How to integrate Cloudflare MCP with Hermes

Read up to 100 text or JSON values from a Workers KV namespace.

Create or overwrite up to 10,000 entries in one Workers KV namespace.

Render a URL or supplied HTML and return selected page representations.

Check authoritative registration availability and pricing for up to 20 domains.

Create an account-owned API token and return its one-time secret value.

Create an account-level Cloudflare notification policy.

Create a D1 database with optional placement and replication settings.

Tool to create a new DNS record within a specific zone.

Register an Email Routing destination; Cloudflare sends it a verification email.

Create a classic or KV Instant namespace in a Cloudflare account.

Create a new empty custom list for use in WAF rules and filters.

Create a Cloudflare Pages deployment from a Git branch or Direct Upload manifest.

Create a Cloudflare Pages project for a production branch.

Create a Turnstile challenge widget for selected domains.

Create a user API token carrying supplied grants.

Create a beta Worker resource and configure its observability, previews, subdomain, tags, and tail consumers.

Deploy existing Worker versions immediately to live traffic by percentage.

Upload code, assets, and configuration as a new Worker version without deploying it to production traffic.

Creates a new DNS zone (domain) in Cloudflare.

Permanently and irreversibly revoke an account-owned Cloudflare API token.

Tool to delete a DNS record within a specific zone.

Tool to delete a WAF list.

Delete a selected non-production Cloudflare Pages deployment.

Permanently revoke one user-owned Cloudflare API token.

Permanently delete a beta Worker and its versions and deployments.

Delete a classic Worker script.

Tool to delete a zone.

Upload or replace a JavaScript module Worker script and create its latest version.

Upload static assets, create a Worker version, and deploy all traffic to it.

Download the raw source or multipart module bundle for a Worker script.

Execute SQL against one Cloudflare D1 database.

Retrieve one Cloudflare account by its exact account ID.

Return whether an account has exhausted its Worker build minutes and when they refresh.

Retrieve the identity, roles, policies, and status of an account member.

Retrieve metadata and policies for one account-owned API token.

Tool to retrieve a zone's Bot Management configuration (Bot Fight Mode / Super Bot Fight Mode / Enterprise Bot Management).

Retrieve identity and account-membership details for the current user.

Get details for one D1 database, optionally selecting response fields.

Retrieve metadata for one Cloudflare Workers KV namespace.

Retrieve the stored bytes for a key in a Workers KV namespace.

Tool to fetch all WAF lists (no items) for an account.

Retrieve one Access AI Controls MCP server and its synchronization state.

Retrieve one Cloudflare Pages deployment and its current build status.

Retrieve build log lines for one Cloudflare Pages deployment.

Retrieve one Cloudflare Pages project and its configuration.

Request a short-lived JWT for Cloudflare Pages Direct Upload assets.

Retrieve the current configuration of a remotely managed Cloudflare Tunnel.

Retrieve metadata and policies for one user-owned API token.

Retrieve one beta Worker resource by its exact ID or name.

Retrieve a specific or latest deployment for a Worker Preview.

Retrieve the input and output JSON Schemas for a Workers AI model.

Retrieve the deployed content of one Cloudflare Worker script.

Retrieve a Worker script's metadata and runtime configuration.

Inspect workers.

Retrieve detailed information for one classic Worker script version.

Retrieve deployed content for a legacy Worker service environment.

Return the workers.

Retrieve one beta Worker version; optional code modules may add megabytes.

Retrieve one Workflow's configuration, metadata, schedules, and counts.

Retrieve logs, status, and execution details for one Workflow instance.

Retrieve one Cloudflare zone and its configuration, status, and metadata.

Retrieve the latest active zone entrypoint ruleset for a Rulesets phase.

Fetch one setting for a Cloudflare zone by setting name.

Return one page each of KV namespaces, Workflows, and D1 databases.

Lists all members of a Cloudflare account with their roles, permissions, and status.

List all Cloudflare accounts you have ownership or verified access to.

List billing subscriptions and plan details for one Cloudflare account.

List account-owned API token metadata and policies with pagination.

List one page of D1 databases in an account.

Tool to list and search DNS records in a Cloudflare zone.

List Email Routing destination addresses configured for an account.

Tool to list firewall rules for a specific DNS zone.

List key names and metadata in a Cloudflare Workers KV namespace.

List Workers KV namespaces in a Cloudflare account.

List Cloudflare Access AI Controls MCP portals with pagination and search.

Tool to list all load-balancer monitors in a Cloudflare account.

List production or preview deployments for a Cloudflare Pages project.

List custom domains attached to a Cloudflare Pages project, including their validation and verification state.

List Pages projects in a Cloudflare account.

Tool to list all load balancer pools in a Cloudflare account.

List queues owned by a Cloudflare account.

List domains registered through Cloudflare Registrar.

List entries in one Cloudflare account rule list.

List Cloudflare Web Analytics sites for an account.

List Cloudflare Tunnel (cloudflared) tunnels in an account to discover tunnel IDs, names, and statuses.

List Turnstile widgets configured for a Cloudflare account.

List metadata for API tokens created by the connected Cloudflare user without returning token secrets.

List one page of Workers CI builds associated with an immutable Worker tag.

List Workers Builds trigger configurations associated with one Worker tag.

List deployment history for a classic Worker script.

List Worker route patterns and script assignments for a Cloudflare zone.

List account Workers with optional sorting and page-based pagination.

List Workers Builds authentication token metadata without returning token secrets.

List uploaded classic Worker scripts, optionally filtering by tag rules.

List classic Worker script versions, optionally filtering to deployable versions.

List custom domains routed to Workers in a Cloudflare account.

List the names and types of secrets bound to one Worker script.

List unique values observed for a Workers telemetry field.

List paginated versions of a Cloudflare Worker.

List Workflow executions with state, UTC date, and cursor filters.

List and search account Workflows.

Lists, searches, sorts, and filters zones in the authenticated account.

Get a Worker's Cron Triggers, or replace all triggers when schedules is supplied.

Execute a parameterized Cloudflare Analytics SQL SELECT statement.

Run a read-only query against Cloudflare's GraphQL Analytics API.

Run a saved or ad-hoc Workers Observability telemetry query.

Replace every item in a Rules List and wait for the bulk operation outcome.

Trigger a fresh activation check for a pending Cloudflare zone.

Irreversibly rotate an Account Owned API token secret.

Promote a previous successful Pages deployment back to production.

Run a Workers AI model and return non-streaming JSON; streaming is unsupported.

Render a URL or supplied HTML and return elements matching CSS selectors.

Register a Worker static-asset manifest and return a one-hour JWT and hash buckets for later asset-upload calls; this action does not upload asset bytes.

Tool to update an existing DNS record within a specific zone.

Tool to update the description of a WAF list (cannot update items).

Rename a Pages project or update its production branch, build configuration, deployment environments, or source repository settings.

Tool to update a remotely-managed Cloudflare Tunnel's configuration (ingress rules and routing).

Create a new Preview deployment by merge-patching bindings or annotations on an existing Preview deployment.

Patch Worker configuration and metadata, creating a new version.

Enable or disable a Worker script and its previews on workers.

Tool to update properties of an existing zone; changes apply immediately to the live zone.

Replace a zone phase entrypoint ruleset.

Upload static assets and register their hashes for a Pages deployment.

Upload one bucket of base64-encoded Worker static assets.

Upload a module-syntax classic Worker version without deploying it.

Add or replace one secret binding, creating a new Worker version.

Create or replace a UTF-8 value in a Cloudflare Workers KV namespace.