Cloudflare (API token)
Give the Sazabi agent access to Cloudflare Workers, DNS, zones, and more through the hosted Cloudflare API MCP server, authenticated with an API token you mint yourself.
About
This is an MCP connector that gives the Sazabi agent tools from Cloudflare's hosted unified API MCP server (mcp.cloudflare.com), authenticated with a Cloudflare API token instead of OAuth. You create the token in the Cloudflare dashboard scoped to exactly the permissions you want the agent to have, then provide it to Sazabi. Sazabi sends it as an Authorization: Bearer <token> header and validates it against Cloudflare's verify endpoint before completing the connection.
If you prefer OAuth instead of an API token, see Cloudflare OAuth connector.
What the agent can do:
- Query Workers observability logs and analytics
- Inspect Workers bindings (D1, R2, KV) and account resources
- Review Workers Builds history and status
- Browse Cloudflare Radar internet traffic insights
Prerequisites
- An active Cloudflare account
- A Cloudflare API token scoped to the products you want the agent to access (tokens with Client IP Address Filtering enabled are not supported)
Set up in the dashboard
Configure connectors in the dashboard under Settings > MCP connectors.
Open the connector
Find Cloudflare (API token) in Settings > MCP connectors.
Add your key
In the Cloudflare dashboard, go to My Profile > API Tokens > Create Token, then Create Custom Token. Under Permissions, add read access for the products you want the agent to use — for example Account > Workers Observability > Read, Zone > DNS > Read, and Account > Account Settings > Read — then copy the generated cfut_... token.
Paste the token into Sazabi. Sazabi stores it securely and sends it as the Authorization header (Authorization: Bearer <token>) to Cloudflare's hosted MCP endpoint at https://mcp.cloudflare.com/mcp.
Set up with the CLI
Cloudflare authenticates with a Cloudflare API token, and sazabi mcp-connectors connect only supports OAuth providers — so set up this connector in the dashboard first (above). Once it's connected, the Sazabi CLI can inspect and manage it (installed and authenticated — see sazabi mcp-connectors reference):
sazabi mcp-connectors list
sazabi mcp-connectors details <connection-id>Find the connection ID with sazabi mcp-connectors list. To rotate the stored credentials later, use sazabi mcp-connectors update-credentials <connection-id>.
Verify
Open the connector's connection page under Settings > MCP connectors and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to use one of those tools and confirm it runs. If no tools appear, confirm the token is correct and has the expected permissions.
Troubleshooting
No tools discovered — Check that the API token is valid and scoped to the products you want. Tokens with Client IP Address Filtering enabled are not supported by the hosted MCP server.
Connection shows needs attention — The token may have been revoked or expired; create a new token and reconnect from Settings > MCP connectors.