Cloudflare Worker MCP integration for AI agents.
Connect AI agents to Cloudflare Worker through 25 structured actions, including get build, create manual build, cancel build, and patch worker script setting…
- ACTION CONTRACTS
- 25
- AUTHENTICATION
- Custom credentials + OAuth 2.0
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Cloudflare Worker integration exposes
The Cloudflare Worker Agent App exposes 25 provider-backed actions for developer tools work. Its current contract lets an authorized agent get the current status and outcome of one workers builds job, start a workers builds job from a configured trigger and branch or commit, and cancel a queued or running workers builds job. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses Custom credentials and OAuth 2.0. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Cloudflare Worker account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Cloudflare Worker capabilities.
Showing 12 of 25 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_buildREADGet the current status and outcome of one Workers Builds job.
INPUTS: accountId / buildUuid
create_manual_buildWRITEStart a Workers Builds job from a configured trigger and branch or commit.
INPUTS: accountId / triggerUuid / branch / commitHash
cancel_buildHIGH IMPACTCancel a queued or running Workers Builds job.
INPUTS: accountId / buildUuid
patch_worker_script_settingsREVIEWPatch Worker metadata and configuration for a Cloudflare Worker script.
INPUTS: accountId / scriptName / bindings / compatibilityDate / compatibilityFlags
create_workerWRITECreate a Cloudflare Worker using the Workers beta API.
INPUTS: accountId / name / logpush / observability / subdomain
delete_workerHIGH IMPACTDelete a Cloudflare Worker and its associated resources using the Workers beta API.
INPUTS: accountId / workerId
delete_worker_scriptHIGH IMPACTDelete a Cloudflare Worker script.
INPUTS: accountId / scriptName / force
delete_worker_script_secretHIGH IMPACTDelete a secret binding from a Cloudflare Worker script.
INPUTS: accountId / scriptName / secretName
edit_workerWRITEPartially update a Cloudflare Worker using the Workers beta API while leaving omitted fields unchanged.
INPUTS: accountId / workerId / name / logpush / observability
get_build_logsREADGet one page of log lines for a Workers Builds job.
INPUTS: accountId / buildUuid / cursor
get_workerREADGet one Worker by Worker ID using the Workers beta API.
INPUTS: accountId / workerId
get_worker_script_contentREADFetch the raw source content for a Cloudflare Worker script.
INPUTS: accountId / scriptName
INPUT CONTRACTS
Know what the action needs before it runs.
get_build
accountIdOPTIONAL- The Cloudflare account ID. Omit this when the connection can uniquely determine the account. This field is required for multi-account OAuth connections; use list_accounts to find an accessible account ID.
buildUuidREQUIRED- The Workers Builds job UUID.
create_manual_build
accountIdOPTIONAL- The Cloudflare account ID. Omit this when the connection can uniquely determine the account. This field is required for multi-account OAuth connections; use list_accounts to find an accessible account ID.
triggerUuidREQUIRED- The Workers Builds trigger UUID.
branchOPTIONAL- The Git branch to build.
commitHashOPTIONAL- The Git commit hash to build.
cancel_build
accountIdOPTIONAL- The Cloudflare account ID. Omit this when the connection can uniquely determine the account. This field is required for multi-account OAuth connections; use list_accounts to find an accessible account ID.
buildUuidREQUIRED- The Workers Builds job UUID.
patch_worker_script_settings
accountIdOPTIONAL- The Cloudflare account ID. Omit this when the connection can uniquely determine the account. This field is required for multi-account OAuth connections; use list_accounts to find an accessible account ID.
scriptNameREQUIRED- The Cloudflare Worker script name.
bindingsOPTIONAL- The full bindings array to set on the script.
compatibilityDateOPTIONAL- The compatibility date.
compatibilityFlagsOPTIONAL- The compatibility flags.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Build
Get the current status and outcome of one Workers Builds job. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_buildControl Create Manual Build
Start a Workers Builds job from a configured trigger and branch or commit. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_manual_buildVerify with Create Manual Build
Start a Workers Builds job from a configured trigger and branch or commit. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
create_manual_buildSAFETY BOUNDARY
Operate Cloudflare Worker with explicit limits
- Authorize Cloudflare Worker with Custom credentials and OAuth 2.0 and grant only the provider access required by the selected actions.
- 9 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `cancel_build`, `delete_worker`, and `delete_worker_script` as high-impact operations and require an explicit approval boundary.
- The sampled contract declares provider scopes including `workers-ci.write`, `workers-scripts.write`, `workers-ci.read`, and `workers-scripts.read`; verify the complete action contract before execution.
- After a call, inspect the structured result and execution record before reporting that the Cloudflare Worker task completed successfully.
CONNECTION MODEL
Custom credentials + OAuth 2.0
Cloudflare Worker uses Custom credentials and OAuth 2.0. Connection requirements and availability are determined by the provider and the Working Machines deployment.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 13
- WRITE SIGNALS
- 5
- HIGH IMPACT
- 4
- REVIEW SIGNALS
- 3
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Cloudflare Worker.