Why Your AI Agent Should Talk to Cloudflare, With Limits

Give the agent visibility before giving it control

An agent with SSH access can inspect your application while remaining blind to the configuration that sends visitors to it. On a single VPS running Ubuntu 24.04 LTS, that gap matters when the application responds locally but the public hostname fails. Reading the relevant Cloudflare configuration gives Claude Code evidence it would otherwise ask you to copy from the dashboard.

We recommend starting with an investigation you already understand, such as checking whether a hostname points at the intended origin. Have the agent compare observed configuration with your deployment notes and identify discrepancies. It should explain what it found before proposing any change.

The connection is useful when dashboard lookups repeatedly interrupt your work. If you change DNS rarely and can answer the question from a short dashboard visit, adding another authenticated integration may not help. Our guide to delegating operations work explains how to choose work that benefits from agent access.

Choose the Cloudflare MCP server that fits the job

Model Context Protocol, or MCP, lets an agent discover and call tools exposed by another service. Cloudflare provides a documentation server and an authenticated API server, alongside servers for particular products. Choose from the official Cloudflare MCP catalog, because the endpoint determines what integration you are actually connecting.

Reading documentation cannot establish what your account currently contains. Conversely, access to account configuration does not explain whether your application process is healthy. Keep those evidence sources separate when asking the agent to diagnose a failure.

For this setup, run Claude Code on your laptop and connect to Cloudflare's hosted endpoint. You do not need to host an MCP service on the VPS or open an inbound port for this connection. If the request path is unclear, first review where the reverse proxy and CDN sit.

Connect Claude Code from your operations directory

Start on a laptop where Claude Code is already installed and authenticated. Open your operations repository, then register the API server using local scope. In Claude Code, local scope makes the connection private to you and available in that project; it does not restrict Cloudflare permissions. The command syntax and scope behavior are documented in the Claude Code MCP reference.

claude mcp add --transport http --scope local cloudflare-api https://mcp.cloudflare.com/mcp
claude mcp get cloudflare-api

Start Claude Code in that directory and enter /mcp in its interactive prompt. Select the Cloudflare connection and follow the browser authentication flow. Inspect the requested permissions before authorizing; stop if the grant is broader than the investigation requires.

Treat the operations directory as a working convenience rather than a security boundary. A narrowly named connection can still hold broad credentials. The restriction that matters must survive an incorrect tool call.

Restrict the credential to a specific resource

For a DNS investigation, begin with DNS read access to the particular zone involved. A zone is the domain container for the DNS records you manage in Cloudflare. Avoid granting edit access simply because a setup template includes it.

Use OAuth when its authorization flow gives you the required boundary. If it cannot express that boundary, use a custom scoped API token through the server's supported bearer-token authentication, or leave account access disconnected. Do not compensate for an oversized grant by writing a stricter prompt.

Cloudflare API tokens support permission groups and resource restrictions, including DNS read access limited to a selected zone. Token expiration can limit how long a grant remains useful. Inspect the permission summary before creating it, following Cloudflare's token creation instructions.

• Choose the exact zone needed for the task instead of all zones.
• Grant read access initially; add another permission only after identifying the operation that requires it.
• Give the credential a purpose-specific name so you can find and revoke it later.
• Keep production write credentials out of the ordinary investigation session.

DNS edit access to a zone should be treated as authority over that zone's records, even when your request names only one hostname. If you require enforcement at the individual-record level, use a controlled wrapper that validates the target or perform the change yourself. A sentence in the task cannot narrow the provider's permission boundary.

Keep token values out of prompts and tracked configuration. Supply credentials through a protected local configuration mechanism, and remember that an agent with broad shell access may still read credentials accessible to that operating-system user. Plan storage and revocation together using the guide to scoped agent credentials.

Review the operation inside each tool call

The Cloudflare API server exposes search for discovering API operations and execute for running generated code that calls them. The same execution tool can support reads or writes, depending on the request and credential. Bearer-token authentication is supported, but tokens with client IP filtering are currently unsupported by this server. These details are documented in the official Cloudflare MCP project.

Our recommendation is to review the underlying request whenever a write-capable credential is present. Approving a tool name such as execute tells you little about the effect of the code inside it. Inspect the target resource and requested operation before allowing execution.

Do not permanently approve every execution call to remove interruptions. Keep routine diagnosis on a credential that cannot mutate production, then authorize a separate maintenance session when a reviewed change is necessary. This makes an accidental approval less consequential.

Treat text returned from tools as evidence rather than instructions. A record comment or other returned content should never authorize a permission expansion or a new destination for account data. Request only the fields needed to answer the operational question, especially when returned data could contain sensitive information.

Verify both permitted and excluded access

Ask Claude Code to read a known DNS record in the selected zone and report its configured target and proxy status. Compare the result with the dashboard yourself. Use a record whose expected configuration you already know so that an incorrect account selection is obvious.

Next, attempt a harmless read against another zone you control that is deliberately excluded from the credential. Use its known identifier rather than asking the agent to discover every accessible zone. Inspect the tool response directly; the agent declining your request does not demonstrate provider-side enforcement.

Inspect the credential's permission summary to confirm it contains no write grant. If you want an empirical write-denial check, use a disposable record in a nonproduction zone where an unexpectedly successful change is acceptable. Never attempt a destructive production operation merely to see whether it fails.

When a permitted read fails, inspect the requested operation and its documented permissions before changing the credential. Some failures come from the wrong resource identifier or an expired authorization. Broadening access until the error disappears can leave you with permissions unrelated to the original task.

Approve a production change with a rollback ready

Before granting write access, require a proposal that identifies the exact resource and shows its current and intended values. For a DNS correction, include the record type, target, TTL and proxy state so that unrelated settings do not change accidentally. Record the existing state somewhere you can reach without the agent.

1. Review the proposed operation and decide how you will restore the previous configuration.
2. Provide a separate, narrowly scoped write grant for the maintenance task.
3. Approve the specific change after inspecting the actual request.
4. Read back the resulting configuration and check application behavior independently.
5. Revoke the temporary grant and return routine work to read access.

An accepted API request proves that a configuration operation was accepted; it does not prove visitors can use the application. DNS caching can also delay what different clients observe, including after a rollback. Keep an independent application check running while you assess the result.

Disconnecting an MCP server and revoking its provider credential are separate actions. When retiring access, revoke the token or application authorization in Cloudflare as appropriate, then clear the client connection. Keep ordinary dashboard access available so recovery does not depend on the same integration you are troubleshooting.

Run a bounded DNS review today

Choose one public hostname served by your VPS and write down its expected origin address. Connect the API server with read access to its zone, then ask Claude Code to compare the actual DNS record with that expectation. Require it to distinguish observed configuration from assumptions about application health.

Save the investigation task and its required permissions in your operations notes so the next session starts with a defined boundary. Pair the review with independent small-server monitoring, which can tell you whether the public application works regardless of what the agent reports. Leave write access disconnected until you have a concrete change to approve.