Remote MCP server

Controlflare for AI agents.

Connect your agent over the Model Context Protocol and it can read your estimated Cloudflare spend, set or clear a hard budget cap, and pause or resume Workers - the same actions you have in the dashboard, in the same activity log.

Connect your agent See the 12 tools

No API keys and no tokens to paste - the client signs you in with Cloudflare the first time it connects. Four of the twelve tools stop production traffic; read that part first.

MCP endpoint

https://app.controlflare.com/mcp

Transport: Streamable HTTP
Auth: OAuth 2.1 · Cloudflare
Tools: 12 · 4 destructive

Connect your agent

One URL, three clients.

Controlflare speaks Streamable HTTP on the same origin as the dashboard. Point a client at the endpoint and it works out the rest.

Claude Code

Adds the server to the local scope. Run it once in any project.

claude mcp add --transport http controlflare https://app.controlflare.com/mcp

Claude Desktop, or any client with a JSON config

Add one entry to the mcpServers object in the client's config file.

{
  "mcpServers": {
    "controlflare": {
      "type": "http",
      "url": "https://app.controlflare.com/mcp"
    }
  }
}

MCP Inspector

To look at the tools before you wire an agent to them. Start the Inspector and connect it to the endpoint over Streamable HTTP.

npx @modelcontextprotocol/inspector

Clients discover the sign-in for themselves. A first call to /mcp comes back 401 with a WWW-Authenticate header naming the protected-resource metadata; the client reads that, registers itself, and opens the consent page in your browser. There is nothing to copy into a config file and no secret to keep.

Signing in

The first connection walks through a browser once. After that the client holds a token and reconnects on its own.

The client asks for access

It registers itself with Controlflare and sends you to a consent page that names the client and lists exactly what it will be able to do - including that it can pause Workers.
You approve

A page you have to read and act on, not a silent redirect. Declining sends the client away with access_denied and nothing changes.
You sign in with Cloudflare

The same "Sign in with Cloudflare" the dashboard uses, asking for one scope: User Details: Read. Controlflare reads your Cloudflare user id and email address, to know which Controlflare account you are - and nothing else. It is not how Controlflare reaches your Workers: pausing and resuming runs through the cost agent you installed in your own Cloudflare account, on the API token you set on it yourself, and this sign-in is never given access to either.
The client gets a token

Scoped to your account and to what you approved. Remove the connection in your client to revoke it; the next call gets a 401 and the flow starts over.

If you have no Controlflare account yet, the first connection creates one. If a Controlflare account already uses your Cloudflare email address, the connection is refused rather than joined to it - Cloudflare does not publish whether an address has been confirmed, so treating it as proof would be a way into an account that is not yours. You will see a page saying so; carry on signing in to the dashboard the way you already do. An agent never sees more than the account you signed in as: an account id belonging to somebody else returns the same "no such account" error as an id that does not exist.

What your agent can do

Twelve tools, three kinds.

Five read. Three change a setting. Four stop production traffic - those carry destructiveHint, and they mean it.

Controlflare MCP tools, grouped by what they do: read-only, settings changes, and destructive tools that stop production traffic.
Tool	Parameters	What it does
Reads only `readOnlyHint`
`list_cloudflare_accounts`	-	Connected accounts with cap, enforcement state, latest estimated spend and workload counts
`get_account`	`accountId`	One account in detail, plus its workloads
`get_estimated_spend`	`accountId`	Current-period estimated USD with its per-product split (Workers, D1, R2, KV and Durable Object requests), the raw units behind it, and which products could not be measured - with an explicit note that this is an estimate, not an invoice
`list_workloads`	`accountId`	Scripts with `status`, `pausedBy`, `pausedAt` and a restore summary
`list_events`	`accountId`, `limit?` (1–500, default 50)	Recent activity, newest first
Changes a setting
`set_billing_cap`	`accountId`, `capUsd: number \| null`	Sets the hard monthly cap; `null` clears it. A cap at or below current spend pauses everything within about five minutes
`set_enforcement`	`accountId`, `enabled: boolean`	Turns automatic pausing on or off
`sync_account`	`accountId`	Refreshes workloads and takes a usage snapshot now
Stops production traffic `destructiveHint`
`pause_workload`	`accountId`, `workloadId`	Pauses one Worker - stops its production traffic
`resume_workload`	`accountId`, `workloadId`	Restores one Worker's routes, domains and schedules
`pause_all_workloads`	`accountId`	Pauses every running Worker on the account
`resume_all_workloads`	`accountId`	Resumes every paused Worker on the account

The table scrolls sideways - the third column says what each tool does.

accountId is the Controlflare account UUID returned by list_cloudflare_accounts - not the 32-hex Cloudflare account id. Start there and pass the id it gives you.

Before you let an agent do this

Four of these stop your site.

An agent with these tools can take production down as surely as you can. That is the whole point of the tools - it is also the reason to read this before you connect one.

Pausing is a real change

Pausing a Worker removes its routes, detaches its custom domains, disables its workers.dev URL and clears its cron triggers. Each of those is stored first, so a resume puts back exactly what was there - but until someone resumes it, that Worker answers nothing.

A cap can pause everything

set_billing_cap is not a read. Set at or below the current estimated spend, it pauses every running Worker on the account within about five minutes. An agent tidying up your caps can do that without ever calling a destructive tool.

The spend figure is an estimate

It is built from Cloudflare usage analytics and published list prices - not an invoice, and not your whole Cloudflare bill. It covers Workers, D1, R2, KV and Durable Object requests; Durable Object duration, Queues, Workers AI and others are still outside it, and a product Controlflare could not read comes back as unavailable rather than as zero. Treat what an agent reports as an approximation, and check the invoice for the authoritative number.

Everything an agent does is logged

Tools reuse the same services as the dashboard and the cron enforcer, so a cap change or a pause made by an agent produces the same cap_updated and workload_paused events as one made by hand. Read them back with list_events, or in the dashboard.

Self-hosting

Your instance, your endpoint.

Deploy Controlflare into your own Cloudflare account and the MCP server comes with it at https://<your-host>/mcp, pointed at your data and nobody else's. It needs a Cloudflare OAuth client for sign-in - the same one the dashboard uses, with /mcp/auth/callback added as a redirect URL - and a KV namespace for the OAuth state. Without both, every MCP path answers 404 and the dashboard carries on unaffected. MCP is Workers-only - the Docker and Kubernetes build answers the same way.

Self-hosting guide