Skip to main content

Cloudflare MCP

Benchmarked against: Anthropic — Claude on 3rd-party platforms (Vertex AI / Bedrock) Provider: Cloudflare official MCP server Tools: search (OpenAPI spec search) + execute (API execution) Authentication: Cloudflare API token

The Cloudflare MCP server gives SuperPortia agents direct access to the Cloudflare API. This is the infrastructure control plane for SS3 (the cloud ship) — managing Workers, D1 databases, R2 storage, Vectorize indexes, and all other Cloudflare services.

Why Cloudflare MCP?​

SuperPortia's cloud infrastructure runs entirely on Cloudflare:

ServiceUsage in SuperPortia
WorkersCloud UB API endpoint (worker.js)
D1Cloud UB database (entries, WOs, messages)
VectorizeSemantic search embeddings
R2Backup storage
PagesDocs site deployment (Phase 3)
KVConfiguration and caching

The Cloudflare MCP allows agents to manage all of these services programmatically, without leaving the agent session.

Tools​

The Cloudflare MCP exposes exactly 2 tools:

search — OpenAPI spec search​

Search the Cloudflare API specification to find the right endpoint for any operation.

// Find endpoints related to D1 databases
async () => {
  const results = [];
  for (const [path, methods] of Object.entries(spec.paths)) {
    for (const [method, op] of Object.entries(methods)) {
      if (op.tags?.some(t => t.toLowerCase() === 'd1')) {
        results.push({ method: method.toUpperCase(), path, summary: op.summary });
      }
    }
  }
  return results;
}

The search tool has the complete Cloudflare OpenAPI spec with all $ref entries pre-resolved. This means agents can explore available APIs, check parameter schemas, and understand request/response formats before executing.

execute — API execution​

Execute JavaScript code against the Cloudflare API using a pre-authenticated client.

// List all D1 databases
async () => {
  return cloudflare.request({
    method: "GET",
    path: `/accounts/${accountId}/d1/database`
  });
}

The execute tool provides:

  • cloudflare.request() — pre-authenticated API client
  • accountId — your Cloudflare account ID
  • Full JavaScript execution environment (async/await, JSON parsing, etc.)

Common operations​

D1 database management​

// Query Cloud UB entries count
async () => {
  const dbId = "your-d1-database-id";
  return cloudflare.request({
    method: "POST",
    path: `/accounts/${accountId}/d1/database/${dbId}/query`,
    body: { sql: "SELECT COUNT(*) as total FROM entries" }
  });
}

Workers management​

// List all Workers
async () => {
  return cloudflare.request({
    method: "GET",
    path: `/accounts/${accountId}/workers/scripts`
  });
}

R2 bucket operations​

// List R2 buckets
async () => {
  return cloudflare.request({
    method: "GET",
    path: `/accounts/${accountId}/r2/buckets`
  });
}

Vectorize index management​

// List Vectorize indexes
async () => {
  return cloudflare.request({
    method: "GET",
    path: `/accounts/${accountId}/vectorize/v2/indexes`
  });
}

Security considerations​

RuleWhy
API token scoped to accountCannot access other Cloudflare accounts
Read-before-writeAlways search first to understand the API, then execute
Pre-Flight Check for destructive opsDeleting D1 databases, Workers = PFC 🔴 zone
Captain approval for infrastructure changesHITL boundary for production changes

Destructive operations (deleting databases, dropping Workers, purging R2 buckets) should always require Captain confirmation per Company Constitution §5.

PageRelationship
MCP Servers OverviewAll servers in the fleet
Cloud UB MCPThe Worker that runs on Cloudflare
Data ResidencyWhere data lives on Cloudflare
SRE StatusHealth monitoring of Cloudflare services