloudflare catalog of managed remote MCP servers, connected over OAuth. The primary Cloudflare API server at https://mcp.cloudflare.com/mcp exposes 2,500+ API endpoints (DNS, Workers, R2, Zero Trust, and more) through two Code Mode tools, search() and execute(), in roughly 1,000 tokens. Sixteen additional product-specific servers cover documentation, Workers bindings and builds, observability, Radar, browser rendering, AI Gateway, audit logs, and more.

Last Evaluated: July 9, 2026
Official Website

Trust Vector Analysis

Dimension Breakdown

๐Ÿš€Performance & Reliability
+
api reliability

API stability analysis

Evidence
Cloudflare API Documentation โ€” Built on Cloudflare's highly reliable API with 99.95%+ uptime
highVerified: 2026-07-09
dns operation success

Operation success testing

Evidence
Cloudflare MCP Server โ€” High success rate for DNS, CDN, and Workers operations
highVerified: 2026-07-09
rate limit handling

Rate limiting behavior testing

Evidence
Cloudflare Rate Limits โ€” Respects Cloudflare rate limits (1200 requests/5 minutes)
mediumVerified: 2026-07-09
global edge performance

Geographic performance testing

Evidence
Cloudflare Network โ€” Excellent global performance with 300+ edge locations
highVerified: 2026-07-09
error recovery

Error handling testing

Evidence
Implementation Review โ€” Handles API errors with retry logic and fallback
mediumVerified: 2026-07-09
๐Ÿ›ก๏ธSecurity
+
authentication security

Authentication mechanism review; raised from 80 as the default connection model is now OAuth with explicit permission selection rather than static API tokens

Evidence
Cloudflare Managed MCP Servers Documentation โ€” Managed remote servers use an OAuth flow where the user is redirected to Cloudflare to authorize and select permissions; API token bearer auth remains available for CI/CD
highVerified: 2026-07-09
token exposure risk

Token security analysis; raised from 65 because the remote OAuth default removes locally stored long-lived tokens

Evidence
Cloudflare Managed MCP Servers Documentation โ€” Remote OAuth connections avoid storing long-lived API tokens in client configuration; token exposure risk remains for CI/CD bearer-token setups
highVerified: 2026-07-09
dns manipulation risk

Operation risk assessment

Evidence
Security Analysis โ€” AI can modify DNS records, potentially causing service disruption
highVerified: 2026-07-09
security policy modification

Security policy testing

Evidence
Security Analysis โ€” Can modify firewall rules, WAF settings, and security policies
highVerified: 2026-07-09
audit logging

Audit logging review

Evidence
Cloudflare Audit Logs โ€” All operations logged in Cloudflare audit system
highVerified: 2026-07-09
zone access control

Access control testing

Evidence
Cloudflare Permissions โ€” Token scoping limits zone access but requires careful configuration
mediumVerified: 2026-07-09
๐Ÿ”’Privacy & Compliance
+
infrastructure metadata exposure

Data flow analysis

Evidence
MCP Data Flow โ€” Zone configurations, DNS records, and Workers code sent to LLM provider
highVerified: 2026-07-09
domain information disclosure

Privacy controls assessment

Evidence
Privacy Analysis โ€” Domain names, origins, and infrastructure details may be exposed
mediumVerified: 2026-07-09
analytics data privacy

Data privacy assessment

Evidence
Cloudflare Analytics โ€” May access traffic analytics and user behavior data
mediumVerified: 2026-07-09
third party data sharing

Data sharing analysis

Evidence
LLM Provider Policies โ€” Infrastructure data shared with LLM provider per their privacy policy
highVerified: 2026-07-09
secrets in workers

Secrets exposure assessment

Evidence
Security Analysis โ€” Workers code may contain secrets or sensitive configuration
mediumVerified: 2026-07-09
๐Ÿ‘๏ธTrust & Transparency
+
documentation quality

Documentation completeness review

Evidence
Cloudflare MCP Docs โ€” Comprehensive documentation with Cloudflare-specific examples
highVerified: 2026-07-09
operation visibility

Logging and traceability assessment

Evidence
Cloudflare Audit Logs โ€” All operations logged in Cloudflare audit trail and MCP logs
highVerified: 2026-07-09
open source transparency

Source code review

Evidence
GitHub Repository โ€” Open source implementation from Cloudflare
highVerified: 2026-07-09
api coverage clarity

API documentation review; raised from 72 as the current docs enumerate the full managed server catalog

Evidence
Cloudflare Managed MCP Servers Documentation โ€” Official docs enumerate every managed server with its endpoint URL and purpose; SSE transport is deprecated in favor of streamable-http at /mcp paths
highVerified: 2026-07-09
โš™๏ธOperational Excellence
+
ease of setup

Setup complexity assessment; raised from 82 as managed remote servers eliminate local installation and token provisioning

Evidence
Cloudflare Managed MCP Servers Documentation โ€” Zero-install: add the managed server URL (e.g. https://mcp.cloudflare.com/mcp) in an OAuth-capable MCP client and authorize; no local server or API token required for interactive use
highVerified: 2026-07-09
api performance

Performance benchmarking

Evidence
Cloudflare API Performance โ€” Excellent API performance (typically 50-200ms globally)
highVerified: 2026-07-09
reliability

Reliability analysis

Evidence
Cloudflare Status โ€” Highly reliable with 99.95%+ uptime
highVerified: 2026-07-09
service coverage

Feature coverage assessment; raised from 78 as coverage expanded to essentially the full Cloudflare API plus a broad server catalog

Evidence
Cloudflare Managed MCP Servers Documentation โ€” Primary API server exposes 2,500+ endpoints via Code Mode search()/execute(); 16 product-specific servers cover docs, bindings, builds, observability, Radar, containers, browser rendering, Logpush, AI Gateway, AI Search, audit logs, DNS analytics, DEX, CASB, and GraphQL
highVerified: 2026-07-09
community adoption

Community activity analysis

Evidence
cloudflare/mcp-server-cloudflare Repository โ€” Growing adoption among Cloudflare users and edge developers; Cloudflare also publishes templates and skills for building remote MCP servers on Workers
mediumVerified: 2026-07-09
Strengths
  • +Official Cloudflare managed remote MCP servers with OAuth and per-connection permission selection
  • +Token-efficient Code Mode: 2,500+ API endpoints reachable through search()/execute() in about 1,000 tokens
  • +Broad catalog of 16 product-specific servers (docs, observability, Radar, bindings, audit logs, and more)
  • +Excellent global API performance on Cloudflare's edge network
  • +Full operation auditability through Cloudflare audit logs
  • +Open source implementations with Cloudflare support; high reliability with 99.95%+ uptime
Limitations
  • !Infrastructure configurations and Workers code exposed to LLM provider
  • !Risk of DNS manipulation causing service disruption
  • !Can modify security policies and firewall rules within authorized permissions
  • !Domain names and infrastructure details may be disclosed
  • !Workers code may contain secrets or sensitive configuration
  • !execute() on the primary API server can reach any authorized endpoint, so OAuth permission selection must be scoped carefully; CI/CD bearer tokens still need manual scoping
Metadata
license: Apache 2.0 (cloudflare/mcp-server-cloudflare)
supported platforms
0: Any OAuth-capable MCP client (remote managed servers); self-hostable on Cloudflare Workers
programming languages
0: TypeScript
mcp version: 1.0
github repo: https://github.com/cloudflare/mcp-server-cloudflare
remote endpoint: https://mcp.cloudflare.com/mcp (plus 16 product-specific *.mcp.cloudflare.com/mcp endpoints)
transport types
0: streamable-http (SSE deprecated)
api dependency: Cloudflare API v4
authentication: OAuth (interactive, with permission selection) or Cloudflare API token bearer auth (CI/CD)
first release: 2024-11
maintained by: Cloudflare

Use Case Ratings

code generation

Excellent for Workers code generation and infrastructure-as-code

customer support

Useful for troubleshooting edge infrastructure and CDN issues

content creation

Moderate applicability for CDN and Pages documentation

data analysis

Good for analyzing traffic patterns, performance metrics, and security data

research assistant

Useful for researching edge computing patterns and Cloudflare configurations

legal compliance

Risk of exposing infrastructure details; careful access control needed

healthcare

Risk of exposing infrastructure for regulated healthcare applications

financial analysis

Moderate risk for financial infrastructure management

education

Excellent for teaching edge computing, CDN, and serverless concepts

creative writing

Low relevance to creative writing workflows