Cloudflare

A tiny TypeScript MCP server to manage a Cloudflare zone through the Cloudflare API: DNS records, cloudflared tunnels and Email Routing. Zone-agnostic: point it at any zone via env vars.

Requirements

• Node.js 18+
• A Cloudflare API token. Permissions by feature:
  • DNS tools → Zone:DNS:Edit (+ Zone:Read to resolve the zone by name)
  • Tunnel tools → Account:Cloudflare Tunnel:Edit (+ Account:Account Settings:Read to auto-resolve the account id)
  • Email Routing rules → Zone:Email Routing Rules:Edit (:Read is enough for the read-only tools)
  • Email Routing destinations → Account:Email Routing Addresses:Edit

Configuration

Variable	Description
CLOUDFLARE_API_TOKEN	Cloudflare API token (see permissions above)
CLOUDFLARE_ZONE_ID	The 32-char hex Zone ID or the zone name (e.g. example.com). A name is resolved to its id at startup (needs Zone:Read).
CLOUDFLARE_ACCOUNT_ID	Optional. Account id for tunnel tools. Auto-resolved from the token if omitted (needs Account:Read).

Copy .env.example to .env and fill it in. Never commit .env.

Scripts

npm install
npm run build   # emit dist/
npm run dev     # tsx src/index.ts (stdio)
npm start       # node dist/index.js

Tools

Tool	Description
dns_list	List all DNS records in the zone (optional type filter: A, CNAME, MX, TXT…)
dns_get	Get a record by exact id, or by a name that resolves to exactly one record
dns_create	Create a record (type, name, content, proxied, priority for MX, ttl, comment). Only A/AAAA/CNAME are proxied by default
dns_update	Update content/proxy by exact id, or by a name plus optional type that resolves to exactly one record
dns_delete	Delete by exact id, or by a name plus optional type that resolves to exactly one record
tunnel_list	List cloudflared tunnels in the account
tunnel_create	Create a remotely-managed tunnel (idempotent by name); returns its run token
tunnel_token	Get the run token for an existing tunnel
tunnel_configure	Set a tunnel's public-hostname ingress (hostname → local service)
tunnel_delete	Delete a tunnel by name
email_routing_status	Whether Email Routing is enabled on the zone
email_routing_enable	Enable Email Routing; Cloudflare adds and locks its MX/SPF/DKIM records
email_routing_dns	The records routing needs and any problem Cloudflare sees with them
email_routing_disable	Disable routing and remove its records (confirm=true)
email_rules_list	List routing rules — which @zone addresses forward where, catch-all included
email_rule_create	Forward an address on the zone to a verified destination
email_rule_delete	Delete a rule by address or tag
email_rule_set_enabled	Turn a rule on or off without deleting it
email_catch_all_set	Drop, or forward to a verified destination, mail no rule matches
email_destinations_list	List the account's destination addresses and whether each is verified
email_destination_add	Add a destination address (Cloudflare emails it a verification link)
email_destination_delete	Remove a destination address from the account

Stand up a tunnel end-to-end

tunnel_create   name=my-dev                                   → returns id + token
tunnel_configure name=my-dev hostname=dev.example.com service=http://localhost:8770
dns_create      type=CNAME name=dev.example.com content=<id>.cfargotunnel.com
# then run it locally (no cert.pem needed):
#   TUNNEL_TOKEN=<token> cloudflared tunnel run

Forward an address end-to-end

email_destination_add   [email protected]        → verification link sent (click it)
email_rule_create       address=hello [email protected]
email_rules_list                                   → confirm [email protected] → [email protected]

A destination must be verified before a rule can forward to it, and the zone needs Email Routing enabled: email_routing_enable adds the MX/SPF/DKIM records, email_routing_dns confirms they are in place.

Token scopes: Account · Email Routing Addresses (destinations) and Zone · Email Routing Rules (rules, enable/disable) live in different scopes; granting one in the wrong scope returns Authentication error (code 10000) while everything else keeps working.

Safety semantics

• DNS: names are not record identities. dns_get, dns_update, and dns_delete accept an exact record id (preferred), or a name that resolves to exactly one record; ambiguous names are rejected instead of selecting the first result. For updates/deletes, pass type when it is needed to make the name unique.
• Tunnels: tunnel_configure and tunnel_ingress replace the current ingress configuration. They refuse to replace existing hostname routes unless replace_existing=true is passed explicitly.
• Email Routing: email_rule_create checks existing literal recipient rules and refuses to create a duplicate instead of adding another forwarding rule. email_rule_delete and email_rule_set_enabled refuse an address that more than one rule matches; pass the exact tag. email_routing_disable requires confirm=true.

Example (via an MCP client)

dns_list                                → all records
dns_get    name=app.example.com         → inspect one record
dns_create type=CNAME name=dev.example.com content=<tunnel-id>.cfargotunnel.com
dns_update name=dev.example.com proxied=true
dns_delete name=old.example.com

Use as an MCP server

Point your MCP client at the built or dev entrypoint over stdio, passing the two env vars. Example (generic MCP config):

{
  "command": "npx",
  "args": ["-y", "tsx", "/absolute/path/to/cloudflare-mcp/src/index.ts"],
  "env": {
    "CLOUDFLARE_API_TOKEN": "<your-token>",
    "CLOUDFLARE_ZONE_ID": "example.com"
  }
}

License

MIT