Cloudflare MCP: DNS, zones and WAF lists from your AI app

Set up Cloudflare in Claude, ChatGPT or Cursor

1. 1Click Connect Cloudflare free and sign in with your Cloudflare account.
2. 2Every tool is on after you connect, and the list appears then. Deleting a zone removes it from your Cloudflare account for good, so switch off the tools that delete zones, DNS records or WAF lists if your AI app should read and propose rather than remove.
3. 3Add ContextGate to your AI app as a connector or MCP server. The steps for each app are on the Works with page.
4. 4Ask your AI app which firewall rules are set on one of your Cloudflare zones, then open Activity to see the call.

Cloudflare changes and checks from a chat

• List the Cloudflare accounts you can access, their members and the zones in each.
• Add a DNS record to a zone, or update only the fields you name on an existing one.
• Audit the firewall rules on a zone before a change goes out.
• Check load balancer pools and monitors across an account.
• Create an IP list for the WAF, or update a list's description.

Hold back destructive DNS changes

• Switch off the delete tools for zones, DNS records and WAF lists; your AI app can still read and create.
• Add a policy that warns or blocks before a DNS record is created or updated.
• Activity keeps a record of every Cloudflare call your team's AI apps make, so a changed record can be traced to the call behind it.

What you get with Cloudflare and ContextGate

• Your AI apps can use CloudflareClaude, Cursor, ChatGPT and other AI apps reach Cloudflare through the one ContextGate connection you add to them.
• You choose which tools they can useSwitch off any Cloudflare tool you don't want used. It's hidden from your AI apps and refused if called.
• Every call is checked and recordedYour policies check each call (for example, personal data is hidden and secrets are blocked), and Activity keeps a record of it.

ContextGate sees only the tool calls that go through it, not your AI app's built-in tools or your chats.

Cloudflare tools

Examples of what your AI apps can do in Cloudflare. You'll see the exact list of tools after you connect it.

• Create DNS recordTool to create a new dns record within a specific zone. use after obtaining the zone id to programmatically add dns entries.
• Create WAF ListTool to create a new empty waf list for the account. use after confirming the account id. example: create list(account id="<id>", kind="ip", name="blocklist")
• Create ZoneTool to create a new zone. use after confirming account id when adding a domain to cloudflare.
• Delete DNS RecordTool to delete a dns record within a specific zone. use after confirming zone and record ids. example: "delete dns record 372e6795... from zone 023e105f4ecef..."
• Delete WAF ListTool to delete a waf list. use when you need to remove a list after verifying no filters reference it. example: delete list(account id="<account id>", list id="<list id>")
• Delete ZoneTool to delete a zone. use after confirming the zone identifier to permanently remove a dns zone from your cloudflare account. example: delete zone(zone identifier="023e105f4ecef8ad9ca31a8372d0c353")
• List WAF ListsTool to fetch all waf lists (no items) for an account. use after confirming account id.
• List Account MembersTool to list members of a given cloudflare account. use after confirming the account id.
• List AccountsTool to list all accounts accessible to the user. use when you need to enumerate cloudflare accounts for selection or auditing.
• List Firewall RulesTool to list firewall rules for a specific zone. use after confirming the zone id to retrieve and audit current firewall rules.
• List MonitorsTool to list all load-balancer monitors in a cloudflare account. use after creating or updating monitors to retrieve a paginated list.
• List PoolsTool to list all load balancer pools in a cloudflare account. use after confirming account id to discover pool ids.
• List ZonesThis tool lists, searches, sorts, and filters your zones.
• Update DNS recordTool to update an existing dns record within a specific zone. use after confirming both zone and record identifiers; only provided fields are modified.
• Update WAF ListTool to update the description of a waf list (cannot update items). use after confirming list metadata.
• Update ZoneTool to update properties of an existing zone. use after confirming the zone id; only one field can be modified per call.