{
  "markdown": "# MCP Cloudflare CrunchTools\n\nA secure MCP (Model Context Protocol) server for Cloudflare DNS, Transform Rules, Page Rules, and cache management.\n\n## Overview\n\nThis MCP server is designed to be:\n\n- **Secure by default** - Comprehensive threat modeling, input validation, and token protection\n- **No third-party services** - Runs locally via stdio, your API token never leaves your machine\n- **Cross-platform** - Works on Linux, macOS, and Windows\n- **Automatically updated** - GitHub Actions monitor for CVEs and update dependencies\n- **Containerized** - Available at `quay.io/crunchtools/mcp-cloudflare` built on [Hummingbird Python](https://quay.io/repository/hummingbird/python) base image\n\n## Naming Convention\n\n| Component | Name |\n|-----------|------|\n| GitHub repo | [crunchtools/mcp-cloudflare](https://github.com/crunchtools/mcp-cloudflare) |\n| Container | `quay.io/crunchtools/mcp-cloudflare` |\n| Python package (PyPI) | `mcp-cloudflare-crunchtools` |\n| CLI command | `mcp-cloudflare-crunchtools` |\n| Module import | `mcp_cloudflare_crunchtools` |\n\n## Why Hummingbird?\n\nThe container image is built on the [Hummingbird Python base image](https://quay.io/repository/hummingbird/python) from [Project Hummingbird](https://github.com/hummingbird-project), which provides:\n\n- **Minimal CVE exposure** - Hummingbird images are built with a minimal package set, dramatically reducing the attack surface compared to general-purpose images\n- **Regular updates** - Security patches are applied promptly, keeping CVE counts low\n- **Optimized for Python** - Pre-configured Python environment with uv package manager for fast, reproducible builds\n- **Production-ready** - Designed for production workloads with proper signal handling and non-root user defaults\n\nThis means your MCP server runs in a hardened environment with fewer vulnerabilities than typical Python container images\n\n## Features\n\n### Zone Management (2 tools)\n- `list_zones` - List all zones accessible by your API token\n- `get_zone` - Get zone details by ID or domain name\n\n### DNS Records (5 tools)\n- `list_dns_records` - List DNS records with filtering\n- `get_dns_record` - Get a single DNS record\n- `create_dns_record` - Create A, AAAA, CNAME, MX, TXT, NS, SRV, CAA records\n- `update_dns_record` - Update existing records\n- `delete_dns_record` - Delete records\n\n### Transform Rules (6 tools)\n- `list_request_header_rules` / `set_request_header_rules` - Modify request headers\n- `list_response_header_rules` / `set_response_header_rules` - Modify response headers\n- `list_url_rewrite_rules` / `set_url_rewrite_rules` - URL path/query rewrites\n\n### Page Rules (4 tools)\n- `list_page_rules` - List all page rules\n- `create_page_rule` - Create redirects, cache settings, SSL modes\n- `update_page_rule` - Modify existing rules\n- `delete_page_rule` - Remove rules\n\n### Cache Management (1 tool)\n- `purge_cache` - Purge by URL, tag, host, prefix, or everything\n\n## Installation\n\n### With uvx (Recommended)\n\n```bash\nuvx mcp-cloudflare-crunchtools\n```\n\n### With pip\n\n```bash\npip install mcp-cloudflare-crunchtools\n```\n\n### With Container\n\n```bash\npodman run -e CLOUDFLARE_API_TOKEN=your_token \\\n    quay.io/crunchtools/mcp-cloudflare\n```\n\n## Configuration\n\n### Creating a Cloudflare API Token\n\n1. **Navigate to API Tokens**\n   - Go to https://dash.cloudflare.com/profile/api-tokens\n   - Click \"Create Token\"\n   - Click \"Get started\" next to \"Create Custom Token\"\n\n2. **Configure Token Name**\n   - Enter: `mcp-cloudflare-crunchtools`\n\n3. **Configure Permissions**\n\n   The Permissions section has three dropdowns per row:\n   - **First dropdown**: Resource type (`Account` or `Zone`)\n   - **Second dropdown**: Specific permission category\n   - **Third dropdown**: Access level (`Read` or `Edit`)\n\n   Click \"+ Add more\" to add each permission row. For full management, add:\n\n   | Resource | Permission | Access |\n   |----------|------------|--------|\n   | Zone | Zone | Read |\n   | Zone | DNS | Edit |\n   | Zone | Page Rules | Edit |\n   | Zone | Transform Rules | Edit |\n   | Zone | Cache Purge | Purge |\n\n4. **Configure Zone Resources**\n   - First dropdown: Select \"Include\"\n   - Second dropdown: Select \"All zones\" or \"Specific zone\"\n\n5. **Configure Client IP Address Filtering (Optional)**\n   - Click \"Use my IP\" button to restrict token to your current IP\n\n6. **Create and Copy Token**\n   - Click \"Continue to summary\" → \"Create Token\"\n   - **IMPORTANT: Copy the token immediately** - it's only shown once!\n\n### Add to Claude Code\n\n```bash\nclaude mcp add mcp-cloudflare-crunchtools \\\n    --env CLOUDFLARE_API_TOKEN=your_token_here \\\n    -- uvx mcp-cloudflare-crunchtools\n```\n\nOr for the container version:\n\n```bash\nclaude mcp add mcp-cloudflare-crunchtools \\\n    --env CLOUDFLARE_API_TOKEN=your_token_here \\\n    -- podman run -i --rm -e CLOUDFLARE_API_TOKEN quay.io/crunchtools/mcp-cloudflare\n```\n\n### Permission Sets by Use Case\n\n#### Read-Only (viewing only)\n| Resource | Permission | Access |\n|----------|------------|--------|\n| Zone | Zone | Read |\n| Zone | DNS | Read |\n\n#### DNS Management Only\n| Resource | Permission | Access |\n|----------|------------|--------|\n| Zone | Zone | Read |\n| Zone | DNS | Edit |\n\n#### Full Management (all features)\n| Resource | Permission | Access |\n|----------|------------|--------|\n| Zone | Zone | Read |\n| Zone | DNS | Edit |\n| Zone | Page Rules | Edit |\n| Zone | Transform Rules | Edit |\n| Zone | Cache Purge | Purge |\n\n## Usage Examples\n\n### List Your Zones\n\n```\nUser: List my Cloudflare zones\nAssistant: [calls list_zones]\n```\n\n### Create a DNS Record\n\n```\nUser: Create an A record for www.example.com pointing to 192.168.1.1\nAssistant: [calls create_dns_record with type=A, name=www, content=192.168.1.1]\n```\n\n### Add Security Headers\n\n```\nUser: Add X-Content-Type-Options: nosniff to all responses for zone abc123...\nAssistant: [calls set_response_header_rules with appropriate rule]\n```\n\n### Purge Cache\n\n```\nUser: Purge the cache for https://example.com/styles.css\nAssistant: [calls purge_cache with files=[\"https://example.com/styles.css\"]]\n```\n\n## Security\n\nThis server was designed with security as a primary concern. See [SECURITY.md](SECURITY.md) for:\n\n- Threat model and attack vectors\n- Defense in depth architecture\n- Token handling best practices\n- Input validation rules\n- Audit logging\n\n### Key Security Features\n\n1. **Token Protection**\n   - Stored as SecretStr (never accidentally logged)\n   - Environment variable only (never in files or args)\n   - Sanitized from all error messages\n\n2. **Input Validation**\n   - Pydantic models for all inputs\n   - Allowlist for record types, actions\n   - Strict format validation for IDs\n\n3. **API Hardening**\n   - Hardcoded API base URL (prevents SSRF)\n   - TLS certificate validation\n   - Request timeouts\n   - Response size limits\n\n4. **Automated CVE Scanning**\n   - GitHub Actions scan dependencies weekly\n   - Automatic PRs for security updates\n   - Dependabot alerts enabled\n\n## Development\n\n### Setup\n\n```bash\ngit clone https://github.com/crunchtools/mcp-cloudflare.git\ncd mcp-cloudflare\nuv sync\n```\n\n### Run Tests\n\n```bash\nuv run pytest\n```\n\n### Lint and Type Check\n\n```bash\nuv run ruff check src tests\nuv run mypy src\n```\n\n### Build Container\n\n```bash\npodman build -t mcp-cloudflare .\n```\n\n## License\n\nAGPL-3.0-or-later\n\n## Contributing\n\nContributions welcome! Please read SECURITY.md before submitting security-related changes.\n\n## Links\n\n- [Cloudflare API Documentation](https://developers.cloudflare.com/api/)\n- [FastMCP Documentation](https://gofastmcp.com/)\n- [MCP Specification](https://modelcontextprotocol.io/)\n- [crunchtools.com](https://crunchtools.com)\n\n<!-- mcp-name: io.github.crunchtools/cloudflare -->\n",
  "bytes": 7686,
  "sha": "5213c7fec90dfd201bdcac138f9aa95680601c5c30e0bc1986d326e90852b302",
  "repo_slug": "crunchtools/mcp-cloudflare",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_crunchtools_cloudflare_45b56c08/readme"
}