Deploy to Cloudflare With an AI Agent
To deploy to Cloudflare with an AI agent, connect the official Cloudflare MCP over OAuth or with a scoped API token, then ask the agent to publish a Worker or Pages project. The hosted server reaches the whole Cloudflare API through three tools — search, execute and docs — so the agent can upload a Worker, set KV/R2/D1 bindings and env vars, and roll back to a previous version. Because the same server also reaches DNS and WAF, the agent can attach a domain and set an edge rule in the same conversation — one connection that covers deploy, DNS, and edge security.
Before you start
You need a Cloudflare account, a Worker or Pages project, and an MCP-compatible client. The setup decision that matters is the token: scope it to exactly the permissions the agent needs, and never hand an agent the global API key.
Step by step
Choose OAuth or a scoped API token
The hosted server authorizes over OAuth — you pick the permissions on the consent screen — or with an API token passed as a bearer. Either way grant only what the agent needs: Workers Scripts:Edit to deploy Workers, Zone:Read and DNS:Edit for DNS, Account Analytics:Read for metrics. Avoid the global API key, and note that tokens with client IP filtering are not accepted.
Connect the hosted Cloudflare MCP
Add https://mcp.cloudflare.com/mcp to your client (Claude Code: claude mcp add --transport http cloudflare https://mcp.cloudflare.com/mcp). It exposes three tools — search, execute and docs — over the whole Cloudflare API. The npm package @cloudflare/mcp-server-cloudflare is an older local server limited to Workers, KV, R2, D1 and Queues: it can deploy a Worker, but the DNS step below does not work through it.
Deploy a Worker or Pages project
Ask the agent to find the Workers upload endpoints with search and publish the script with execute, set its env vars and bindings (KV, R2, D1), and report the deployed URL.
Attach a domain and edge rules
Because the same MCP controls DNS and WAF, the agent can point a domain at the deployment and add an edge rule in the same conversation — no second tool.
Roll back if a deploy regresses
Ask the agent to publish a previous Worker version. Pair this with Cloudflare Change History so every agent-initiated change stays auditable.
Token permissions by task
| If the agent should… | Grant |
|---|---|
| Read analytics and zone config only | Account Analytics:Read, Zone:Read |
| Deploy Workers | + Workers Scripts:Edit |
| Edit DNS records | + DNS:Edit on the zone |
| Manage R2 / KV storage | + Workers KV / R2 permissions |
No confirmation layer on destructive ops
Frequently asked questions
How do I deploy to Cloudflare with an AI agent?
Connect the hosted Cloudflare MCP (mcp.cloudflare.com/mcp) to your agent client over OAuth or with a scoped API token, then ask the agent to publish a Worker or Pages project. Through its search and execute tools the agent reaches the Workers API to upload a script, set KV/R2/D1 bindings and env vars, and roll back to a previous version — and because the same server reaches DNS and WAF, it can attach a domain and set an edge rule in the same conversation.
What API token permissions does the Cloudflare MCP need?
Only what the task requires. For read-only use: Account Analytics:Read and Zone:Read. To deploy Workers add Workers Scripts:Edit. For DNS changes add the DNS edit permission on the zone. Create a scoped token per use case rather than using the global API key, which grants every permission on the account.
Can the Cloudflare MCP roll back a deploy?
Yes. It can publish a previous Worker version, which is the rollback path for Workers. It can also set env vars and bindings and roll back if a deploy fails. Pair it with Cloudflare Change History so every agent-initiated change is auditable after the fact.
Is it safe to run the Cloudflare MCP against production DNS?
Only with a scoped token and approval enabled. DNS mistakes propagate quickly and can black-hole traffic, and the Cloudflare MCP runs destructive operations — delete Worker, purge zone — immediately, with no built-in confirmation layer. Scope the token, keep production changes behind a human approval step, and use Change History for audit.
Does the Cloudflare MCP also handle DNS and domains?
Yes, on the hosted server. DNS record CRUD, WAF rules, R2 and KV storage, zone analytics and — since the Registrar API beta of April 2026 — domain search and registration are all reachable through search and execute, alongside Worker deploys. For an agent-driven deploy that needs a custom domain it removes the need for a separate domains MCP. The legacy npm package does not do DNS at all.
Continue reading
Compare Cloudflare against the other hosting MCPs, or pair it with a domains MCP.
Related guides
Tutorial
How to Buy a Domain From Claude (Cloudflare MCP, Step by Step)
6 min read
Tutorial
How to Connect a Custom Domain to Your Site With an AI Agent (MCP Workflow)
7 min read
Ranked Guide
Best MCPs for DNS Management in 2026 (Records, Propagation, DNSSEC)
9 min read
Comparison
Vercel vs Netlify vs Cloudflare MCP: Which to Use (2026)
9 min read
Ranked Guide
Best MCP Servers for Deploying Websites in 2026 (Ranked)
13 min read
Strategy
Can an AI Agent Deploy to Production? (Safely, in 2026)
8 min read