---
title: "Cloudflare MCP in Slack: ask an AI teammate to check DNS and cache | Chickpea"
description: "Use Cloudflare's API MCP server from Slack. Give a channel an AI teammate connected to Cloudflare, then ask about DNS, Workers, and cache. Open source."
canonical: https://chickpea.co/connectors/cloudflare-api
keyword: "Cloudflare MCP in Slack"
verified: 2026-09-17
---

# A Cloudflare teammate in Slack, on Cloudflare's own API MCP server.

> Chickpea gives a channel a named AI teammate that holds its own Cloudflare connection. It signs in with OAuth and calls Cloudflare's API MCP server, which reaches the whole Cloudflare API through three tools: `docs`, `search`, and `execute`. Ask it in Slack what a DNS record points at, or to purge one cached URL, and it answers in the thread.

Facts checked against the sources on September 17, 2026. The HTML page is at https://chickpea.co/connectors/cloudflare-api; every connector is listed at https://chickpea.co/connectors; the site index for agents is at https://chickpea.co/llms.txt.

**Cloudflare** (Cloudflare, Inc., https://www.cloudflare.com): Search Cloudflare docs and execute approved operations across your account. Category: Engineering. Lane: Vendor MCP server. Sign in: OAuth.

**Chickpea**: an open source Slack app that gives a workspace named AI teammates, each with its own handle, instructions, memory, connected accounts, schedules, and model, deployed to your own Cloudflare account or a Node host.

## What people ask it
The teammate in these examples is @oncall, published to #eng.

### Look up a record or a setting
- @oncall what do the api records on northwind.dev point at, and are they proxied
- @oncall which zones still have development mode on

A read comes straight back, and a long answer arrives as a table in the thread. Cloudflare says the server covers the entire Cloudflare API, over 2,500 endpoints across DNS, Workers, R2, Zero Trust, and every other product. What the teammate can see is what the permissions you ticked on Cloudflare allow, and nothing wider.

### Read what a Worker is doing
- @oncall which version of the checkout worker is live, and when did it deploy
- @oncall how many requests did northwind.dev serve yesterday, and how many came from cache

Another read. Cloudflare says its server handles the GraphQL Analytics API through the same `execute` tool, so a traffic question and a deployment question use one connection. The teammate quotes the numbers Cloudflare returned rather than estimating, and says so when a question is outside what came back.

### Purge one path from the cache
- @oncall purge the cache for northwind.dev/pricing, the new copy is stuck
- @oncall purge everything tagged pricing on northwind.dev

A purge by URL, prefix, or tag is narrow and the cache fills again from your origin, so it applies at once. The reply repeats what Cloudflare says about the result: a successful request means Cloudflare received it, not that any content was evicted yet. Purging a whole zone is in the group below.

### Change a record, a rule, or a whole zone
- @oncall point api.northwind.dev at 198.51.100.77 and turn the proxy on
- @oncall block the ASN hammering /checkout with a WAF rule

A change to where a hostname resolves, an edit to a firewall rule, or a purge of a whole zone comes back as the exact edit and waits for a yes. Cloudflare warns that purging everything sends every later request to your origin until the cache refills, and that this can overload it. A write also needs the message you sent to name it, because thread history, retrieved content, and memory cannot authorize one.

### On a schedule
- @oncall every weekday at 9am Eastern, post yesterday's requests, cache hit ratio, and 5xx count for northwind.dev
- @oncall every Monday at 8am Pacific, list the DNS records changed in the last seven days

A schedule saves on the spot. It needs an explicit time zone, runs under the Cloudflare connection of the person who asked, and fails with a named reason rather than running if that connection is disconnected.

### Example conversations

**Check a DNS record**
> **Sofia:** @oncall what do the api records on northwind.dev point at, and are they proxied?
> **@oncall:** Four records match api on northwind.dev. Three are proxied and one is not, which is the staging one.
>
> | Name | Type | Value | Proxied |
> |---|---|---|---|
> | api | A | 198.51.100.24 | Yes |
> | api-eu | CNAME | eu.northwind.dev | Yes |
> | api-edge | CNAME | checkout.workers.dev | Yes |
> | api-staging | A | 203.0.113.9 | No |

**How is the Worker doing**
> **Marco:** @oncall which version of the checkout worker is live, and how did northwind.dev do yesterday?
> **@oncall:** The live deployment is v47, put out yesterday at 16:02 UTC, 100% of traffic. Yesterday northwind.dev served 4.21M requests, 88.6% of them from cache, and 1,904 responses were 5xx. The 5xx count is 0.05%, about the same as the day before.

**Purge a cached path**
> **Dana:** @oncall purge the cache for northwind.dev/pricing, the new copy is stuck.
> **@oncall:** Purged https://northwind.dev/pricing. Cloudflare accepted the request, which means it got it, not that the old copy is already gone everywhere. Nothing else in the zone was touched. Give it a few seconds and reload.

**Change a DNS record**
> **Marco:** @oncall point api.northwind.dev at 198.51.100.77 and turn the proxy on.
> **@oncall:** The api A record is on 198.51.100.24, proxied already, TTL auto. Changing where a live hostname resolves is not something I will do on my own, so here is the exact edit. Go ahead?
> Buttons: Yes, change the record · Show me what depends on it

**Every morning**
> **Priya:** @oncall every weekday at 9am Eastern, post yesterday’s requests, cache hit ratio, and 5xx count for northwind.dev.
> **@oncall:** Saved. Every weekday at 9:00 AM Eastern I’ll post yesterday’s request count, cache hit ratio, and 5xx count for northwind.dev in #eng. First run is Fri Sep 18. It runs on your Cloudflare connection, so say "pause the morning digest" if you want it to stop.

## Connect Cloudflare
1. In Chickpea Admin, open the teammate, then **Connections**, find **Cloudflare**, and choose **Connect**. Or ask in Slack, `@oncall connect Cloudflare`, and follow the link it posts.
2. Choose who uses it. **Team** is one shared Cloudflare account that everyone who can use the teammate acts through. **Personal** means each member signs in as themselves, and Cloudflare records their actions as them.
3. Choose **Continue to sign in**. Cloudflare asks you to authorize, and its own screen is where you select the permissions to grant. There is no token to paste and no config file to edit.
4. Chickpea connects to [mcp.cloudflare.com/mcp](https://developers.cloudflare.com/agents/model-context-protocol/mcp-servers-for-cloudflare/) and records the tools the server answered with. Cloudflare exposes three: `docs`, `search`, and `execute`. The teammate is handed that list, and it can later be narrowed but never widened.
5. Ask something. `@oncall what do the api records on northwind.dev point at` is a good first question, because it reads and cannot change anything.

A connection belongs to one teammate. Giving a second teammate Cloudflare means a second sign-in with its own consent, so the support teammate never inherits what the on-call teammate can reach.

## What the teammate is handed with Cloudflare
There is no built-in Chickpea skill for Cloudflare, and none is needed. The tools arrive from Cloudflare's server. Chickpea connects before it saves anything, records what the server answered with, and exposes only those tools. Cloudflare describes the three as `docs`, which searches its developer documentation, `search`, which writes JavaScript to find endpoints in the API spec, and `execute`, which writes JavaScript that calls the Cloudflare API.

Cloudflare runs the server and publishes its source: https://github.com/cloudflare/mcp

## Beside Cloudflare
- **Sentry:** The error in Sentry, beside the deployment on Cloudflare that introduced it
- **Neon:** The Postgres branch behind the Worker, in the same question
- **Supabase:** The other half of the stack when the database is not on Cloudflare
- **incident.io:** When an edge problem turns into an incident, the same teammate can say who is on call
- All 37 connectors: https://chickpea.co/connectors

## Questions people ask

### What is Cloudflare MCP?
A hosted MCP server Cloudflare runs at mcp.cloudflare.com/mcp. Cloudflare says it reaches the entire Cloudflare API, over 2,500 endpoints, through three tools: docs, search, and execute. That covers DNS, Workers, R2, Zero Trust, and every other product. Cloudflare runs a catalog of narrower servers beside it, for documentation, observability, Radar, and audit logs. Chickpea's preset points at the API one, so a teammate in Slack uses it with no editor and no config file anywhere.

### What is Cloudflare Code Mode, and how does it work?
Code Mode is Cloudflare's name for the search-and-execute pattern this server uses. Rather than register a tool for each of about 2,500 endpoints, the model writes JavaScript against a typed version of the OpenAPI spec and the Cloudflare API client. The generated code then runs inside an isolated Dynamic Worker sandbox. Cloudflare puts the cost at roughly 1,000 tokens whatever the API contains, against more than a million for a server that exposed every endpoint as its own tool. That is why one connection can cover the whole API without filling a teammate's context.

### Which Cloudflare MCP server should I use?
For a channel, the API server, which is the one this preset connects to. Cloudflare's product-specific servers are narrower by design: docs.mcp.cloudflare.com for reference material, an observability server for logs and analytics, Radar for internet traffic, audit logs, Workers Builds, and others. One connection to the API server answers the questions that actually come up in a thread. If a team wants one of the narrow servers as well, Chickpea takes a custom MCP server URL on the same page.

### How do I get a Cloudflare API token for this?
You do not need one. This preset signs in with OAuth, and Cloudflare redirects you to authorize and pick the permissions to grant. Cloudflare documents API tokens as the other path, for CI/CD and automation: you create one in the dashboard under API Tokens with the permissions you need, and both user tokens and account tokens work. Cloudflare adds that an account token needs Account Resources Read, so the server can detect the account. Tokens with Client IP Address Filtering are not supported. None of that applies here, because this connector has no token field.

### Does it use Cloudflare's MCP server or the API?
The MCP server. Cloudflare is a vendor MCP lane: the deployment connects to mcp.cloudflare.com/mcp over streamable HTTP and signs in with OAuth. The preset sends no scope string, so the connection gets whatever you approve on Cloudflare's consent screen and nothing else. There is no API key anywhere in this connector, and the connection cannot reach any other address.

### Can it delete a DNS record or a Worker?
Cloudflare's server reaches whatever the permissions you approved cover, and delete endpoints are part of the API, so this page will not claim deletion is impossible. Two things bound it. The first is Cloudflare's own consent screen: approve read permissions and every write fails there, not here. The second is Chickpea's gate. Of the three tools, only execute reaches your account, and execute is not a read verb, so the gate refuses it unless the message you just sent names the action and its target. A question names its own read. A deletion has to be asked for in that message, and a thread, a document, or a memory cannot ask on your behalf.

### Can I use this from Claude Code or Cursor instead?
Yes. Cloudflare publishes a Skills plugin that bundles its MCP servers with skills and slash commands, and documents installing it for Claude Code, Cursor, OpenCode, OpenAI Codex, and Pi. Those put the server in one person's editor. A teammate puts it in a channel, with a stored connection, saved instructions, schedules, and every action visible in the thread where it was asked for. Teams often run both.

### Is this Agent Lee?
No. Agent Lee is Cloudflare's own AI co-pilot, built into the Cloudflare dashboard. Cloudflare documents it as answering questions about your account from your real data, and as changing DNS records, zone settings, and security rules. It also runs diagnostics such as DNS lookups and certificate checks, and draws charts from your analytics. Cloudflare says it cannot write Workers scripts, reach billing data, remember previous conversations, work across several accounts, or make a change without your approval. It lives in the dashboard. A Chickpea teammate lives in a Slack channel and holds Cloudflare beside your other connected accounts.

### Do I still need Cloudflare's Slack notifications?
Yes, for anything that starts on Cloudflare's side. Cloudflare publishes no Slack app. What it publishes is notification destinations, and a Slack incoming webhook is one of the services it documents, beside Google Chat, DataDog, Discord, OpsGenie, Splunk, Feishu, Teams, and ServiceNow. Cloudflare says free accounts get email. Professional and above add webhooks, and Business and above add PagerDuty. Webhook destinations need at least one zone on Pro or above. A Chickpea teammate hears nothing from Cloudflare and posts nothing unprompted. Keep the webhook for alerts, and ask the teammate when you want to know why one fired.

### Does Chickpea itself run on Cloudflare?
Yes. A Chickpea deployment is one Worker in your own Cloudflare account, which is also where its data and its stored credentials sit. That is worth naming, and it is not a requirement of this connector. The connection here is an ordinary OAuth sign-in to whichever Cloudflare account you choose, and it does not have to be the account the deployment runs in.

## Sources
- [Chickpea docs: connector catalog, the Cloudflare API preset, its lane and its three tools](https://docs.chickpea.co/reference/connector-catalog/)
- [Chickpea docs: connections, team and personal accounts, the binding as a ceiling](https://docs.chickpea.co/agents/connections/)
- [Chickpea docs: authority and confirmation, including the read-verb gate](https://docs.chickpea.co/security/authority-and-confirmation/)
- [Chickpea docs: connect a service, OAuth presets and the Slack link](https://docs.chickpea.co/agents/connect-a-service/)
- [Chickpea docs: schedules, time zones and what each run rechecks](https://docs.chickpea.co/agents/schedules/)
- [Chickpea source: the Cloudflare API preset (server URL, transport, OAuth, no scope)](https://github.com/pejmanjohn/chickpea/blob/main/src/config/presets.ts)
- [Chickpea source: an MCP connection exposes approved tools that are still discovered](https://github.com/pejmanjohn/chickpea/blob/main/src/config/types.ts)
- [Cloudflare docs: Cloudflare's own MCP servers, the API server and the product ones](https://developers.cloudflare.com/agents/model-context-protocol/mcp-servers-for-cloudflare/)
- [Cloudflare source: cloudflare/mcp, the three tools, OAuth, and the API token path](https://github.com/cloudflare/mcp)
- [Cloudflare docs: Agent Lee, what it does in the dashboard and what it will not do](https://developers.cloudflare.com/agent-lee/)
- [Cloudflare docs: notifications, the delivery methods and the plans each needs](https://developers.cloudflare.com/notifications/)
- [Cloudflare docs: configuring webhooks, including the Slack destination](https://developers.cloudflare.com/notifications/get-started/configure-webhooks/)
- [Cloudflare docs: purging cache, the purge options and what a success response means](https://developers.cloudflare.com/cache/how-to/purge-cache/)
- [Cloudflare docs: purge everything, and the origin load it causes](https://developers.cloudflare.com/cache/how-to/purge-cache/purge-everything/)
- [Chickpea source on GitHub](https://github.com/pejmanjohn/chickpea)

## More
- [Ahrefs MCP in Slack](https://chickpea.co/connectors/ahrefs.md)
- [Airtable MCP in Slack](https://chickpea.co/connectors/airtable.md)
- [Asana AI agent in Slack](https://chickpea.co/connectors/asana.md)
- [Jira and Confluence MCP in Slack](https://chickpea.co/connectors/atlassian.md)
- [BugSnag MCP in Slack](https://chickpea.co/connectors/bugsnag.md)
- [Exa MCP in Slack](https://chickpea.co/connectors/exa.md)
- [Firecrawl MCP in Slack](https://chickpea.co/connectors/firecrawl.md)
- [Fireflies MCP in Slack](https://chickpea.co/connectors/fireflies.md)
- [Gamma MCP in Slack](https://chickpea.co/connectors/gamma.md)
- [Gmail AI agent in Slack](https://chickpea.co/connectors/gmail.md)
- [Gong AI agent in Slack](https://chickpea.co/connectors/gong-managed.md)
- [Google Ads AI agent in Slack](https://chickpea.co/connectors/google-ads.md)
- [Google Analytics AI agent in Slack](https://chickpea.co/connectors/google-analytics.md)
- [Google Calendar AI agent in Slack](https://chickpea.co/connectors/google-calendar.md)
- [Google Docs AI agent in Slack](https://chickpea.co/connectors/google-docs.md)
- [Google Drive AI agent in Slack](https://chickpea.co/connectors/google-drive.md)
- [Google Search Console AI agent in Slack](https://chickpea.co/connectors/google-search-console.md)
- [Google Sheets AI agent in Slack](https://chickpea.co/connectors/google-sheets.md)
- [Google Slides AI agent in Slack](https://chickpea.co/connectors/google-slides.md)
- [Granola MCP in Slack](https://chickpea.co/connectors/granola.md)
- [HubSpot AI agent in Slack](https://chickpea.co/connectors/hubspot-managed.md)
- [Hugging Face MCP in Slack](https://chickpea.co/connectors/huggingface.md)
- [incident.io MCP in Slack](https://chickpea.co/connectors/incident-io.md)
- [Intercom MCP in Slack](https://chickpea.co/connectors/intercom.md)
- [Linear MCP in Slack](https://chickpea.co/connectors/linear.md)
- [LunarCrush MCP in Slack](https://chickpea.co/connectors/lunarcrush.md)
- [Meta Ads MCP in Slack](https://chickpea.co/connectors/meta-ads.md)
- [Monday.com MCP in Slack](https://chickpea.co/connectors/monday.md)
- [Neon MCP in Slack](https://chickpea.co/connectors/neon.md)
- [Notion Slack integration with an AI agent](https://chickpea.co/connectors/notion-managed.md)
- [PostHog MCP in Slack](https://chickpea.co/connectors/posthog.md)
- [Sentry MCP in Slack](https://chickpea.co/connectors/sentry.md)
- [Stripe MCP in Slack](https://chickpea.co/connectors/stripe.md)
- [Supabase MCP in Slack](https://chickpea.co/connectors/supabase.md)
- [YouTube AI agent in Slack](https://chickpea.co/connectors/youtube-managed.md)
- [Zendesk AI agent in Slack](https://chickpea.co/connectors/zendesk.md)
- [All connectors](https://chickpea.co/connectors.md)

## Try Chickpea
- Site: https://chickpea.co/
- Deploy to Cloudflare: https://deploy.workers.cloudflare.com/?url=https://github.com/pejmanjohn/chickpea
- Source, Apache 2.0: https://github.com/pejmanjohn/chickpea
- Docs: https://docs.chickpea.co