Cloudflare MCP Servers

You just deployed a Cloudflare Worker that handles authentication. It works in dev, but something is off in production — the KV reads are returning stale data and the R2 bucket permissions look wrong. You open four browser tabs: the Workers dashboard, the KV namespace viewer, the R2 bucket settings, and the Cloudflare docs. You copy values between tabs, cross-reference configuration, and lose twenty minutes before finding the issue. A single mistyped namespace binding name.

Cloudflare’s MCP servers bring your entire edge infrastructure into your AI’s context. The AI reads your Worker code, inspects KV namespaces, queries D1 databases, checks R2 buckets, and searches the Cloudflare docs — all from one conversation in your editor.

What You’ll Walk Away With

• Setup for Cloudflare’s managed remote MCP servers
• Overview of all 16 available servers and when to use each
• Prompts for Workers deployment, KV/R2 management, D1 queries, and documentation lookup
• OAuth authentication flow and account selection

How Cloudflare MCP Works

Cloudflare runs remote MCP servers — unlike most MCP servers that run locally on your machine, these are hosted services that authenticate via OAuth. When you first connect, a browser window opens for Cloudflare login. After authentication, you select which Cloudflare account to use, and the MCP server operates with your account permissions.

All Cloudflare MCP servers follow the same URL pattern: https://{service}.mcp.cloudflare.com/mcp

The Full Server Catalog

Cloudflare provides 16 managed MCP servers, but you do not need all of them. Start with the ones that match your stack:

Server	URL	What It Does
Documentation	https://docs.mcp.cloudflare.com/mcp	Search Cloudflare’s reference docs
Workers Bindings	https://bindings.mcp.cloudflare.com/mcp	Manage Workers + bound resources (KV, R2, D1, Durable Objects, Queues, Vectorize, Hyperdrive)
Workers Builds	https://builds.mcp.cloudflare.com/mcp	Inspect and manage Workers build history
Observability	https://observability.mcp.cloudflare.com/mcp	Query Workers logs, errors, and analytics
Radar	https://radar.mcp.cloudflare.com/mcp	Internet traffic, trends, and URL scans
Container	https://containers.mcp.cloudflare.com/mcp	Spin up a sandbox container for the agent
Browser Rendering	https://browser.mcp.cloudflare.com/mcp	Fetch pages, screenshots, and markdown via a headless browser
Logpush	https://logs.mcp.cloudflare.com/mcp	Summarize Logpush job health
AI Gateway	https://ai-gateway.mcp.cloudflare.com/mcp	Inspect AI Gateway logs, prompts, and responses
AI Search (AutoRAG)	https://autorag.mcp.cloudflare.com/mcp	List and query AutoRAG document indexes
Audit Logs	https://auditlogs.mcp.cloudflare.com/mcp	Query account audit logs and generate reports
DNS Analytics	https://dns-analytics.mcp.cloudflare.com/mcp	Optimize DNS performance and debug issues
Digital Experience Monitoring	https://dex.mcp.cloudflare.com/mcp	Insights into org connectivity and app health
Cloudflare One CASB	https://casb.mcp.cloudflare.com/mcp	Surface SaaS security misconfigurations
GraphQL	https://graphql.mcp.cloudflare.com/mcp	Query the Cloudflare analytics GraphQL API
Agents SDK Docs	https://agents.cloudflare.com/mcp	Reference docs for building on the Agents SDK

Tip

Start with just two or three servers. Adding all 16 overwhelms the AI’s context with tool descriptions it does not need. For most Workers projects, connecting Workers Bindings + Workers Builds + Observability + Documentation is enough. Add more as your workflow demands them.

Note

There is no standalone KV, R2, or D1 server. Those primitives are reached through the single Workers Bindings server, which sees every resource bound to your Workers. If you came here looking for a “Cloudflare KV MCP,” Workers Bindings is the one you want.

Setup: Bindings + Builds + Observability (Recommended Starting Point)

This trio covers most Workers work: Workers Bindings reaches your KV, R2, D1, Durable Objects, Queues, Vectorize, and Hyperdrive resources; Workers Builds inspects deployments; Observability queries logs and errors.

Cursor

{
  "mcpServers": {
    "cloudflare-bindings": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://bindings.mcp.cloudflare.com/mcp"]
    },
    "cloudflare-builds": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://builds.mcp.cloudflare.com/mcp"]
    },
    "cloudflare-observability": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://observability.mcp.cloudflare.com/mcp"]
    }
  }
}

Claude Code

claude mcp add --transport http cf-bindings https://bindings.mcp.cloudflare.com/mcp
claude mcp add --transport http cf-builds https://builds.mcp.cloudflare.com/mcp
claude mcp add --transport http cf-observability https://observability.mcp.cloudflare.com/mcp

Or add to .mcp.json in your project root:

{
  "mcpServers": {
    "cloudflare-bindings": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://bindings.mcp.cloudflare.com/mcp"]
    },
    "cloudflare-builds": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://builds.mcp.cloudflare.com/mcp"]
    },
    "cloudflare-observability": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://observability.mcp.cloudflare.com/mcp"]
    }
  }
}

Codex

[mcp_servers.cloudflare-bindings]
url = "https://bindings.mcp.cloudflare.com/mcp"

[mcp_servers.cloudflare-builds]
url = "https://builds.mcp.cloudflare.com/mcp"

[mcp_servers.cloudflare-observability]
url = "https://observability.mcp.cloudflare.com/mcp"

Each server triggers its own OAuth flow on first use. After the first authorization, credentials are cached locally.

Workers Workflows

Tip

Copy-paste prompt for Worker debugging:

“List all my deployed Workers. Find the one handling authentication routes. Read its code and check for any issues with the KV binding configuration. Compare the binding names in the Worker code to the actual KV namespaces in my account and flag any mismatches.”

Tip

Copy-paste prompt for Worker creation:

“Create a new Cloudflare Worker called ‘api-rate-limiter’ that uses a KV namespace to track request counts per IP address. The Worker should allow 100 requests per minute per IP and return a 429 response with a Retry-After header when the limit is exceeded. Deploy it to my account.”

KV and D1 Workflows

KV, R2, and D1 access all flow through the Workers Bindings server — there is no separate per-primitive server to add. Point your prompts at the namespaces and databases bound to your Workers.

Tip

Copy-paste prompt for data inspection:

“Using the Workers Bindings server, list all KV namespaces in my account. For the namespace called ‘user-sessions’, list the last 20 keys and read the value of the most recent one. Check if the session data structure matches what the Worker code in src/worker.ts expects.”

Tip

Copy-paste prompt for D1 database management:

“Using the Workers Bindings server, list my D1 databases. Connect to the ‘production’ database and show the schema for all tables. Then run a query to count active users from the last 7 days, grouped by signup source. Compare the schema to the Drizzle ORM types in src/lib/db/schema.ts and flag any drift.”

Cloudflare Documentation Search

The Docs MCP server is underrated. Instead of searching docs.cloudflare.com in a browser, the AI searches Cloudflare’s documentation directly and applies what it finds to your code.

Cursor

{
  "mcpServers": {
    "cloudflare-docs": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://docs.mcp.cloudflare.com/mcp"]
    }
  }
}

Claude Code

claude mcp add cf-docs -- npx -y mcp-remote https://docs.mcp.cloudflare.com/mcp

Codex

[mcp_servers.cloudflare-docs]
url = "https://docs.mcp.cloudflare.com/mcp"

Tip

Copy-paste prompt for documentation-grounded development:

“Search the Cloudflare documentation for how to set up Durable Objects with WebSocket hibernation. Read the relevant docs and then implement a chat room Durable Object in src/durable-objects/chat-room.ts that follows Cloudflare’s recommended patterns exactly.”

When This Breaks

OAuth flow fails. Cloudflare’s OAuth redirects to localhost. If something blocks localhost callbacks (VPN, corporate proxy, browser extensions), the flow hangs. Try a different browser or temporarily disable the proxy.

Wrong account selected. If you have multiple Cloudflare accounts, the MCP server lets you choose which one to use. If you are seeing the wrong Workers or KV namespaces, disconnect and reconnect to select the correct account.

Rate limiting. Cloudflare MCP servers are backed by the Cloudflare API, which has rate limits. If you hit them, reduce the scope of your prompts. Instead of “list all KV keys,” try “list the first 50 KV keys matching the prefix ‘user:’.”

Stale data after deployments. If you deploy a Worker through Wrangler and then ask the MCP server about it, there may be a brief delay before the new deployment appears. Wait 10-15 seconds and try again.

Too many MCP servers slow down startup. Each Cloudflare MCP server adds tool descriptions to the AI’s context. If you have all 16 connected, that is hundreds of tool descriptions competing for attention. Connect only the servers you actively need.

What’s Next

MCP Security Secure your remote MCP connections with OAuth and access controls.

Database MCP Connect to databases beyond Cloudflare D1.