Cloudflare MCP server

What the model can do

Cloudflare: zones and their status, DNS records, traffic analytics by day (requests, unique visitors, bandwidth, cache ratio, status codes, countries), top paths and hosts, security events (what the WAF and firewall blocked or challenged, by action, source and country), and the Workers scripts in an account; can also create, change or delete a DNS record, purge the cache, block, challenge or allow an IP, range, ASN or country, pause or resume a zone, delete a Worker, and re-check a pending zone's nameservers, when you ask.

Reads

• cloudflare_zonesList the Cloudflare zones (domains) this token can see: id, name, status (active, pending, moved…), plan, account, nameservers…
• cloudflare_dns_recordsDNS records of a zone: type, name, content, whether proxied through Cloudflare, TTL, priority, comment and tags.
• cloudflare_trafficTraffic analytics for a zone over a range of days (default the last 7, up to 90): totals and per-day rows of requests, unique visitors, page views…
• cloudflare_top_requestsThe busiest paths, hosts, countries or response statuses for a zone over a recent window (default the last 24 hours, at most 30 days)…
• cloudflare_security_eventsWhat Cloudflare's security layers did to requests on a zone over a recent window (default the last 24 hours, at most 30 days): counts by action…
• cloudflare_workersWorkers scripts in an account: name, when created and last changed, usage model, compatibility date, handlers (fetch, scheduled, queue…)…

Acts, when you ask

These change something in Cloudflare. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• cloudflare_create_dns_recordCreates a DNS record in a Cloudflare zone — a live DNS change that resolvers see within minutes and that can take a hostname or mail delivery off or…
• cloudflare_update_dns_recordChanges a DNS record in a Cloudflare zone — its content, name, TTL, proxy status, priority, comment or tags; only the fields given change.
• cloudflare_delete_dns_recordPermanently deletes a DNS record from a Cloudflare zone — a live DNS change; the name stops resolving…
• cloudflare_purge_cachePurges cached content from every Cloudflare data center for a zone — by full URLs, cache tags, hostnames or URL prefixes (one kind per call…
• cloudflare_create_ip_access_ruleAdds an IP access rule to a Cloudflare zone that blocks, challenges or allows (whitelist) every request from one IP, IP range, ASN or country…
• cloudflare_delete_ip_access_ruleRemoves an IP access rule from one Cloudflare zone, so the IP, range, ASN or country it named is no longer blocked, challenged or allowed there.
• cloudflare_pause_zonePauses Cloudflare on a zone (paused: true) — traffic then goes straight to the origin with no proxy, cache, WAF or DDoS protection…
• cloudflare_delete_workerPermanently deletes a Workers script from a Cloudflare account; its routes and custom domains stop serving it at once.
• cloudflare_check_zone_activationAsks Cloudflare to re-check a pending zone's nameservers now rather than wait for its next scheduled check (allowed every 5 minutes on paid plans…

Connect it

First connect Cloudflare on Dashboard → Connections, then add Memtro to your client once. The Cloudflare tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared Cloudflare connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › How many unique visitors did example.com get each day last week, and what was the cache ratio?
• › Which paths had the most 5xx responses in the last 24 hours?
• › What did the WAF block on shop.example.com yesterday, and from which countries?
• › Is mail.example.com proxied, and what does its MX record point at?
• › Purge the cache for https://example.com/pricing

Questions

Is this an official Cloudflare MCP server?

No. It is Memtro's MCP server with Memtro's Cloudflare connector behind it: the connector reads Cloudflare through its API with the credentials you connect on Dashboard → Connections, and Cloudflare publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in Cloudflare?

Only when you ask, and only what it has been granted: create, change or delete a DNS record (a live DNS change); purge cached content by URL, tag, host or prefix, or everything in a zone; block, challenge or allow an IP, range, ASN or country on a zone, or remove such a rule; pause Cloudflare on a zone, or resume it; delete a Workers script (permanent); re-check a pending zone's nameservers. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server