You can manage Cloudflare DNS through a purpose-built MCP server designed for token efficiency, full CRUD operations, and flexible deployment as a local MCP server or a Cloudflare Worker. It provides a focused set of DNS tools, safety checks, and multiple transport options to fit your workflow.

How to use

You will run this MCP server either locally in stdio mode or as an HTTP transport for remote access. You interact with it using an MCP client, performing read and write operations on zones and DNS records. Use the provided tools to list zones, view and edit records, bulk-create records, export zones in BIND format, and audit zones with summary and sampling modes. All delete actions require an explicit confirmation to prevent accidental removal.

How to install

Prerequisites: Node.js and npm must be installed on your system.

git clone https://github.com/piersdd/cloudflare-platform-mcp.git
cd cloudflare-platform-mcp
npm install
npm run build

Additional configuration and usage notes

Configure your client to connect via the stdio MCP server or via HTTP transport. The modal for starting in HTTP transport uses environment variables to enable remote access and security.

Example client configuration snippet for Claude Desktop (local stdio transport): you provide the server command and arguments, plus your Cloudflare API token. Restart the client after saving this configuration.

{
  "mcpServers": {
    "cloudflare_dns": {
      "command": "node",
      "args": ["/path/to/cloudflare-platform-mcp/dist/index.js"],
      "env": {
        "CLOUDFLARE_API_TOKEN": "your-api-token-here"
      }
    }
  }
}

HTTP Transport (remote access) and API details

To run as an HTTP server for remote access, start with the following approach. The server will listen on port 8787 by default, and you can change this with the PORT environment variable. An API key is automatically generated on first run and can be persisted with an environment variable.

Start the server in HTTP mode with explicit transport control:

TRANSPORT=http CLOUDFLARE_API_TOKEN=your-token node dist/index.js

Endpoints:

• POST /mcp — MCP Streamable HTTP (requires X-API-Key header)
• GET /health — Health check

## Deploy as a Cloudflare Worker

You can deploy the same MCP server to Cloudflare Workers for always-on remote access. Prepare secrets and then deploy.

Set secrets

npx wrangler secret put CLOUDFLARE_API_TOKEN npx wrangler secret put CLOUDFLARE_DNS_MCP_API_KEY

Deploy

npm run deploy

Your MCP server will be available at a Worker URL ending with /mcp.

Environment and startup notes

Key environment variables you will encounter include the Cloudflare API token (CLOUDFLARE_API_TOKEN) and optional API keys for HTTP transport (CLOUDFLARE_DNS_MCP_API_KEY). The server exposes endpoints for MCP communication and health checks. When operating in HTTP mode, ensure your firewall allows access to port 8787 (or the port you configure). The safety gate for deletions requires confirm: true in the request payload.

Security considerations

Protect your API token and any API keys used by the HTTP transport. Use scoped tokens with zone read and DNS edit permissions, and consider placing the Worker behind access controls or a reverse proxy with authentication if you expose it publicly.

Troubleshooting and tips

If you cannot reach the MCP server, verify that the process is running, the correct port is used, and the environment variables are set as described. For HTTP mode, check that the API key header is included in requests and that the X-API-Key matches the server's generated key.

Available tools

Read Tools

Group of read operations including listing zones, getting zones, listing records, getting a single record, and exporting records as a BIND file.

Write Tools

Group of write operations including creating, updating, and deleting records, plus bulk creation and bulk updates.

Safety gates

Deletes require explicit confirmation to prevent accidental data loss.

Summary mode

Provides record counts and type distribution without fetching every individual record.

Random sampling

Audits large zones by sampling a few records without loading all data.

Dual transport

Supports stdio for local desktop usage and HTTP for remote access.

Worker deployment

Code can be deployed to Cloudflare Workers for always-on access.