Skip to main content
Connect Cloudflare so CloudThinker can list your accounts and zones, summarize HTTP traffic and cache behavior, review firewall events, and look up Cloudflare documentation. CloudThinker uses Cloudflare’s hosted MCP server and authenticates with one API token, whose permissions decide what CloudThinker can reach.

​
Prerequisites

  • A Cloudflare account with at least one zone.
  • Permission to create API tokens in the Cloudflare dashboard.

​
Setup

1

Create a custom API token

In the Cloudflare dashboard, go to My Profile → API Tokens → Create Token. Under Create Custom Token, click Get started. Add each permission from the Required permissions table. Each row in the Cloudflare form has three dropdowns, so Zone → Analytics → Read means group Zone, permission Analytics, access Read.
2

Limit the token to the account and zones you need

Under Account Resources, choose Include → your account. Under Zone Resources, choose Include → Specific zone for each zone CloudThinker should see. Use All zones only if you want CloudThinker to cover every zone.
3

Set an expiry, then create and copy the token

Under TTL, set an end date, for example 90 days from today. Leave Client IP Address Filtering empty: API calls reach Cloudflare through its hosted MCP server, not from an address you control. Click Continue to summary → Create Token. Copy the token now. Cloudflare shows it only once.
Need tokens restricted to known IP addresses? IP whitelist support is available for Enterprise. Contact support@cloudthinker.io.
To check the token before you paste it:
Success state: the response includes "status": "active".
4

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections, select Cloudflare, and click Connect. Fill in Alias (for example main-account) and Description (for example Main Cloudflare account, production zones). Agents read the description to pick the right connection when you have several. Paste the token into Cloudflare API token, and click Connect.Success state: the connection shows Connecting and Verifying, then a Connected status. Discovery now runs once in the background and spends credits. See What happens after you connect.
5

Set the environment

Open Cloudflare in More → Workspace settings → Connections, click the pencil icon on the connection’s row, and set Environment in Edit Instance. It labels the connection for people and agents.

​
Connection details

The data path is CloudThinker Cloud → Cloudflare’s hosted MCP server → the Cloudflare API, so the token and API responses pass through Cloudflare’s own service. You don’t enter an account ID. CloudThinker finds the accounts and zones the token can see. If a token covers several zones and your request matches more than one, CloudThinker asks which zone you mean. You can add more than one Cloudflare connection, for example one token per account.

​
Required permissions

Each permission is written as it appears in the Cloudflare form: group → permission → access. CloudThinker can only reach what the token allows.
Keep the token read-only and scoped to specific zones. There’s no fixed list of write actions: execute can call any Cloudflare API endpoint, so any edit permission you add to the token, such as Zone → DNS → Edit, becomes a change agents can propose. Each call still goes through your approvals.

​
Agent capabilities

The connection has three tools. Two run freely. The third calls the Cloudflare API and always goes through Approvals, even for a read, because the same tool can also make changes. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself. Discovery never waits for a person, so it skips any execute call that would ask and finds little on Cloudflare. An automation that calls execute uses its own Approval mode, Refuse by default, so a call that would ask is refused instead. Built-in query limits keep results small: traffic summaries cover up to 7 days of hourly data for one zone, and firewall reviews cover up to 24 hours and 50 sample events. Firewall output doesn’t include client IP addresses.

​
Verify the connection

The answer comes from the execute tool, so it goes through your approvals first. If CloudThinker posts an approval request in the chat, approve it. The answer lists your real account name and zone names.

​
Example prompts

​
Troubleshooting

CloudThinker reports CLOUDFLARE_PERMISSION_DENIED. The token is missing the read permission for what you asked about. Edit the token in My Profile → API Tokens, add the permission, and ask again.
CLOUDFLARE_NO_ZONES means the token lists no zones. CLOUDFLARE_ZONE_NOT_FOUND means the zone you named isn’t visible to it. Check Zone Resources on the token and use the exact zone name.
Every Cloudflare API call goes through your approvals, and some wait for a person. Check the chat for a pending approval request, or review your Approval mode. If you reject a request, CloudThinker won’t retry it.
A new zone or a zone with little traffic may have no analytics yet. Confirm the zone receives traffic through Cloudflare and that the token has Zone → Analytics → Read.
New connections never hit this. A connection created before the move to Cloudflare’s hosted MCP server shows Error with this message, and CloudThinker reconnects it on its own. If the status doesn’t change, open the connection and click Retry. The old Account ID and Enabled Services values are no longer used.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Restrict zones: limit the token to specific zones rather than all zones to reduce blast radius.
  • Rotate before the TTL ends: rotate the token before the TTL end date you set when you created it.

Approvals

Decide how Cloudflare API calls get approved.

Connections overview

How connections, testing, and discovery work.