Sixteen hosted servers trade API breadth for typed tools
The README lists 16 domain-specific endpoints maintained in this repository. They cover Cloudflare documentation, Workers bindings and builds, observability, containers, browser rendering, Logpush, AI Gateway, AutoRAG, audit logs, DNS analytics, digital experience monitoring, CASB, Radar, the Cloudflare blog, and a demo server. Each endpoint exposes a curated tool set for one area, which makes its permissions and prompts easier to reason about than a single server spanning the whole Cloudflare API.
Every endpoint now uses a stateless Streamable HTTP handler at /mcp, with /sse retained as a URL alias. A legacy HTTP+SSE GET /sse receives 410 Gone instead of opening an event stream. Release containers-mcp@0.2.19, published August 11, 2026, added that migration response and points clients toward /mcp. This is useful behavior, but it means an old MCP configuration can keep the right-looking URL while speaking the wrong transport.
One remote URL is easy; account authority is the setup
A hosted connection does not require the 870 packages in our local install. You give a remote-capable MCP client the product endpoint, complete OAuth, and select an account where needed. The README also documents bearer API tokens for the OpenAI Responses API. Open issue 466 asks Cloudflare to document that token path for other MCP clients and to publish the scopes required by each server. Until that happens, operators should derive the smallest token from the actual tools they intend to expose.
Permission choice is the deployment. The README says a client can read configurations, process information, suggest changes, and make those changes through Cloudflare services. A tool call can therefore reach DNS, Workers, account security, or stored prompts depending on the chosen server. Put read-only investigation on separate credentials from mutation. For write-capable tools, require the user to inspect the target account, zone, resource, and proposed diff before the call runs. Natural-language confirmation alone is too easy to misunderstand.
What happened when we ran it
We cloned commit db90847 into an unprivileged Debian container with 3 CPUs and 8 GB of RAM. Pnpm installed 870 packages in 16 seconds and occupied 836 MB. The root package had no build script or target, so our harness skipped the build step. That is a neutral repository fact, not a failed build. The code is organized as workspaces whose checks are driven through shared TurboRepo and package scripts.
Vitest completed in 129 seconds with 320 passed and 0 failed out of 320. That is the strongest test count in this batch. The checkout contained 469 files, roughly 300,081 source lines, 4 CI workflow files, and no Dockerfile. Tests live inside apps and packages rather than one top-level test directory. Our run checked repository behavior with mocks and local tooling. It did not authorize a Cloudflare account or exercise production zones.
The broad Code Mode server lives in another repository
Cloudflare now recommends cloudflare/mcp when an agent needs broad API coverage through code execution. This repository remains the home for narrower servers with guided schemas. The distinction is practical. A DNS or observability server advertises a bounded vocabulary, while Code Mode can discover and call a wider set of APIs. Pick the smallest surface that completes the job. Adding 16 product servers to one client recreates broad authority with more consent screens and more tools to choose incorrectly.
Terraform is the better fit when changes should pass through a plan and code review. The official TypeScript client is better when application code should choose every endpoint and argument explicitly. MCP earns its place for interactive investigation and guided operations where a person benefits from asking a question in plain language. It should not replace an existing deployment pipeline merely because the same operation can be expressed as a tool call. The 320 passing tests support the implementation, not the wisdom of each requested change.
Cron events can disappear at the schema boundary
Open issue 440 reports that the Workers Observability server rejects cron-triggered events because their valid API shape omits the outcome field required by the MCP schema. The REST API returns the events, but the MCP layer fails while parsing them. Issue 418 describes the same field requirement discarding an entire response when any row lacks it. A proposed fix is open. Until merged and deployed, scheduled-job investigations need the documented calculations-view workaround or the REST endpoint.
Other open reports are narrower but decision-relevant. Issue 456 says dns_report requests a dimension unavailable below the Business plan and that a parameter named zone actually expects a zone ID. Issue 470 reports that the local stdio package cannot start headlessly from an API token because it expects Wrangler's OAuth file. These failures affect particular products and transports, not all 16 hosted servers. Test the exact endpoint, plan, credential style, and client you intend to use.
September reports follow an August package release
GitHub showed 4,255 stars and 77 combined open issues and pull requests. The default branch was last pushed on September 1, 2026, while new issue activity continued through September 20. The latest GitHub release was containers-mcp@0.2.19 on August 11, a package-specific tag rather than one version for all workspaces. The queue mixes real compatibility reports with unrelated submissions, so the combined count is not a bug count.
Cloudflare's domain servers are the sensible first MCP choice when one Cloudflare product is the task. Our 320 passing tests provide a solid reason to trial them, and the hosted endpoints remove most installation work. The remaining decision is authority: give each server the smallest credential it can use, keep writes visible, and retain REST or Terraform fallbacks for incident response and production changes. A green MCP response should never be the only record of what changed.