How to integrate Cloudflare MCP with Mastra AI

Connect Mastra AI to Cloudflare MCP. Add new a record for your domain, list all firewall rules for zone, and more using natural language, with authentication handled for you.

Cloudflare logoCloudflare
Api Key

Cloudflare is a global network that secures and accelerates web traffic. It helps protect your sites and APIs from attacks while ensuring reliable performance.

139 Tools

Introduction

This guide walks you through connecting Cloudflare to Mastra AI using the Composio tool router. By the end, you'll have a working Cloudflare agent that can manage DNS records and zones, deploy Workers and Pages, query D1 databases, store KV data, and run analytics queries through natural language commands.

This guide will help you understand how to give your Mastra AI agent real control over a Cloudflare account through Composio's Cloudflare MCP server.

Before we dive in, let's take a quick look at the key ideas and tools involved.

Also integrate Cloudflare with

TL;DR

Here's what you'll learn:
  • Set up your environment so Mastra, OpenAI, and Composio work together
  • Create a Tool Router session in Composio that exposes Cloudflare tools
  • Connect Mastra's MCP client to the Composio generated MCP URL
  • Fetch Cloudflare tool definitions and attach them as a toolset
  • Build a Mastra agent that can reason, call tools, and return structured results
  • Run an interactive CLI where you can chat with your Cloudflare agent

What is Mastra AI?

Mastra AI is a TypeScript framework for building AI agents with tool support. It provides a clean API for creating agents that can use external services through MCP.

Key features include:

  • MCP Client: Built-in support for Model Context Protocol servers
  • Toolsets: Organize tools into logical groups
  • Step Callbacks: Monitor and debug agent execution
  • OpenAI Integration: Works with OpenAI models via @ai-sdk/openai

What is the Cloudflare MCP server, and what's possible with it?

The Cloudflare MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Cloudflare account. It provides structured and secure access to your Cloudflare infrastructure, so your agent can perform actions like managing DNS records, configuring WAF lists, auditing firewall rules, and overseeing zones and account members—all on your behalf.

  • DNS record management: Effortlessly create or delete DNS records within any zone, allowing your agent to automate domain setup and maintenance tasks.
  • WAF list and firewall rule automation: Direct your agent to create, list, or delete Web Application Firewall (WAF) lists and audit firewall rules to enhance your site's security posture.
  • Zone administration: Enable your agent to create new zones when adding domains or delete zones that are no longer needed, streamlining domain onboarding and cleanup.
  • Account and member management: Let your agent list all Cloudflare accounts you have access to and enumerate members within each account for audit or collaboration purposes.
  • Comprehensive infrastructure visibility: Ask your agent to fetch and review your entire Cloudflare account structure, making it simple to monitor resources and configurations at scale.

What is the Composio tool router, and how does it fit here?

What is Composio SDK?

Composio's Composio SDK helps agents find the right tools for a task at runtime. You can plug in multiple toolkits (like Gmail, HubSpot, and GitHub), and the agent will identify the relevant app and action to complete multi-step workflows. This can reduce token usage and improve the reliability of tool calls. Read more here: Getting started with Composio SDK

The tool router generates a secure MCP URL that your agents can access to perform actions.

How the Composio SDK works

The Composio SDK follows a three-phase workflow:

  1. Discovery: Searches for tools matching your task and returns relevant toolkits with their details.
  2. Authentication: Checks for active connections. If missing, creates an auth config and returns a connection URL via Auth Link.
  3. Execution: Executes the action using the authenticated connection.

Step-by-step Guide

Step by step09 STEPS
1

Prerequisites

Before starting, make sure you have:
  • Node.js 18 or higher
  • A Composio account with an active API key
  • An OpenAI API key
  • Basic familiarity with TypeScript
2

Getting API Keys for OpenAI and Composio

OpenAI API Key
  • Go to the OpenAI dashboard and create an API key.
  • You need credits or a connected billing setup to use the models.
  • Store the key somewhere safe.
Composio API Key
  • Log in to the Composio dashboard.
  • Go to Settings and copy your API key.
  • This key lets your Mastra agent talk to Composio and reach Cloudflare through MCP.
3

Install dependencies

bash
npm install @composio/core @mastra/core @mastra/mcp @ai-sdk/openai dotenv

Install the required packages.

What's happening:

  • @composio/core is the Composio SDK for creating MCP sessions
  • @mastra/core provides the Agent class
  • @mastra/mcp is Mastra's MCP client
  • @ai-sdk/openai is the model wrapper for OpenAI
  • dotenv loads environment variables from .env
4

Set up environment variables

bash
COMPOSIO_API_KEY=your_composio_api_key_here
COMPOSIO_USER_ID=your_user_id_here
OPENAI_API_KEY=your_openai_api_key_here

Create a .env file in your project root.

What's happening:

  • COMPOSIO_API_KEY authenticates your requests to Composio
  • COMPOSIO_USER_ID tells Composio which user this session belongs to
  • OPENAI_API_KEY lets the Mastra agent call OpenAI models
5

Import libraries and validate environment

typescript
import "dotenv/config";
import { openai } from "@ai-sdk/openai";
import { Agent } from "@mastra/core/agent";
import { MCPClient } from "@mastra/mcp";
import { Composio } from "@composio/core";
import * as readline from "readline";

import type { AiMessageType } from "@mastra/core/agent";

const openaiAPIKey = process.env.OPENAI_API_KEY;
const composioAPIKey = process.env.COMPOSIO_API_KEY;
const composioUserID = process.env.COMPOSIO_USER_ID;

if (!openaiAPIKey) throw new Error("OPENAI_API_KEY is not set");
if (!composioAPIKey) throw new Error("COMPOSIO_API_KEY is not set");
if (!composioUserID) throw new Error("COMPOSIO_USER_ID is not set");

const composio = new Composio({
  apiKey: composioAPIKey as string,
});
What's happening:
  • dotenv/config auto loads your .env so process.env.* is available
  • openai gives you a Mastra compatible model wrapper
  • Agent is the Mastra agent that will call tools and produce answers
  • MCPClient connects Mastra to your Composio MCP server
  • Composio is used to create a Tool Router session
6

Create a Tool Router session for Cloudflare

typescript
async function main() {
  const session = await composio.create(
    composioUserID as string,
    {
      toolkits: ["cloudflare"],
    },
  );

  const composioMCPUrl = session.mcp.url;
  console.log("Cloudflare MCP URL:", composioMCPUrl);
What's happening:
  • create spins up a short-lived MCP HTTP endpoint for this user
  • The toolkits array contains "cloudflare" for Cloudflare access
  • session.mcp.url is the MCP URL that Mastra's MCPClient will connect to
7

Configure Mastra MCP client and fetch tools

typescript
const mcpClient = new MCPClient({
    id: composioUserID as string,
    servers: {
      nasdaq: {
        url: new URL(composioMCPUrl),
        requestInit: {
          headers: session.mcp.headers,
        },
      },
    },
    timeout: 30_000,
  });

console.log("Fetching MCP tools from Composio...");
const composioTools = await mcpClient.getTools();
console.log("Number of tools:", Object.keys(composioTools).length);
What's happening:
  • MCPClient takes an id for this client and a list of MCP servers
  • The headers property includes the x-api-key for authentication
  • getTools fetches the tool definitions exposed by the Cloudflare toolkit
8

Create the Mastra agent

typescript
const agent = new Agent({
    name: "cloudflare-mastra-agent",
    instructions: "You are an AI agent with Cloudflare tools via Composio.",
    model: "openai/gpt-5",
  });
What's happening:
  • Agent is the core Mastra agent
  • name is just an identifier for logging and debugging
  • instructions guide the agent to use tools instead of only answering in natural language
  • model uses openai("gpt-5") to configure the underlying LLM
9

Set up interactive chat interface

typescript
let messages: AiMessageType[] = [];

console.log("Chat started! Type 'exit' or 'quit' to end.\n");

const rl = readline.createInterface({
  input: process.stdin,
  output: process.stdout,
  prompt: "> ",
});

rl.prompt();

rl.on("line", async (userInput: string) => {
  const trimmedInput = userInput.trim();

  if (["exit", "quit", "bye"].includes(trimmedInput.toLowerCase())) {
    console.log("\nGoodbye!");
    rl.close();
    process.exit(0);
  }

  if (!trimmedInput) {
    rl.prompt();
    return;
  }

  messages.push({
    id: crypto.randomUUID(),
    role: "user",
    content: trimmedInput,
  });

  console.log("\nAgent is thinking...\n");

  try {
    const response = await agent.generate(messages, {
      toolsets: {
        cloudflare: composioTools,
      },
      maxSteps: 8,
    });

    const { text } = response;

    if (text && text.trim().length > 0) {
      console.log(`Agent: ${text}\n`);
        messages.push({
          id: crypto.randomUUID(),
          role: "assistant",
          content: text,
        });
      }
    } catch (error) {
      console.error("\nError:", error);
    }

    rl.prompt();
  });

  rl.on("close", async () => {
    console.log("\nSession ended.");
    await mcpClient.disconnect();
    process.exit(0);
  });
}

main().catch((err) => {
  console.error("Fatal error:", err);
  process.exit(1);
});
What's happening:
  • messages keeps the full conversation history in Mastra's expected format
  • agent.generate runs the agent with conversation history and Cloudflare toolsets
  • maxSteps limits how many tool calls the agent can take in a single run
  • onStepFinish is a hook that prints intermediate steps for debugging

Complete Code

Here's the complete code to get you started with Cloudflare and Mastra AI:

typescript
import "dotenv/config";
import { openai } from "@ai-sdk/openai";
import { Agent } from "@mastra/core/agent";
import { MCPClient } from "@mastra/mcp";
import { Composio } from "@composio/core";
import * as readline from "readline";

import type { AiMessageType } from "@mastra/core/agent";

const openaiAPIKey = process.env.OPENAI_API_KEY;
const composioAPIKey = process.env.COMPOSIO_API_KEY;
const composioUserID = process.env.COMPOSIO_USER_ID;

if (!openaiAPIKey) throw new Error("OPENAI_API_KEY is not set");
if (!composioAPIKey) throw new Error("COMPOSIO_API_KEY is not set");
if (!composioUserID) throw new Error("COMPOSIO_USER_ID is not set");

const composio = new Composio({ apiKey: composioAPIKey as string });

async function main() {
  const session = await composio.create(composioUserID as string, {
    toolkits: ["cloudflare"],
  });

  const composioMCPUrl = session.mcp.url;

  const mcpClient = new MCPClient({
    id: composioUserID as string,
    servers: {
      cloudflare: {
        url: new URL(composioMCPUrl),
        requestInit: {
          headers: session.mcp.headers,
        },
      },
    },
    timeout: 30_000,
  });

  const composioTools = await mcpClient.getTools();

  const agent = new Agent({
    name: "cloudflare-mastra-agent",
    instructions: "You are an AI agent with Cloudflare tools via Composio.",
    model: "openai/gpt-5",
  });

  let messages: AiMessageType[] = [];

  const rl = readline.createInterface({
    input: process.stdin,
    output: process.stdout,
    prompt: "> ",
  });

  rl.prompt();

  rl.on("line", async (input: string) => {
    const trimmed = input.trim();
    if (["exit", "quit"].includes(trimmed.toLowerCase())) {
      rl.close();
      return;
    }

    messages.push({ id: crypto.randomUUID(), role: "user", content: trimmed });

    const { text } = await agent.generate(messages, {
      toolsets: { cloudflare: composioTools },
      maxSteps: 8,
    });

    if (text) {
      console.log(`Agent: ${text}\n`);
      messages.push({ id: crypto.randomUUID(), role: "assistant", content: text });
    }

    rl.prompt();
  });

  rl.on("close", async () => {
    await mcpClient.disconnect();
    process.exit(0);
  });
}

main();

Conclusion

You've built a Mastra AI agent that can interact with Cloudflare through Composio's Tool Router. You can extend this further by:
  • Adding other toolkits like Gmail, Slack, or GitHub
  • Building a web-based chat interface around this agent
  • Using multiple MCP endpoints to enable cross-app workflows
TOOLS

Supported Tools

Every Cloudflare action and event your agent gets out of the box.

Bulk Read KV Values

Read up to 100 text or JSON values from a Workers KV namespace.

Bulk Write Workers KV Entries

Create or overwrite up to 10,000 entries in one Workers KV namespace.

Cancel Worker Build

Cancel a queued or running Cloudflare Workers CI build.

Capture Browser Snapshot

Render a URL or supplied HTML and return selected page representations.

Check Registrar Domains

Check authoritative registration availability and pricing for up to 20 domains.

Create Account API Token

Create an account-owned API token and return its one-time secret value.

Create Alert Policy

Create an account-level Cloudflare notification policy.

Create D1 Database

Create a D1 database with optional placement and replication settings.

Create DNS record

Tool to create a new DNS record within a specific zone.

Create Email Routing Address

Register an Email Routing destination; Cloudflare sends it a verification email.

Create KV Namespace

Create a classic or KV Instant namespace in a Cloudflare account.

Create WAF List

Create a new empty custom list for use in WAF rules and filters.

Create Pages Deployment

Create a Cloudflare Pages deployment from a Git branch or Direct Upload manifest.

Create Pages Project

Create a Cloudflare Pages project for a production branch.

Create Turnstile Widget

Create a Turnstile challenge widget for selected domains.

Create User API Token

Create a user API token carrying supplied grants.

Create Worker

Create a beta Worker resource and configure its observability, previews, subdomain, tags, and tail consumers.

Create Worker Deployment

Deploy existing Worker versions immediately to live traffic by percentage.

Create Worker Version

Upload code, assets, and configuration as a new Worker version without deploying it to production traffic.

Create Zone

Create a Cloudflare DNS zone for a domain, optionally specifying the account and zone setup mode.

Delete Account API Token

Permanently and irreversibly revoke an account-owned Cloudflare API token.

Delete DNS Record

Tool to delete a DNS record within a specific zone.

Delete WAF List

Tool to delete a WAF list.

Delete Pages Deployment

Delete a selected non-production Cloudflare Pages deployment.

Delete User API Token

Permanently revoke one user-owned Cloudflare API token.

Delete Worker

Permanently delete a beta Worker and its versions and deployments.

Delete Worker Script

Delete a classic Worker script.

Delete Zone

Tool to delete a zone.

Deploy Worker Script

Upload or replace a JavaScript module Worker script and create its latest version.

Deploy Worker With Assets

Upload static assets, create a Worker version, and deploy all traffic to it.

Download Worker Script

Download the raw source or multipart module bundle for a Worker script.

Execute D1 Query

Execute SQL against one Cloudflare D1 database.

Get Access Application

Retrieve one Cloudflare Access application by its exact application ID.

Get Account

Retrieve one Cloudflare account by its exact account ID.

Get Account Build Limits

Return whether an account has exhausted its Worker build minutes and when they refresh.

Get Account Member

Retrieve the identity, roles, policies, and status of an account member.

Get Account Token

Retrieve metadata and policies for one account-owned API token.

Get Bot Management Settings

Tool to retrieve a zone's Bot Management configuration (Bot Fight Mode / Super Bot Fight Mode / Enterprise Bot Management).

Get Current User

Retrieve identity and account-membership details for the current user.

Get D1 Database

Get details for one D1 database, optionally selecting response fields.

Get KV Namespace

Retrieve metadata for one Cloudflare Workers KV namespace.

Get KV Value

Retrieve a key's value from a Workers KV namespace.

List WAF Lists

Fetch WAF lists for a Cloudflare account without their items.

Get MCP Server

Retrieve one Access AI Controls MCP server and its synchronization state.

Get Pages Deployment

Retrieve one Cloudflare Pages deployment and its current build status.

Get Pages Deployment Logs

Retrieve build log lines for one Cloudflare Pages deployment.

Get Pages Project

Retrieve one Cloudflare Pages project and its configuration.

Get Pages Upload Token

Request a short-lived JWT for Cloudflare Pages Direct Upload assets.

Get R2 Bucket

Retrieve properties for one named Cloudflare R2 bucket.

Get R2 Object

Download an object's stored content and metadata from an R2 bucket.

Get Tunnel Configuration

Retrieve the current configuration of a remotely managed Cloudflare Tunnel.

Get User API Token

Retrieve metadata and policies for one user-owned API token.

Get Worker

Retrieve one beta Worker resource by its exact ID or name.

Get Worker Build Logs

Retrieve cursor-paginated log output for one Workers CI build.

Get Worker Preview Deployment

Retrieve a specific or latest deployment for a Worker Preview.

Get Workers AI Model Schema

Retrieve the input and output JSON Schemas for a Workers AI model.

Get Worker Script Content

Retrieve the deployed content of one Cloudflare Worker script.

Get Worker Script Settings

Retrieve a Worker script's metadata and runtime configuration.

Get Worker Script Subdomain

Inspect workers.

Get Worker Script Version

Retrieve detailed information for one classic Worker script version.

Get Worker Service Environment Content

Retrieve deployed content for a legacy Worker service environment.

Get Workers Subdomain

Return the workers.

Get Worker Version

Retrieve one beta Worker version; optional code modules may add megabytes.

Get Workflow

Retrieve one Workflow's configuration, metadata, schedules, and counts.

Get Workflow Instance

Retrieve logs, status, and execution details for one Workflow instance.

Get Zero Trust Organization

Retrieve the configuration of a Cloudflare Zero Trust organization.

Get Zone

Retrieve one Cloudflare zone and its configuration, status, and metadata.

Get Zone Ruleset Phase Entrypoint

Retrieve the latest active zone entrypoint ruleset for a Rulesets phase.

Get Zone Setting

Fetch one setting for a Cloudflare zone by setting name.

Inventory Developer Resources

Return one page each of KV namespaces, Workflows, and D1 databases.

List Access Applications

List and filter Cloudflare Access applications in an account.

List Access Reusable Policies

List reusable Cloudflare Access policies for an account.

List Account Members

List a page of Cloudflare account members with their user details, roles, permissions, status, and access policies when available.

List Accounts

List all Cloudflare accounts you have ownership or verified access to.

List Account Subscriptions

List billing subscriptions and plan details for one Cloudflare account.

List Account Tokens

List account-owned API token metadata and policies with pagination.

List D1 Databases

List one page of D1 databases in an account.

List DNS records

List and search one page of DNS records in a Cloudflare zone, including record IDs and properties.

List Email Routing Addresses

List one page of Email Routing destination addresses configured for an account, optionally filtering by verification status.

List Firewall Rules

List one page of firewall rules for a specific DNS zone for auditing.

List KV Keys

List key names and metadata in a Cloudflare Workers KV namespace.

List KV Namespaces

List Workers KV namespaces in a Cloudflare account.

List MCP Portals

List Cloudflare Access AI Controls MCP portals with pagination and search.

List Monitors

Tool to list all load-balancer monitors in a Cloudflare account.

List Pages Deployments

List production or preview deployments for a Cloudflare Pages project.

List Pages Project Domains

List custom domains attached to a Cloudflare Pages project, including their validation and verification state.

List Pages Projects

List Pages projects in a Cloudflare account.

List Pools

Tool to list all load balancer pools in a Cloudflare account.

List Queues

List queues owned by a Cloudflare account.

List R2 Objects

List object metadata in an R2 bucket with cursor pagination.

List Registrar Registrations

List domains registered through Cloudflare Registrar.

List Rule List Entries

List entries in one Cloudflare account rule list.

List Web Analytics Sites

List Cloudflare Web Analytics sites for an account.

List Tunnels

List Cloudflare Tunnel (cloudflared) tunnels in an account to discover tunnel IDs, names, and statuses.

List Turnstile Widgets

List Turnstile widgets configured for a Cloudflare account, returning widget summaries without secret keys.

List User API Tokens

List one page of metadata for API tokens created by the connected Cloudflare user without returning token secrets.

List Worker Builds

List one page of Workers CI builds associated with an immutable Worker tag.

List Worker Build Triggers

List Workers Builds trigger configurations associated with one Worker tag.

List Worker Deployments

List one page of deployment history for a classic Worker script.

List Worker Routes

List Worker route patterns and script assignments for a Cloudflare zone.

List Workers

List account Workers with optional sorting and page-based pagination.

List Workers Build Tokens

List Workers Builds authentication token metadata for an account, with optional pagination.

List Worker Scripts

List uploaded classic Worker scripts, optionally filtering by tag rules.

List Worker Script Versions

List classic Worker script versions, optionally filtering to deployable versions.

List Workers Domains

List custom domains routed to Workers in a Cloudflare account.

List Worker Secrets

List the names and types of secrets bound to one Worker script.

List Worker Telemetry Values

List unique values observed for a Workers telemetry field.

List Worker Versions

List paginated versions of a Cloudflare Worker.

List Workflow Instances

List Workflow executions with state, UTC date, and cursor filters.

List Workflows

List and search account Workflows.

List Zones

List, search, sort, and filter accessible Cloudflare zones.

Manage Worker Schedules

Get a Worker's Cron Triggers, or replace all triggers when schedules is supplied.

Query Analytics SQL

Execute a parameterized Cloudflare Analytics SQL SELECT statement.

Query GraphQL Analytics

Run a read-only query against Cloudflare's GraphQL Analytics API.

Query Worker Telemetry

Run a saved or ad-hoc Workers Observability telemetry query.

Replace Rules List Items

Replace every item in a Rules List and poll for the bulk operation outcome.

Rerun Zone Activation Check

Trigger a fresh activation check for a pending Cloudflare zone.

Roll Account Token

Irreversibly rotate an Account Owned API token secret.

Roll Back Pages Deployment

Promote a previous successful Pages deployment back to production.

Run Workers AI Model

Run a Workers AI model and return non-streaming JSON; streaming is unsupported.

Scrape Page Elements

Render a URL or supplied HTML and return elements matching CSS selectors.

Start Worker Asset Upload Session

Register a Worker static-asset manifest and return a one-hour JWT and hash buckets for later asset-upload calls; this action does not upload asset bytes.

Update Access Application

Replace one account-scoped Cloudflare Access application with a full PUT.

Update DNS record

Tool to update an existing DNS record within a specific zone.

Update WAF List

Tool to update the description of a WAF list (cannot update items).

Update Pages Project

Rename a Pages project or update its production branch, build configuration, deployment environments, or source repository settings.

Update Tunnel Configuration

Tool to update a remotely-managed Cloudflare Tunnel's configuration (ingress rules and routing).

Update Worker Build Trigger

Update commands, caching, and filters for a Workers build trigger.

Update Worker Preview Deployment

Create a new Preview deployment by merge-patching bindings or annotations on an existing Preview deployment.

Update Worker Script Settings

Patch Worker configuration and metadata, creating a new version.

Update Worker Script Subdomain

Enable or disable a Worker script and its previews on workers.

Update Zone

Tool to update properties of an existing zone; changes apply immediately to the live zone.

Update Zone Ruleset Phase Entrypoint

Replace a zone phase entrypoint ruleset.

Upload Pages Assets

Upload static assets and register their hashes for a Pages deployment.

Upload R2 Object

Upload binary content to an R2 key, replacing its content if it exists.

Upload Worker Assets

Upload one bucket of base64-encoded Worker static assets.

Upload Worker Script Version

Upload a module-syntax classic Worker version without deploying it.

Upsert Worker Secret

Add or replace one secret binding, creating a new Worker version.

Write KV Value

Create or replace a UTF-8 value in a Cloudflare Workers KV namespace.

FAQ

Frequently asked questions

With a standalone Cloudflare MCP server, the agents and LLMs can only access a fixed set of Cloudflare tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Cloudflare and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Mastra AI fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Cloudflare tools.

Yes, absolutely. You can configure which Cloudflare scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Cloudflare data and credentials are handled as safely as possible.

Start with Cloudflare.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Cloudflare tool your agent needs.Free to start.

Start building