# Cloudflare MCP Pro (npm · cloudflare-mcp-pro)

Cloudflare MCP: DNS, Zones, Workers, KV, R2, D1, Pages, WAF, SSL, Email, AI via REST API v4

- Trust score: 67/100 (medium)
- Change this week: +22
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `cloudflare-mcp-pro`: 67/100 (this document), [markdown](https://verifymcp.io/servers/helbertparanhos-cloudflare-mcp-pro/cloudflare-mcp-pro.md), [page](https://verifymcp.io/servers/helbertparanhos-cloudflare-mcp-pro/cloudflare-mcp-pro)

## Channel facts

- Registry: `npm`
- Package: `cloudflare-mcp-pro`
- Version: `1.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 41 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 7774 tokens (~112/item across 69 items; 69 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 92% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add helbertparanhos-cloudflare-mcp-pro -- npx -y cloudflare-mcp-pro
```

### Codex

```bash
codex mcp add helbertparanhos-cloudflare-mcp-pro -- npx -y cloudflare-mcp-pro
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "helbertparanhos-cloudflare-mcp-pro": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "cloudflare-mcp-pro"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add helbertparanhos-cloudflare-mcp-pro --command npx --arg -y --arg cloudflare-mcp-pro
```

### Hermes

```yaml
mcp_servers:
  helbertparanhos-cloudflare-mcp-pro:
    command: "npx"
    args: ["-y", "cloudflare-mcp-pro"]
```

### Other

```json
{
  "mcpServers": {
    "helbertparanhos-cloudflare-mcp-pro": {
      "command": "npx",
      "args": [
        "-y",
        "cloudflare-mcp-pro"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 67, +47)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-31 (score 20, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 27, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (69)

### `verify_token` (~22 tokens)

Validate the configured Cloudflare API token and show its status/permissions.

### `list_accounts` (~69 tokens)

List Cloudflare accounts accessible by the token.

Input parameters:

- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `page` (number): Page number (default 1).
- `per_page` (number): Results per page (max 50).

### `list_zones` (~86 tokens)

List zones (domains), optionally filtered by name or status.

Input parameters:

- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `name` (string): Filter by domain name (exact or substring).
- `page` (number)
- `per_page` (number)
- `status` (string): Filter by zone status.

### `get_zone` (~41 tokens)

Get details of a single zone by ID.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_zone` (~150 tokens)

Add a new domain (zone) to an account. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `name` (string, required): The domain name to add (e.g. example.com).
- `type` (string): Zone setup type. Default 'full'.

### `delete_zone` (~110 tokens)

Delete a zone by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `purge_cache` (~202 tokens)

Purge a zone's cache — everything, or by files/tags/hosts/prefixes. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `files` (array): Specific URLs to purge.
- `hosts` (array): Hostnames to purge (Enterprise).
- `prefixes` (array): URL prefixes to purge (Enterprise).
- `purge_everything` (boolean): Purge the entire cache. Mutually exclusive with files/tags/hosts/prefixes.
- `tags` (array): Cache-Tags to purge (Enterprise).
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `get_zone_analytics` (~127 tokens)

Get HTTP traffic analytics for a zone over a time range (via GraphQL).

Input parameters:

- `since` (string, required): Hour-aligned ISO 8601 UTC start, e.g. 2024-01-01T00:00:00Z. httpRequests1hGroups buckets are hourly.
- `until` (string, required): Hour-aligned ISO 8601 UTC end, e.g. 2024-01-02T00:00:00Z.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `get_zone_setting` (~84 tokens)

Get a single zone setting (e.g. ssl, always_use_https, min_tls_version).

Input parameters:

- `setting` (string, required): Setting id, e.g. ssl, always_use_https, min_tls_version, brotli, http3, security_level.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `update_zone_setting` (~183 tokens)

Update a single zone setting (e.g. set ssl=full, always_use_https=on). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `setting` (string, required): Setting id to change, e.g. ssl, always_use_https, min_tls_version.
- `value` (required): New value. Type depends on the setting (e.g. ssl='full', always_use_https='on', min_tls_version='1.2').
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_dns_records` (~110 tokens)

List DNS records of a zone, optionally filtered by type/name.

Input parameters:

- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `name` (string): Filter by record name (FQDN).
- `page` (number)
- `per_page` (number)
- `type` (string): DNS record type.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_dns_record` (~239 tokens)

Create a DNS record (A, AAAA, CNAME, TXT, MX, etc). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `comment` (string): Optional comment for the record.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `content` (string, required): Record value (IP, target host, text, etc).
- `name` (string, required): Record name (e.g. www.example.com or @ for root).
- `priority` (number): Priority for MX/SRV records.
- `proxied` (boolean): Whether traffic is proxied through Cloudflare (A/AAAA/CNAME only).
- `ttl` (number): TTL in seconds. 1 = automatic. Default 1.
- `type` (string, required): DNS record type.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `update_dns_record` (~183 tokens)

Update an existing DNS record (partial update). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `comment` (string)
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `content` (string)
- `name` (string)
- `priority` (number)
- `proxied` (boolean)
- `record_id` (string, required): DNS record ID (from list_dns_records).
- `ttl` (number)
- `type` (string): DNS record type.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `delete_dns_record` (~125 tokens)

Delete a DNS record by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `record_id` (string, required): DNS record ID to delete.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `get_dnssec` (~46 tokens)

Get the DNSSEC status and DS record details for a zone.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `edit_dnssec` (~137 tokens)

Enable or disable DNSSEC for a zone. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `status` (string, required): Set 'active' to enable DNSSEC, 'disabled' to turn it off.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `export_dns_records` (~47 tokens)

Export all DNS records of a zone as a BIND zone file.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_workers` (~42 tokens)

List Worker scripts in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.

### `get_worker` (~56 tokens)

Get a Worker script's settings/metadata.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `script_name` (string, required): The Worker script name.

### `deploy_worker` (~188 tokens)

Create or update (deploy) a Worker script from ES module source. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `compatibility_date` (string): Compatibility date, e.g. 2024-01-01.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `main_module` (string): Entry module filename. Default 'worker.js'.
- `script` (string, required): The Worker source code (ES module format).
- `script_name` (string, required): The Worker script name to create/update.

### `delete_worker` (~128 tokens)

Delete a Worker script by name. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `script_name` (string, required): The Worker script name to delete.

### `list_worker_routes` (~47 tokens)

List Worker routes (URL patterns mapped to Workers) on a zone.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_worker_route` (~158 tokens)

Create a Worker route mapping a URL pattern to a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `pattern` (string, required): Route pattern, e.g. example.com/api/*.
- `script` (string): Worker script name to run on this route. Omit to disable on the pattern.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `delete_worker_route` (~127 tokens)

Delete a Worker route by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `route_id` (string, required): Route ID (from list_worker_routes).
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `put_worker_secret` (~158 tokens)

Create or update a secret binding on a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `name` (string, required): Secret binding name (env var name in the Worker).
- `script_name` (string, required): The Worker script name.
- `text` (string, required): The secret value.

### `delete_worker_secret` (~141 tokens)

Delete a secret binding from a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `name` (string, required): Secret binding name to delete.
- `script_name` (string, required): The Worker script name.

### `update_worker_cron` (~162 tokens)

Set the cron triggers (schedules) for a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `crons` (array, required): List of cron expressions, e.g. ['*/5 * * * *']. Empty array clears triggers.
- `script_name` (string, required): The Worker script name.

### `list_kv_namespaces` (~85 tokens)

List Workers KV namespaces in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `page` (number)
- `per_page` (number)

### `create_kv_namespace` (~127 tokens)

Create a new Workers KV namespace. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `title` (string, required): Human-readable namespace title.

### `kv_list_keys` (~84 tokens)

List keys in a KV namespace, optionally filtered by prefix.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `limit` (number): Max keys (default 1000).
- `namespace_id` (string, required): KV namespace ID.
- `prefix` (string): Filter keys by prefix.

### `kv_get` (~68 tokens)

Read the value of a key in a KV namespace.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `key` (string, required): The key to read.
- `namespace_id` (string, required): KV namespace ID.

### `kv_put` (~169 tokens)

Write a value to a key in a KV namespace, with optional TTL. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `expiration_ttl` (number): Seconds until the key expires.
- `key` (string, required): The key to write.
- `namespace_id` (string, required): KV namespace ID.
- `value` (string, required): The value to store.

### `kv_delete` (~137 tokens)

Delete a key from a KV namespace. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `key` (string, required): The key to delete.
- `namespace_id` (string, required): KV namespace ID.

### `list_r2_buckets` (~59 tokens)

List R2 buckets in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `name_contains` (string): Filter buckets by name substring.

### `create_r2_bucket` (~148 tokens)

Create a new R2 bucket. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `location_hint` (string): Optional region hint for the bucket location.
- `name` (string, required): Bucket name (lowercase, hyphens allowed).

### `delete_r2_bucket` (~133 tokens)

Delete an (empty) R2 bucket. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `name` (string, required): Bucket name to delete (must be empty).

### `list_d1_databases` (~96 tokens)

List D1 databases in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `name` (string): Filter by database name.
- `page` (number)
- `per_page` (number)

### `create_d1_database` (~147 tokens)

Create a new D1 database. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `name` (string, required): Database name.
- `primary_location_hint` (string): Optional primary location hint, e.g. wnam, weur.

### `query_d1` (~169 tokens)

Execute a SQL statement against a D1 database (with optional bound params). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `database_id` (string, required): D1 database ID (from list_d1_databases).
- `params` (array): Bound parameters for '?' placeholders in the SQL.
- `sql` (string, required): The SQL statement to execute.

### `list_pages_projects` (~45 tokens)

List Cloudflare Pages projects in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.

### `get_pages_project` (~57 tokens)

Get details of a Cloudflare Pages project.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `project_name` (string, required): The Pages project name.

### `list_firewall_rulesets` (~45 tokens)

List WAF rulesets configured on a zone.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `get_ruleset` (~65 tokens)

Get a single ruleset (with its rules) by ID.

Input parameters:

- `ruleset_id` (string, required): Ruleset ID (from list_firewall_rulesets).
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_access_rules` (~104 tokens)

List IP/ASN/country access rules (block/challenge/allow) on a zone.

Input parameters:

- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `mode` (string): Action to take for matching requests.
- `page` (number)
- `per_page` (number)
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_access_rule` (~200 tokens)

Create an IP/ASN/country access rule (block, challenge, or whitelist). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `mode` (string, required): Action to take for matching requests.
- `notes` (string): Optional note describing the rule.
- `target` (string, required): What the rule matches on.
- `value` (string, required): Match value, e.g. '1.2.3.4', '1.2.3.0/24', 'AS13335', or 'US'.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `delete_access_rule` (~128 tokens)

Delete an access rule by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `rule_id` (string, required): Access rule ID (from list_access_rules).
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_page_rules` (~50 tokens)

List page rules on a zone.

Input parameters:

- `status` (string): Filter by status.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_page_rule` (~183 tokens)

Create a page rule (URL pattern + actions like cache_level, forwarding_url). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `actions` (array, required): List of actions to apply when the pattern matches.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `priority` (number): Rule priority (higher runs first).
- `status` (string): Rule status. Default 'active'.
- `url_pattern` (string, required): URL match pattern, e.g. *example.com/images/*.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `delete_page_rule` (~128 tokens)

Delete a page rule by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `rule_id` (string, required): Page rule ID (from list_page_rules).
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_certificate_packs` (~60 tokens)

List SSL/TLS certificate packs on a zone.

Input parameters:

- `status` (string): Filter by certificate pack status. Default 'all'.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `get_ssl_verification` (~45 tokens)

Get SSL/TLS certificate verification status for a zone.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `order_certificate_pack` (~185 tokens)

Order an advanced certificate pack for one or more hostnames. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `certificate_authority` (string): Certificate authority. Default 'google'.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `hosts` (array, required): Hostnames to cover, e.g. ['example.com', '*.example.com'].
- `validation_method` (string): Domain control validation method. Default 'txt'.
- `validity_days`: Certificate validity in days. Default 90.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_custom_hostnames` (~97 tokens)

List custom hostnames (SSL for SaaS) on a zone.

Input parameters:

- `fetch_all` (boolean): When true, follow pagination and return all pages combined (ignores page/per_page).
- `hostname` (string): Filter by hostname.
- `page` (number)
- `per_page` (number)
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_custom_hostname` (~167 tokens)

Add a custom hostname (SSL for SaaS) to a zone. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `hostname` (string, required): The custom hostname to add, e.g. app.customer.com.
- `ssl_method` (string): SSL validation method. Default 'http'.
- `ssl_type` (string): Certificate type. Default 'dv'.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `delete_custom_hostname` (~130 tokens)

Delete a custom hostname by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `custom_hostname_id` (string, required): Custom hostname ID (from list_custom_hostnames).
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_email_rules` (~41 tokens)

List Email Routing rules on a zone.

Input parameters:

- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_email_rule` (~178 tokens)

Create an Email Routing rule (forward an address to a destination). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `enabled` (boolean): Whether the rule is active. Default true.
- `forward_to` (string, required): Verified destination address to forward matched mail to.
- `match_to` (string, required): Source address to match, e.g. hello@example.com.
- `name` (string): Optional rule name.
- `zone_id` (string, required): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `list_email_destinations` (~47 tokens)

List verified Email Routing destination addresses in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.

### `list_queues` (~45 tokens)

List Cloudflare Queues in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.

### `create_queue` (~127 tokens)

Create a new Cloudflare Queue. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `queue_name` (string, required): Name for the new queue.

### `delete_queue` (~128 tokens)

Delete a Queue by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `queue_id` (string, required): Queue ID (from list_queues).

### `list_tunnels` (~67 tokens)

List Cloudflare Tunnels (cloudflared) in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `is_deleted` (boolean): Include deleted tunnels. Default false (active only).

### `get_tunnel` (~61 tokens)

Get details of a Cloudflare Tunnel by ID.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `tunnel_id` (string, required): Tunnel ID (from list_tunnels).

### `list_turnstile_widgets` (~47 tokens)

List Turnstile widgets in an account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.

### `create_turnstile_widget` (~169 tokens)

Create a Turnstile widget (CAPTCHA alternative) for given domains. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `domains` (array, required): Allowed domains for the widget, e.g. ['example.com'].
- `mode` (string): Widget mode. Default 'managed'.
- `name` (string, required): Human-readable widget name.

### `list_ai_models` (~78 tokens)

Search the catalog of Workers AI models available to the account.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `search` (string): Filter models by name/task substring.
- `task` (string): Filter by task, e.g. 'Text Generation'.

### `run_ai` (~197 tokens)

Run inference on a Workers AI model (text generation, embeddings, classification). Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Cloudflare account ID. Falls back to CLOUDFLARE_ACCOUNT_ID env var when omitted.
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `input` (object, required): Model inputs as a JSON object. For text generation use { prompt } or { messages: [...] }; for embeddings use { text }.
- `model` (string, required): Model id, e.g. @cf/meta/llama-3.1-8b-instruct or @cf/baai/bge-base-en-v1.5.

### `list_logpush_jobs` (~64 tokens)

List Logpush jobs for a zone or account.

Input parameters:

- `account_id` (string): List account-scoped jobs (used when zone_id is omitted).
- `zone_id` (string): The Cloudflare zone ID (32-char hex). Get it from list_zones.

### `create_logpush_job` (~246 tokens)

Create a Logpush job streaming a dataset to a destination. Requires confirm:true (human-approval gate); without it returns a preview only.

Input parameters:

- `account_id` (string): Create an account-scoped job (used when zone_id is omitted).
- `confirm` (boolean): Human-approval gate: must be true to actually perform this mutating operation. Omit or set false to get a non-executing preview of what would happen (with secrets redacted). A human should approve be…
- `dataset` (string, required): Dataset, e.g. http_requests, firewall_events, dns_logs.
- `destination_conf` (string, required): Destination URI, e.g. s3://bucket/path?region=us-east-1 or r2://... or an HTTPS endpoint.
- `enabled` (boolean): Whether the job starts enabled. Default true.
- `logpull_options` (string): Optional fields/timestamp options, e.g. 'fields=...&timestamps=rfc3339'.
- `name` (string, required): Job name.
- `zone_id` (string): The Cloudflare zone ID (32-char hex). Get it from list_zones.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/helbertparanhos-cloudflare-mcp-pro/cloudflare-mcp-pro#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 67
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-30: 27
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/cloudflare-mcp-pro
- Socket report: https://socket.dev/npm/package/cloudflare-mcp-pro
- Repository: https://github.com/helbertparanhos/cloudflare-mcp-pro
- Changelog RSS feed: https://verifymcp.io/servers/helbertparanhos-cloudflare-mcp-pro/cloudflare-mcp-pro/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/helbertparanhos-cloudflare-mcp-pro/cloudflare-mcp-pro/changelog.json
- HTML version of this page: https://verifymcp.io/servers/helbertparanhos-cloudflare-mcp-pro/cloudflare-mcp-pro