Read-only access to Cloudflare analytics for the configured zone, including traffic aggregation, threats by country, targeted paths, and arbitrary GraphQL queries.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@codecrafting-cloudflare-mcp Show me traffic data for the last 7 days"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Serveur MCP local (stdio, Node ≥ 22) qui expose en lecture seule l'analytics de
trafic Cloudflare de la zone codecrafting.fr. Destiné à tes sessions Claude Code
locales (pas à la routine cloud — celle-ci utilise le serveur MCP officiel Cloudflare).
Outil | Rôle |
| Trafic agrégé par jour (requêtes, pages vues, visiteurs uniques, menaces, cache) sur N jours. |
| Menaces bloquées réparties par pays d'origine. |
| Chemins ciblés par les attaques + statuts. Détecte les fuites (2xx/3xx sur chemin sensible = fichier servi) et les anomalies (5xx). Fenêtre 1 jour max en plan Free ( |
| Requête GraphQL analytics arbitraire (besoins avancés). Lecture seule. |
Related MCP server: Clamp Analytics MCP Server
cd D:/CodeCrafting/Devs/CodeBase/MCP/codecrafting-cloudflare-mcp
npm install
cp .env.example .env # puis renseigner le tokenLe .env (gitignoré) doit contenir le token Cloudflare lecture seule
(Agent-Claude-Security-Review) :
SECURITY_WATCH_CF_API_TOKEN=<token lecture seule>
SECURITY_WATCH_CF_ZONE_ID=<zone ID Cloudflare, depuis le dashboard>Ajouter dans la config MCP (.mcp.json du projet, ou config utilisateur Claude Code) :
{
"mcpServers": {
"codecrafting-cloudflare": {
"command": "node",
"args": ["D:/CodeCrafting/Devs/CodeBase/MCP/codecrafting-cloudflare-mcp/server.mjs"]
}
}
}Le serveur lit son token depuis son propre .env ; rien à passer dans la config.
Au prochain démarrage de Claude Code, les 4 outils cf_* sont disponibles.
Lecture seule : aucun outil ne modifie quoi que ce soit sur Cloudflare (uniquement des requêtes au dataset Analytics).
Le token vit dans le .env local (jamais committé, jamais renvoyé dans une réponse
d'outil). Token scopé Analytics Read / Logs Read — aucun droit DNS/WAF/R2.
npm start # démarre le serveur en stdio (Ctrl+C pour quitter)Le serveur écrit [codecrafting-cloudflare-mcp] prêt (stdio). sur stderr quand il est prêt.
Chemins ciblés par les attaques (statuts 4xx/5xx) avec détection de fuite : 2xx/3xx sur chemin sensible = FUITE (fichier servi), 5xx = anomalie (Worker plante au lieu de 404). Fenêtre limitée à 1 jour côté plan Free : utiliser days=1 pour un résultat exact, days>1 boucle jour par jour.
| Name | Required | Description | Default |
|---|---|---|---|
| zone | No | Zone ID Cloudflare (défaut: codecrafting.fr). | |
| days | No | Nombre de jours à couvrir (défaut 1). | |
| limitPerDay | No | Nb max de chemins remontés par jour (défaut 80). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description bears full weight. It discloses the Free plan limitation (1-day window), how day>1 behaves, and the leak detection logic (2xx/3xx on sensitive path = FUITE, 5xx = anomaly). This fully informs the agent about behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences. First front-loads purpose and detection logic; second adds crucial usage constraint. No wasted words; every piece earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description covers purpose, behavioral nuances, and parameter usage well. It does not describe return format, but the tool's output is likely a list of paths with status info, inferable from context. Considered complete enough for selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. The description adds significant extra meaning for the 'days' parameter by explaining the Free plan constraint and looping behavior, exceeding what the schema provides. No extra info for 'zone' or 'limitPerDay' but schema already describes them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool finds attack-targeted paths with leak detection (FUITE/anomalie). It distinguishes itself from sibling tools like cf_get_traffic or cf_get_threats_by_country by its specific focus on path-level security analysis.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: indicates when to use (detect leaks/anomalies) and gives a specific usage tip for the Free plan (days=1 exact, days>1 loops). Does not explicitly mention alternatives but is sufficient for understanding when to invoke.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Répartition des menaces bloquées par pays d'origine sur N jours. Lecture seule.
| Name | Required | Description | Default |
|---|---|---|---|
| zone | No | Zone ID Cloudflare (défaut: codecrafting.fr). | |
| days | No | Nombre de jours (défaut 7). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It only states 'Lecture seule' (read-only), which is useful but minimal. No disclosure of rate limits, authentication, or other behavioral traits (e.g., pagination, data freshness).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundancy. It is front-loaded with the core purpose and efficiently conveys the read-only nature. Every word serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description should describe the return format (e.g., list of countries with counts). It does not, leaving the agent without crucial information about the tool's output. Sibling context is not leveraged.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds no additional parameter context beyond what the schema already provides (e.g., 'N jours' matches schema's 'Nombre de jours'). No new meaning is added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns the distribution of blocked threats by country over N days and that it is read-only. It uniquely identifies the resource and action, differentiating it from siblings like cf_get_traffic (overall traffic) and cf_get_targeted_paths (specific paths).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. While 'Lecture seule' hints at safety, there is no mention of scenarios or exclusions. The description does not help the agent decide between this and sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Trafic agrégé de la zone Cloudflare (requêtes, pages vues, visiteurs uniques, menaces, cache) par jour sur N jours. Lecture seule.
| Name | Required | Description | Default |
|---|---|---|---|
| zone | No | Zone ID Cloudflare (défaut: codecrafting.fr). | |
| days | No | Nombre de jours (défaut 7, max ~30). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description marks the tool as read-only ('Lecture seule'), which is the key behavioral trait. However, without annotations, it could have disclosed more (e.g., no side effects, rate limits). It is minimally sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (two sentences) and front-loaded with the tool's purpose. It wastes no words, though it could benefit from a bit more structure (e.g., list of metrics).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description does not explain the output format or structure of the returned data. Since there is no output schema, the agent might not know what to expect from the response (e.g., time series, aggregated totals). This is a notable gap for a data retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides descriptions for both parameters (zone, days) with defaults and max values. The description adds no additional semantic meaning beyond what the schema offers, so it does not compensate beyond baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool aggregates Cloudflare zone traffic metrics (requests, page views, unique visitors, threats, cache) per day. It is distinct from sibling tools like cf_get_targeted_paths which focus on specific paths.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for getting aggregated traffic data over N days but does not explicitly state when to prefer this over siblings or any prerequisites. It is adequate but lacks guidance on tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Exécute une requête GraphQL arbitraire contre l'API Analytics Cloudflare (https://api.cloudflare.com/client/v4/graphql). Pour des besoins avancés non couverts par les autres outils. Lecture seule (dataset analytics).
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | La requête GraphQL. | |
| variables | No | Variables de la requête (optionnel). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It indicates read-only behavior and names the specific API URL, but lacks details on authentication, rate limits, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a URL and phrase, concise and front-loaded with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a generic GraphQL executor, the description is adequate but could mention the expected return format or that queries must conform to the Analytics API schema. No output schema exists, so description should cover return values minimally.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with basic descriptions for both parameters. The description does not add additional meaning beyond the schema, so baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it executes arbitrary GraphQL queries against the Cloudflare Analytics API. It also specifies it's for advanced needs not covered by other tools, distinguishing it from the sibling tools which are more specialized.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes it is for advanced needs not covered by other tools, providing clear context for when to use it. However, it does not explicitly state when not to use it or provide exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0cf_get_targeted_pathscf_get_threats_by_countrycf_get_trafficcf_graphql_queryEach tool has a clearly distinct purpose: targeted paths, threats by country, aggregated traffic, and arbitrary GraphQL queries. No overlap.
Three tools follow 'cf_get_*' pattern, but 'cf_graphql_query' uses 'query' instead of 'get', introducing a minor inconsistency.
With 4 tools, the set is well-scoped for Cloudflare analytics, covering key metrics and offering flexibility via GraphQL.
Covers common analytics needs; arbitrary GraphQL fills gaps. Minor missing features like DNS analytics but overall sufficient.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Read-only MCP access to sessions, funnels, campaigns, errors, live visitors, and anomalies.
Read-only website analytics, AI referrals, crawlers, goals, revenue, and funnels.
Read-only access to your Nexly web analytics: traffic, pages, acquisition, events, and reports.
Read-only analytics for Convex apps, queryable via MCP from Claude, Cursor, and other clients.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/CodeCraftingDevelopment/codecrafting-cloudflare-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
