# Cloudflare MCP connector The Cloudflare connector lets Claude, ChatGPT, Cursor, or any MCP client look up your Cloudflare accounts, zones, members, roles, firewall rules, rule sets, WAF overrides, and audit logs through one governed Elaichi endpoint, inside each person's own access. Source: https://elaichi.ai/connectors/cloudflare/ ## Facts | | | | --- | --- | | Application | Cloudflare | | Category | Application Development | | AI tools | 12 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | Yes | ## What you can ask once Cloudflare is connected - Which zones changed firewall rules in the last week? - List members with admin roles on our production account. - Show WAF overrides active across all Cloudflare zones. ## Connect Cloudflare in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Cloudflare. 2. Optionally set Share with, then press Connect. 3. Paste a Cloudflare API key. One person generates a token in Cloudflare and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Cloudflare tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Cloudflare to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Cloudflare to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Cloudflare to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Cloudflare to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Cloudflare tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Cloudflare through Elaichi ### Review firewall rules before a change window Security. Ask which firewall rules and rule sets are active on a zone and get them read back in plain language before anyone touches production. ### Check who still has access to Cloudflare IT. List every member across your Cloudflare accounts with their roles, then spot contractors and former staff who should no longer be there. ### Pull Cloudflare audit history for a review Compliance. When an auditor asks who changed what and when, have the agent read the Cloudflare audit log for the period and summarize it. ### Find the zone behind a customer domain Support. When a customer says their site is misbehaving, look up the zone it sits in and read its details without opening the Cloudflare dashboard. ### Compare rule sets across staging and production Engineering. Fetch the rule sets attached to two zones and ask where they differ before a release goes out. ### Inventory every domain across accounts Operations. List all zones across every Cloudflare account you manage for a quarterly ownership review, in one question instead of account by account. ## Frequently asked questions ### How do I connect Cloudflare to Claude? Connect Cloudflare in Elaichi first, then open Claude, go to Customize, then Connectors, then Add, and paste https://api.elaichi.ai/mcp. Cloudflare connects with an API key, so the sign-in step is pasting a key from your Cloudflare account into Elaichi. There is no OAuth application to register and no client ID or secret to generate. ### Does Cloudflare work with ChatGPT and Cursor as well as Claude? Yes. Once Cloudflare is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect Cloudflare once and every client you use sees it. ### What can an AI agent actually do with my Cloudflare data? With the Cloudflare connector, an agent can list your accounts, zones, members and their roles, firewall rules, rule sets, WAF overrides, and audit logs, and look up any one of them by ID. That means you can ask in plain language which firewall rules protect a domain, who has access to an account, or what changed last week, and get an answer from live Cloudflare records. This connector reads Cloudflare; it does not change settings. ### Does connecting Cloudflare give the AI access to every account and zone? No. Everything the agent sees in Cloudflare follows the access of the person who signed in with their key, so it can only read the accounts and zones that person can already read in Cloudflare. Elaichi can narrow that further with restrictions per action, and it can never widen it beyond what Cloudflare itself allows. ### Can my team share one Cloudflare connection? Yes. One person connects Cloudflare in Elaichi and shares the connection with a team, and nobody else ever handles the Cloudflare API key. Each teammate still signs in to Elaichi as themselves, so the audit log names the actual person behind every lookup of a zone or firewall rule. ### Can I stop an agent from deleting or changing things in Cloudflare? The Cloudflare connector in Elaichi only lists and looks up records such as zones, firewall rules, and members, so there is nothing here that deletes or changes a Cloudflare setting. On top of that, Elaichi restrictions work per action, so you can turn off any individual capability for a team. A blocked action is never advertised to Claude, ChatGPT, or Cursor, so no prompt can reach it. ### What happens to a Cloudflare connection when someone leaves? Offboarding a person in Elaichi ends their access to Cloudflare through Elaichi at once, across every client they used. A shared Cloudflare connection keeps working for everyone else on the team. If you want to remove Cloudflare entirely, disconnecting it once in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client at the same time. ## All 12 Cloudflare tools Every tool below is callable through https://api.elaichi.ai/mcp once Cloudflare is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all Cloudflare accounts** (List). List all accounts you have ownership or verified access to. Use the name query parameter to filter by account name. - **Get single Cloudflare account by ID** (Get). Get information about a specific Cloudflare account that you are a member of. Always requires the id to fetch. - **List all Cloudflare members** (List). Use this endpoint to get all the team members in a Cloudflare account. - **Get single Cloudflare member by ID** (Get). Use this endpoint to get a single team member in a Cloudflare account. Always requires the id to fetch. - **List all Cloudflare roles** (List). Use this endpoint to list all the roles available in Cloudflare. - **List all Cloudflare waf overrides** (List). List WAF overrides in Cloudflare for a specific zone. Requires zone_id. Returns id, description, groups, paused, priority, rewrite_action, rules, and urls fields for each override. This applies only to previous WAF managed rules version. - **List all Cloudflare zones** (List). List all the zones in the Cloudflare account. Use the name query parameter to filter by domain name. - **Get single Cloudflare zone by ID** (Get). Retrieve details for a specific zone by its ID in the Cloudflare account. - **List all Cloudflare firewall rules** (List). Fetches firewall rules in a zone. Always requires the ID of the Zone you want to fetch the firewall rules for. - **List all Cloudflare audit logs** (List). Gets a list of audit logs for an account on Cloudflare. Some of the use cases is to figure out when someone logged in, when an API token was created, or basically any change event happening on a Cloudflare account. Use the actor and action query parameters to filter by who made the change, and the type of change. - **List all Cloudflare rule sets** (List). List rulesets for a specific zone in Cloudflare. Requires zone_id. Returns id, kind, last_updated, name, phase, version, and description for each ruleset. - **Get single Cloudflare rule set by ID** (Get). Get a specific ruleset in Cloudflare. Requires zone_id and id. Returns fields such as id, kind, name, phase, version, description, and rules with their actions and parameters.