Cloudflare

You deploy a single MCP server that combines active Cloudflare API operations with read-only access to Cloudflare documentation, so you can manage zones, accounts, rulesets, and related resources from one cohesive interface. This server is designed to be used by MCP clients to perform common Cloudflare Ruleset Engine tasks while also accessing documentation through a unified endpoint.

How to use

You connect an MCP client to the server to perform day-to-day Cloudflare operations. Use the available tools to list zones and accounts, manage device certificates, and edit rulesets. You can read documentation content and browse documentation catalogs directly through the same MCP surface. For best results, specify the target zone or account before making changes and validate the outcome by listing resources first.

How to install

Prerequisites you need before installation include Python 3.10 or newer (3.11 recommended) and a working Python package manager.

Steps to install and run the MCP server locally are shown below. Copy and paste each block into your terminal or appropriate shell.

git clone https://github.com/quareth/cloudflare_waf_mcp.git
cd cloudflare_waf_mcp

# (Recommended) Create and activate a virtual environment
python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies
pip install --upgrade pip
pip install -r requirements.txt

# Configure credentials (choose one method)**

# Option A: MCP Client Configuration (Recommended for MCP clients)
# See the following Examples for how to set up the client config.

# Option B: Environment File (Recommended for standalone usage)
cp example.env .env
# Edit .env to include CLOUDFLARE_API_TOKEN

# Option C: System Environment Variables (preferred for CI/CD or shells)
export CLOUDFLARE_API_TOKEN="your_token_here"

# Run the server in standard mode (stdio)
python -m src.cloudflare_waf_mcp_server.server

# Or run the server in SSE/HTTP mode (behind a trusted boundary)
python -m src.cloudflare_waf_mcp_server.server --sse --host 0.0.0.0 --port 8000

# If you need to connect via HTTP/SSE, the server URL is:
# http://localhost:8000/sse

Additional sections

Configuration priority determines which credentials are used when multiple sources are present. The server checks MCP client env first, then system environment variables, and finally a .env file if provided.

Security considerations

Do not expose the SSE/HTTP endpoint directly to the public internet without proper authentication and access controls. If you use a client configuration, understand that the API token may be stored in the client config file. For shared systems or CI/CD, prefer environment variables or a .env file and keep keys out of version control.

Troubleshooting

Common issues include missing dependencies in the Python environment or incorrect venv paths. Ensure your MCP client uses the correct Python from your virtual environment. If you see module errors, verify the Python interpreter path in use and confirm dependencies are installed.

Resource and documentation access

Documentation content is accessible through a dedicated URI scheme that allows you to read specific files and browse a catalog of resources. Use cloudflare://docs/... paths to retrieve documentation content and cloudflare://docs-catalog/... to explore documentation by scope.

Available tools

cloudflare_list_document_names

List documentation files available through MCP resources

cloudflare_read_document

Read documentation content for a given path

cloudflare_list_zones

List Cloudflare zones accessible to the authenticated user

cloudflare_get_zone_details

Get detailed information about a specific zone

cloudflare_list_accounts

List Cloudflare accounts accessible to the authenticated user

client_certificate_provisioning_enable

Enable or disable client certificate provisioning for Device Information Only mode for a zone

cloudflare_list_rulesets

List rulesets for zones or accounts

cloudflare_get_ruleset

Get detailed information about a ruleset

cloudflare_add_ruleset_rule

Add a new rule to a ruleset

cloudflare_update_ruleset_rule

Update an existing rule within a ruleset

cloudflare_delete_ruleset_rule

Delete a rule from a ruleset (single-rule operation)

cloudflare_list_ruleset_versions

List versions of a ruleset

cloudflare_get_ruleset_version

Get a specific ruleset version

cloudflare_get_ruleset_version_by_tag

Get a ruleset version filtered by tag