Cloudflare MCP server: setup & sharing

Workers, KV, R2, and D1 visibility for remote teammates — deployments need your approval.

Run on your machine

Start the server on your host machine. Tools not listed in --allow are completely hidden from the agent.

Terminal · Host machine

npx -y @mcpwire/cli share \
  --name cloudflare \
  --allow "zones_list,get_kvs,kv_list,kv_get,d1_list_databases,worker_list,worker_get,r2_list_buckets,r2_list_objects,r2_get_object" \
  --redact-secrets \
  -- npx -y @cloudflare/mcp-server-cloudflare@0.2.0

Exposes 10 default tools with pattern-based secret redaction. Optionally set an expiry with --ttl 30m, prompt for approvals with --confirm, or limit calls with --max-calls 20.

Connect your teammate’s agent

MCPWire prints a unique wire://... ticket in your terminal. Send it privately to your teammate to paste into their MCP client:

Claude Desktop · Cursor · Windsurf config

{
  "mcpServers": {
    "cloudflare": {
      "command": "npx",
      "args": [
        "-y",
        "@mcpwire/cli",
        "join",
        "wire://<TICKET_FROM_HOST>"
      ]
    }
  }
}

Replace <TICKET_FROM_HOST> with the active session ticket. The agent can only discover and call the tools exposed above.

Scoped tool permissions

MCPWire acts as a Layer 7 JSON-RPC firewall. Requests for blocked tools are dropped on the wire before ever touching your machine.

Tool	Default Policy	Notes
`zones_list`	Allowed	Lists zones in the account.
`get_kvs`	Allowed	Lists KV namespaces.
`kv_list`	Allowed	Lists keys in a KV namespace.
`kv_get`	Allowed	Reads a value from KV.
`d1_list_databases`	Allowed	Lists D1 databases.
`worker_list`	Allowed	Lists Workers.
`worker_get`	Allowed	Reads a Worker's script content.
`r2_list_buckets`	Allowed	Lists R2 buckets.
`r2_list_objects`	Allowed	Lists objects in an R2 bucket.
`r2_get_object`	Allowed	Reads an object from R2.
`d1_query`	Blocked (Review)	Runs arbitrary SQL against D1 — the query can write as well as read.
`analytics_get`	Blocked (Review)	Reads Workers analytics; requires a paid Workers plan.
`kv_put`	Blocked (High risk)	Writes values to KV.
`kv_delete`	Blocked (High risk)	Deletes KV keys.
`r2_put_object`	Blocked (High risk)	Writes objects to R2.
`r2_delete_object`	Blocked (High risk)	Deletes objects from R2.
`worker_put`	Blocked (High risk)	Creates or updates Worker scripts.
`worker_deploy`	Blocked (High risk)	Deploys Workers.
`worker_delete`	Blocked (High risk)	Deletes Workers.
`d1_create_database`	Blocked (High risk)	Creates D1 databases.
`d1_delete_database`	Blocked (High risk)	Deletes D1 databases.
`secret_put`	Blocked (High risk)	Stores Worker secrets.
`version_rollback`	Blocked (High risk)	Rolls a Worker back to an earlier version.

Test and verify

Try these recommended prompts to confirm the agent receives expected outputs and that restricted actions fail safely.

Try Cloudflare

Create an API token with Account: Read plus the resource scopes you intend to share, and set both CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN in the host environment. Prefer a token limited to the account and permission set you are comfortable exposing.

Ask the agent to list Workers with worker_list and inspect one with worker_get, or to read KV with kv_list and kv_get. Stored values, script contents, and R2 objects flow to the guest while the session is open. The official server registers 150+ tools — every deploy and delete tool (worker_deploy, worker_put, kv_put, d1_delete_database, version_rollback, and more) stays outside the default allowlist, and d1_query is excluded too because its SQL can write.

The generated command above contains the catalog’s explicit default allowlist. Check the guest’s tool list before making calls and use the server’s argument schema for required fields. See the CLI guide for guest configuration and session controls for approvals, redaction, and expiry.

Review the session in your browser: Add --record session.wirelog to your host command. Drop the resulting file into the Session Replay Viewer to inspect timestamps, latency, blocked attempts, and secret scrubbing.

← All server guides Open in command builder