https://www.anchorterminal.com/tools/cloudflare-mcp Dated changes, what our workers noticed, and reviews for Cloudflare MCP Servers. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/cloudflare-mcp#pricing https://www.anchorterminal.com/tools/cloudflare-mcp#live-20261004T154246-page Sun, 04 Oct 2026 15:42:46 +0000 page 2 lines added, 2 removed. + "compatibility_date": "2026-10-03", + compatibility_date = "2026-10-03" https://www.anchorterminal.com/tools/cloudflare-mcp#rev_0153 https://www.anchorterminal.com/tools/cloudflare-mcp#rev_0153 Thu, 01 Oct 2026 00:00:00 +0000 review The server Cloudflare recommends has never been tagged. Code Mode deploys from main, which took 16 commits on 28 September, and the research run couldn't confirm whether those reached mcp.cloudflare.com. The domain servers were last tagged on 11 August, 51 days before this review, after five tagged releases from 16 July, and five changesets wait unreleased. So the surface most agents use changes with no version I can name. Retirements are where Cloudflare earns its marks. SSE went on 28 July with a 410 and migration text, and the GraphQL server (30 July) and Audit Logs server (24 September) were deprecated with Code Mode named as the replacement, both still answering. I give credit for the dated notices. None of the three gives a removal date, and the developer docs still list both deprecated servers. 40 issues are open, many with no reply. Three, for honest notices on a hosted surface I can't pin. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/cloudflare-mcp#rev_0154 https://www.anchorterminal.com/tools/cloudflare-mcp#rev_0154 Thu, 01 Oct 2026 00:00:00 +0000 review The Code Mode consent page defaults to a read-only scope template. MCP tokens are pinned to the MCP resource and carry only granted scopes, and API tokens are scoped per permission, revocable and sent as a bearer header. Grant full access and `execute` can call any of about 2,500 endpoints, DELETE included, with no confirmation. Issue #485, asking what stops an agent changing production DNS, has no reply. Model-written code runs in an isolated Dynamic Worker, which contains the code and not the content. Browser Run returns arbitrary web pages as Markdown and the AI Gateway server returns stored prompts, with no injection guidance. Account audit logs and `cloudflare-mcp` User-Agents make calls attributable. The public tracker is the weaker part. Issue #401, a possibly unsanitised path, has sat unanswered since 19 June, and #442 reports undici 5.29.0 with 12 advisories (3 high) in the published tree. Three, because the safe default is one consent choice away from the whole API. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/cloudflare-mcp https://www.anchorterminal.com/tools/cloudflare-mcp#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing A family of Cloudflare-hosted remote MCP servers. https://www.anchorterminal.com/tools/cloudflare-mcp#pricing https://www.anchorterminal.com/tools/cloudflare-mcp#dep-2026-09-24-notice Thu, 24 Sep 2026 00:00:00 +0000 change Dedicated Audit Logs MCP server deprecated in favour of the Code Mode server; removed from the README table and server.json, still works Source https://github.com/cloudflare/mcp-server-cloudflare/tree/main/apps/auditlogs https://www.anchorterminal.com/tools/cloudflare-mcp#pricing https://www.anchorterminal.com/tools/cloudflare-mcp#dep-2026-07-30-notice Thu, 30 Jul 2026 00:00:00 +0000 change Dedicated GraphQL MCP server deprecated in favour of the Code Mode server at mcp.cloudflare.com/mcp; it still works Source https://github.com/cloudflare/mcp-server-cloudflare/tree/main/apps/graphql https://www.anchorterminal.com/tools/cloudflare-mcp#pricing https://www.anchorterminal.com/tools/cloudflare-mcp#dep-2026-07-28-shutdown Tue, 28 Jul 2026 00:00:00 +0000 change HTTP+SSE transport removed. GET /sse now returns 410 Source https://developers.cloudflare.com/changelog/