# Cloudflare MCP Server

> Cloudflare MCP Server is an officially published MCP server from Cloudflare. Anomity scores its risk at 45 out of 100 (medium). It matches 1 dangerous capability combination.

- **Canonical URL:** https://catalog.anomity.ai/mcp/cloudflare-mcp-server
- **Kind:** MCP server
- **Publisher:** Cloudflare
- **Trust level:** official
- **Risk score:** 45/100 (medium)
- **Website:** https://developers.cloudflare.com/agents/model-context-protocol/
- **Documentation:** https://developers.cloudflare.com/agents/model-context-protocol/
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/mcp/cloudflare-mcp-server

## Description

Cloudflare ships a family of remote MCP servers covering Workers, KV, R2, D1, DNS, Workers Logs, and account APIs. An agent can read observability data, query a D1 database, inspect DNS records, or deploy a Worker, depending on which server and scopes are connected.

This is infrastructure control, so the risk is proportional to the API token behind it rather than to the protocol. The declared capabilities are outbound network access, credential access, and database reads and writes for the D1 surface. A token that can edit DNS or deploy Workers can redirect or intercept production traffic — treat connecting this server as granting an agent a seat on your infrastructure, and prefer read-scoped tokens for anything an assistant uses interactively.

## Why it scored 45

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Published by the vendor | -40 | trust offset |  |
| 2 high-risk capabilities: credentials:access, database:write | +20 | critical |  |
| Database exfiltration risk (high) | +15 | high | Database read combined with outbound network can exfiltrate production data. |

Clamped result: **45/100**, band **medium**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `network:outbound` | Outbound network | Can make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access. |
| `credentials:access` | Credentials access | Reads provider API keys, OAuth tokens, or other secrets from the host keychain or environment. |
| `database:read` | Database read | Reads from connected databases. Useful for query and analytics agents; risky when combined with outbound network. |
| `database:write` | Database write | Writes to connected databases. High-impact; combined with outbound network is treated as exfiltration-class. |

## Dangerous combinations matched

### Database exfiltration risk (high)

Database read combined with outbound network can exfiltrate production data.

Capabilities: `database:read`, `network:outbound`

## Related MCP servers

- [Airtable MCP Server](https://catalog.anomity.ai/mcp/airtable-mcp-server) — risk 45 (medium)
- [MongoDB MCP Server](https://catalog.anomity.ai/mcp/mongodb-mcp-server) — risk 45 (medium)
- [Neon MCP Server](https://catalog.anomity.ai/mcp/neon-mcp-server) — risk 45 (medium)
- [PostgreSQL](https://catalog.anomity.ai/mcp/postgres) — risk 45 (medium)
- [Supabase MCP Server](https://catalog.anomity.ai/mcp/supabase-mcp-server) — risk 45 (medium)
- [Grafana MCP Server](https://catalog.anomity.ai/mcp/grafana-mcp-server) — risk 35 (medium)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json