Cloudflare Zero Trust MCP Server

A Model Context Protocol (MCP) server for managing Cloudflare Zero Trust from Claude Desktop and Claude Code. Covers Access, Gateway, Tunnels, Devices, DEX, DLP, Networks, Risk Scoring, and Connectivity.

Quick Start

1. Installation

1. Clone this repository:

   git clone https://github.com/robcerda/cloudflare-zt-mcp-server.git
   cd cloudflare-zt-mcp-server

2. Install dependencies:

   Using pip:

   pip install -r requirements.txt
   pip install -e .

   Using uv (alternative):

   uv sync

3. Configure Claude Desktop: Add this to your Claude Desktop configuration file:

   macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

   Windows: %APPDATA%\Claude\claude_desktop_config.json

   {
     "mcpServers": {
       "Cloudflare Zero Trust": {
         "command": "/opt/homebrew/bin/uv",
         "args": [
           "run",
           "--with",
           "mcp[cli]",
           "--with-editable",
           "/path/to/your/cloudflare-zt-mcp-server",
           "mcp",
           "run",
           "/path/to/your/cloudflare-zt-mcp-server/src/cloudflare_zt_mcp_server/server.py"
         ],
         "env": {
           "CLOUDFLARE_API_TOKEN": "your_api_token",
           "CLOUDFLARE_ACCOUNT_ID": "your_account_id"
         }
       }
     }
   }

   Important: Replace /path/to/your/cloudflare-zt-mcp-server with your actual path.

4. Restart Claude Desktop

OR

3. Configure Claude Code (CLI): Add this to your Claude Code configuration file:

   Global (all projects):

   macOS/Linux: ~/.claude.json

   Windows: %USERPROFILE%\.claude.json

   {
     "mcpServers": {
       "Cloudflare Zero Trust": {
         "command": "/opt/homebrew/bin/uv",
         "args": [
           "run",
           "--with",
           "mcp[cli]",
           "--with-editable",
           "/path/to/your/cloudflare-zt-mcp-server",
           "mcp",
           "run",
           "/path/to/your/cloudflare-zt-mcp-server/src/cloudflare_zt_mcp_server/server.py"
         ],
         "env": {
           "CLOUDFLARE_API_TOKEN": "your_api_token",
           "CLOUDFLARE_ACCOUNT_ID": "your_account_id"
         }
       }
     }
   }

   If installed via pip instead of uv, use:

   {
     "command": "python",
     "args": ["/path/to/your/cloudflare-zt-mcp-server/src/cloudflare_zt_mcp_server/server.py"]
   }

4. Restart Claude Code

2. Credentials

1. Create an API token at https://dash.cloudflare.com/profile/api-tokens with Account > Zero Trust > Edit permissions.

2. Find your account ID in any Cloudflare dashboard URL.

3. Set both as environment variables (or put them in the env block of your MCP config, as shown above):

   export CLOUDFLARE_API_TOKEN=...
   export CLOUDFLARE_ACCOUNT_ID=...

A .env file in the project root also works.

3. Start Using

Verify with check_authentication, then use any of the tools listed below directly in Claude.

Features

• Access: Applications, policies, groups, identity providers, service tokens, and mTLS certificates
• Gateway: DNS/HTTP/L4 rules, lists, locations, logging settings, and categories
• Tunnels: Cloudflared tunnels, connectors, token management, and configurations
• Devices: WARP devices, registrations, device profiles, posture rules, and managed networks
• DEX: Tests, fleet status, HTTP/traceroute analytics, and remote captures
• DLP: Profiles, datasets, patterns, and email content rules
• Networks: Private network routes, virtual networks, WARP subnets, and hostname routes
• Risk Scoring: Behaviors, user risk scores, and clearing flagged users
• Connectivity: Magic WAN, Magic Transit, static routes, and GRE/IPsec tunnels

Available Tools

Full list of tools is registered in src/cloudflare_zt_mcp_server/tools/. Each module exposes tools grouped by feature area; run check_authentication in Claude and then ask Claude to list available Cloudflare tools to see them in-session.

Key examples:

Tool	Description
check_authentication	Verify API token and account ID are valid
list_access_applications	List all Access applications
create_gateway_rule	Create a DNS/HTTP/L4 Gateway rule
list_tunnels	List cloudflared tunnels
list_devices	List enrolled WARP devices
list_custom_device_policies	List custom device settings profiles
create_managed_network	Create a TLS-based managed network
list_network_routes	List private network routes
list_dex_tests	List Digital Experience Monitoring tests
list_dlp_profiles	List DLP profiles

Troubleshooting

Authentication errors

Run check_authentication first. If it fails, verify:

• CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID are set
• The token has Account > Zero Trust > Edit permissions
• The account ID matches the account the token is scoped to

User tokens vs API tokens

A few device policy endpoints require a standard API token rather than a cfut_-prefixed user token. If you see a bad device request error on update/delete of a custom device policy, switch to a standard API token.

Rate limits

The Cloudflare API enforces per-account rate limits. If you hit them, space out requests or batch reads.

Technical Details

Project Structure

cloudflare-zt-mcp-server/
├── src/cloudflare_zt_mcp_server/
│   ├── __init__.py
│   ├── api_client.py           # HTTP client, auth, response handling
│   ├── server.py               # Main server entry point
│   └── tools/                  # Tool modules per feature area
│       ├── access.py
│       ├── connectivity.py
│       ├── devices.py
│       ├── dex.py
│       ├── dlp.py
│       ├── gateway.py
│       ├── networks.py
│       ├── risk_scoring.py
│       └── tunnels.py
├── pyproject.toml
├── requirements.txt
└── README.md

API Client

All tools call api_get, api_post, api_put, api_patch, or api_delete from api_client.py. Requests are scoped to https://api.cloudflare.com/client/v4/accounts/{account_id}/ and responses are unwrapped from the standard {success, result, errors} envelope.

License

MIT License