<p>This is a companion to the <a href="/ga4-mcp.html">GA4 MCP post</a>. Same idea,
different service. Cloudflare ships a remote MCP server that covers
their entire API. You connect it to Claude Code, authenticate via
OAuth in your browser, and then Claude can query your Cloudflare
account directly.</p>
<p>I <a href="/dns-xfer-godaddy-cloudflare.html">moved my DNS to Cloudflare</a> a
while back and use the CDN proxy on
<a href="https://kyle.pericak.com">kyle.pericak.com</a>. The MCP server lets me
check DNS records, zone settings, and account details without opening
the dashboard. Read-only access is fine for this.</p>
<h1 id="how-it-works">How it works</h1>
<p>Cloudflare's MCP server is different from most. It has
<a href="https://developers.cloudflare.com/api/">thousands of API endpoints</a>,
but instead of exposing one tool per endpoint, it exposes two:
<code>search</code> and <code>execute</code>.</p>
<p><code>search</code> queries the OpenAPI spec to find the right endpoint.
<code>execute</code> runs JavaScript code server-side against the Cloudflare
API using a
<a href="https://github.com/cloudflare/mcp"><code>cloudflare.request()</code></a>
function. Claude writes the code, the server runs it, and the
result comes back.</p>
<p>Cloudflare calls this
"<a href="https://blog.cloudflare.com/code-mode-mcp/">Code Mode</a>."
The full Cloudflare API (2,500+ endpoints) fits in about 1,000
tokens of tool definitions instead of 1.17 million for native
MCP with full schemas.</p>
<h1 id="one-command-to-connect">One command to connect</h1>
<pre><code class="language-bash">claude mcp add --transport http cloudflare-api \
  https://mcp.cloudflare.com/mcp
</code></pre>
<p>This adds the server to your <code>~/.claude.json</code> under the current
project. Restart Claude Code and run <code>/mcp</code> to confirm it shows up.</p>
<h2 id="oauth">OAuth</h2>
<p>The first time Claude calls a Cloudflare tool, your browser opens to
an authorization page. You pick an access level:</p>
<ul>
<li><strong>Read Only</strong> (recommended): view resources without making changes</li>
<li><strong>Workers Full Access</strong>: full access to Workers, KV, D1, R2</li>
<li><strong>DNS Full Access</strong>: full access to DNS records and zone settings</li>
<li><strong>Advanced</strong>: pick individual permissions</li>
</ul>
<p>You can always re-auth later with broader
permissions if you need to manage Workers or edit DNS from the
terminal.</p>
<p>After you log in and grant access, the OAuth token is cached
in <code>~/.mcp-auth/</code> (by the
<a href="https://github.com/geelen/mcp-remote">mcp-remote</a> transport
layer). Delete that directory to force re-authentication or
change access levels.</p>
<h1 id="querying-my-account">Querying my account</h1>
<h2 id="list-zones">List zones</h2>
<pre><code>> What zones do I have in Cloudflare?
</code></pre>
<p>Claude called <code>execute</code> with code that hit <code>GET /zones</code> and returned:</p>
<table>
<thead>
<tr>
<th>Zone</th>
<th>Status</th>
</tr>
</thead>
<tbody>
<tr>
<td>example.com</td>
<td>active</td>
</tr>
<tr>
<td>example.info</td>
<td>active</td>
</tr>
</tbody>
</table>
<h2 id="dns-records">DNS records</h2>
<pre><code>> Show me the DNS records for example.com
</code></pre>
<p>This one appears the most useful. Sanitized sample from the
full output:</p>
<table>
<thead>
<tr>
<th>Type</th>
<th>Name</th>
<th>Content</th>
<th>Proxied</th>
</tr>
</thead>
<tbody>
<tr>
<td>A</td>
<td>example.com</td>
<td>198.51.100.1</td>
<td>No</td>
</tr>
<tr>
<td>CNAME</td>
<td>blog.example.com</td>
<td>c.storage.googleapis.com</td>
<td>Yes</td>
</tr>
<tr>
<td>MX</td>
<td>example.com</td>
<td>example-com.mail.protection.outlook.com</td>
<td>No</td>
</tr>
<tr>
<td>TXT</td>
<td>example.com</td>
<td>v=spf1 include:spf.protection.outlook.com -all</td>
<td>No</td>
</tr>
</tbody>
</table>
<p>The blog subdomain is proxied through Cloudflare (the orange cloud),
pointing at a GCS bucket. The root domain has A records from a
previous setup. The MX and TXT records are for email.</p>
<p>Useful when debugging
<a href="/cloudflare-https-frontend.html">certificate issues</a> or verifying
propagation after a change.</p>
<h2 id="zone-details">Zone details</h2>
<pre><code>> What are the nameservers for example.com?
</code></pre>
<p>It returned the two Cloudflare nameservers assigned to the zone,
plus the creation date and plan tier.</p>
<h2 id="what-else-to-ask-it">What else to ask it</h2>
<p>DNS lookups are the obvious use, but the full API means you can
ask about things you'd otherwise dig through the dashboard for:</p>
<ul>
<li>"Is Cloudflare proxying blog.example.com or is it DNS-only?"</li>
<li>"Do I have any DNS records still pointing at my old hosting
IP?"</li>
<li>"Show me all TXT records across all my zones"</li>
<li>"What Workers do I have deployed?"</li>
<li>"Compare the DNS records for example.com and example.info"</li>
<li>"Are there any firewall events for my zone?"</li>
<li>"What countries is my traffic coming from right now?"</li>
</ul>
<h1 id="product-specific-servers">Product-specific servers</h1>
<p>The main <code>mcp.cloudflare.com/mcp</code> endpoint covers the entire API,
but Cloudflare also ships
<a href="https://developers.cloudflare.com/agents/model-context-protocol/mcp-servers-for-cloudflare/">focused MCP servers</a>
for individual products:</p>
<ul>
<li><strong>DNS Analytics</strong>: <code>dns-analytics.mcp.cloudflare.com/mcp</code></li>
<li><strong>Observability</strong>: <code>observability.mcp.cloudflare.com/mcp</code></li>
<li><strong>Workers Builds</strong>: <code>builds.mcp.cloudflare.com/mcp</code></li>
<li><strong>Radar</strong>: <code>radar.mcp.cloudflare.com/mcp</code> (internet traffic
data)</li>
<li><strong>Browser Rendering</strong>: <code>browser.mcp.cloudflare.com/mcp</code></li>
</ul>
<p>Same transport, same <code>claude mcp add --transport http</code> setup.
The main server is enough for general use.</p>
<h1 id="compared-to-the-ga4-mcp-server">Compared to the GA4 MCP server</h1>
<p>The <a href="/ga4-mcp.html">GA4 MCP server</a> runs locally via <code>pipx</code>, uses
Google Application Default Credentials, and exposes five specific
tools. Setting it up requires enabling GCP APIs and running
<code>gcloud auth</code>.</p>
<p>The Cloudflare MCP is a remote server. No local install, no API
keys to manage. OAuth in the browser and you're done. The tradeoff
is you need network access to <code>mcp.cloudflare.com</code> and the
server's availability depends on Cloudflare.</p>
<p>The two-tool design (search + execute) is interesting. It means Claude
has to write JavaScript to query the API. But it
also means the responses are raw API output rather than pre-formatted
tool results. For most queries that's fine.</p>


<p>I owned some domain names that used godaddy.com as their registrar. With
Godaddy it takes <strong>forever</strong> for changes to propagate, which can be a real
problem when you need to update TXT records.</p>
<p>Cloudflare is awesome in that they're really affordable for domains, have
really nice CDN capabilities, don't charge you for "protection", and their DNS
changes replicate super fast.</p>
<p>Here's how to move a domain from Godaddy to Cloudflare.</p>
<h1 id="steps">Steps</h1>
<h2 id="unlock-the-domain">Unlock the Domain</h2>
<ol>
<li>Log into Godaddy</li>
<li>Go to <a href="https://dcc.godaddy.com/domains/">My Domains</a> and select your domain</li>
<li>Click "Edit" next to <code>Domain lock: On</code> to show the slider. Set it to "off".</li>
</ol>
<h2 id="get-your-transfer-authorization-code">Get your transfer authorization code</h2>
<ol>
<li>Log into Godaddy</li>
<li>Go to <a href="https://dcc.godaddy.com/domains/">My Domains</a> and select your domain</li>
<li>Click 'Transfer domain away from GoDaddy'</li>
<li>Continue with transfer</li>
<li>Skip whatever annoying ads they give you</li>
<li>Go to your email and get your registration code</li>
</ol>
<h2 id="transfer-the-domain-to-cloudflare">Transfer the Domain to Cloudflare</h2>
<p>If you haven't added your site yet, add it now in Cloudflare. You need to add
the nameserver settings too before you can transfer it. This tripped me up,
since I hadn't redirected the nameservers from GoDaddy's default ones to
Cloudflare's yet.</p>
<ol>
<li>From Cloudflare's dashboard, go to Domain Registration</li>
<li>It should let you choose your domain here. If it says there are none
available, you haven't set up your existing domain with them yet.</li>
<li>Enter your auth code, click Confirm Authorization Codes</li>
<li>Fill out the contact info, Confirm and Finalize Transfer</li>
</ol>
<p>That's it, your domain is now transferred to Cloudflare</p>
<h1 id="references">References</h1>
<ul>
<li><a href="https://developers.cloudflare.com/registrar/transfer-instructions/godaddy/">Cloudflare transfer guide</a></li>
<li><a href="https://ca.godaddy.com/help/unlock-my-domain-for-transfer-410">GoDaddy unlock for xfer</a></li>
</ul>


Kyle Pericak

"It works in my environment"

Categories

Tags