Cloudflare Security MCP Server

Cloudflare Security

Bot mitigation and firewall rule management for Cloudflare zones. All operations require a zone_id — list zones first to obtain it.

Capability areas

Bot management

• Read bot config — inspect current Bot Fight Mode status and Super Bot Fight Mode thresholds (definitely automated, likely automated, verified bots).
• Toggle Bot Fight Mode — enable or disable automatic JavaScript challenges for traffic from known bot signatures. Safe to toggle; takes effect within seconds.

Firewall rules

• List rules — view all active firewall rules with their expressions, actions, priority, and paused state.
• Create/update rules — author rules using Cloudflare's filter expression syntax (e.g., (ip.src eq 192.0.2.1), (http.request.uri.path contains "/admin")). Actions: simulate (log only), ban (block), challenge (CAPTCHA), js_challenge, managed_challenge.
• Delete rules — permanently remove a firewall rule by ID.

Workflows

• Security audit: list zones → pick zone → review bot management settings → list firewall rules to understand current posture.
• Block an IP: list zones → create a firewall rule with (ip.src eq <IP>) and action ban.
• Bot protection rollout: list zones → enable Bot Fight Mode → create firewall rules for additional URL-path-based protection on sensitive endpoints.
• Rule cleanup: list firewall rules → identify stale or simulate-only rules → delete or update to active actions.

Gotchas

• zone_id required: every security operation is zone-scoped. Always start by listing zones.
• Firewall rule creation does not return a rule_id: after creating a rule, list rules to find the newly created entry.
• Rule evaluation order: firewall rules are evaluated in priority order. Place critical blocks ahead of permissive catch-alls.
• Expression syntax: expressions must be wrapped in parentheses and use Cloudflare's expression language — not regex. Fields: ip.src, http.request.uri.path, http.host, http.request.method, etc.
• Bot Fight Mode scope: only challenges traffic from known bot networks. For custom bot logic, use firewall rules instead.