Cloudflare DNS MCP integration for AI agents.
Connect AI agents to Cloudflare DNS through 8 structured actions, including get dns record, create dns record, and delete dns record. Review authentication…
- ACTION CONTRACTS
- 8
- AUTHENTICATION
- API key + OAuth 2.0
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Cloudflare DNS integration exposes
The Cloudflare DNS Agent App exposes 8 provider-backed actions for developer tools and security work. Its current contract lets an authorized agent get one dns record from a cloudflare zone, create a dns record inside a cloudflare zone, and delete one dns record from a cloudflare zone. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key and OAuth 2.0. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Cloudflare DNS account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Cloudflare DNS capabilities.
Showing 8 of 8 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_dns_recordREADGet one DNS record from a Cloudflare zone.
INPUTS: zoneId / dnsRecordId
create_dns_recordWRITECreate a DNS record inside a Cloudflare zone.
INPUTS: zoneId / type / name / content / data
delete_dns_recordHIGH IMPACTDelete one DNS record from a Cloudflare zone.
INPUTS: zoneId / dnsRecordId
get_zoneREADGet one Cloudflare zone by zone ID.
INPUTS: zoneId
list_accountsREADList Cloudflare accounts visible to the current credential.
INPUTS: page / perPage
list_dns_recordsREADList DNS records inside one Cloudflare zone.
INPUTS: zoneId / page / perPage / type / name
list_zonesREADList the Cloudflare zones visible to the current API token.
INPUTS: page / perPage / name / status / accountId
update_dns_recordWRITEPatch one DNS record inside a Cloudflare zone.
INPUTS: zoneId / dnsRecordId / type / name / content
INPUT CONTRACTS
Know what the action needs before it runs.
get_dns_record
zoneIdREQUIRED- The Cloudflare zone ID.
dnsRecordIdREQUIRED- The Cloudflare DNS record ID.
create_dns_record
zoneIdREQUIRED- The Cloudflare zone ID.
typeREQUIRED- The DNS record type.
nameREQUIRED- The DNS record name.
contentOPTIONAL- The DNS record content.
dataOPTIONAL- A free-form object accepted by the Cloudflare API.
delete_dns_record
zoneIdREQUIRED- The Cloudflare zone ID.
dnsRecordIdREQUIRED- The Cloudflare DNS record ID.
get_zone
zoneIdREQUIRED- The Cloudflare zone ID.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Dns Record
Get one DNS record from a Cloudflare zone. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_dns_recordControl Create Dns Record
Create a DNS record inside a Cloudflare zone. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_dns_recordVerify with Get Zone
Get one Cloudflare zone by zone ID. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_zoneSAFETY BOUNDARY
Operate Cloudflare DNS with explicit limits
- Authorize Cloudflare DNS with API key and OAuth 2.0 and grant only the provider access required by the selected actions.
- 3 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `delete_dns_record` as high-impact operations and require an explicit approval boundary.
- The sampled contract declares provider scopes including `zone.read`, `dns.read`, and `dns.write`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the Cloudflare DNS task completed successfully.
CONNECTION MODEL
API key + OAuth 2.0
Cloudflare API token sent as a Bearer token. Create one from the Cloudflare API Tokens page: https://dash.cloudflare.com/profile/api-tokens
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 5
- WRITE SIGNALS
- 2
- HIGH IMPACT
- 1
- REVIEW SIGNALS
- 0
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Cloudflare DNS.