Public assessment

helbertparanhos/cloudflare-mcp-pro (cloudflare-mcp-pro)

cloudflare-mcp-pro · v1.1.0 · scanned Aug 2, 2026

What changed in the harness

Selection accuracy 100→100, token cost up 6%, unconfirmed writes 0%→0%.

Category breakdown

Where the score comes from.

Earned points across the four signals Gradable measures. Safety and Legibility are scored out of 30; Economics and Discoverability are scored out of 20.

01Safety

0.0 / 30

0.0 out of 30

02Legibility

20.1 / 30

20.1 out of 30

03Economics

11.0 / 20

11.0 out of 20

04Discoverability

8.8 / 20

8.8 out of 20

Highest-impact fix

Estimated gain +30 points

Add explicit identity and permission preflight tools

Expose machine-readable principal/tenant confirmation and a non-mutating permission check so agents can verify both before destructive actions.

Description evidence

Defects and rewrites.

35 defects found across the exposed tool descriptions. Suggested rewrites make purpose, inputs, boundaries, and returns easier for an agent to understand.

Tool	Defect types	Suggested rewrite
`verify_token`	no_return_description	Validate the configured Cloudflare API token against the token verification endpoint. Returns the token's status (active/invalid) along with its ID and granted permission scopes.
`list_accounts`	name_restates_behavior no_return_description	Retrieve Cloudflare accounts accessible by the configured token, useful for finding an account_id to pass to other tools. Supports page/per_page pagination, or fetch_all to combine every page. Returns an array of account objects with id, name, and settings.
`list_zones`	name_restates_behavior params_unexplained no_return_description	Retrieve zones (domains) in the account, optionally filtered by name or status, to find a zone_id for use in other tools. page selects which results page to return and per_page sets its size; fetch_all instead follows pagination and combines every page. Returns an array of zone objects including id, name, status, and name servers.
`get_zone`	name_restates_behavior no_return_description	Fetch full configuration for a single zone identified by zone_id. Returns the zone object including name, status, plan, name servers, and account association.
`get_zone_analytics`	name_restates_behavior no_return_description	Query hourly-aggregated HTTP request analytics for a zone over the given since/until window via Cloudflare's GraphQL Analytics API. Returns request counts, bandwidth, cache status breakdown, and threat data grouped by hour.
`get_zone_setting`	name_restates_behavior no_return_description	Fetch the current value and editability of one named zone setting (e.g. ssl, always_use_https, min_tls_version). Returns the setting's id, current value, and whether it can be edited on the account's plan.
`list_dns_records`	name_restates_behavior params_unexplained no_return_description	Retrieve DNS records for a zone, optionally filtered by record type or name, to find record IDs for other tools. page selects which results page to return and per_page sets its size; fetch_all instead follows pagination and combines every page. Returns an array of DNS record objects with id, type, name, content, ttl, and proxied status.
`update_dns_record`	params_unexplained	Update one or more fields of an existing DNS record identified by zone_id and record_id; only the fields you provide are changed. name sets the record hostname, content sets its value (IP/target/text), ttl sets time-to-live in seconds, proxied toggles Cloudflare proxying (A/AAAA/CNAME only), priority sets MX/SRV priority, and comment sets a free-text note. Requires confirm:true (human-approval gate); without it returns a preview only.
`get_dnssec`	name_restates_behavior no_return_description	Fetch a zone's DNSSEC configuration, including whether it is enabled and the DS record needed to complete signing at the registrar. Returns status, algorithm, digest, and DS record fields.
`export_dns_records`	name_restates_behavior no_return_description	Generate a backup of a zone's DNS records formatted as a standard BIND zone file. Returns the zone file contents as plain text.
`list_workers`	name_restates_behavior no_return_description	Retrieve Worker scripts deployed to an account, to find script names for other Worker tools. Returns an array of script metadata including name, modified date, and usage model.
`get_worker`	name_restates_behavior no_return_description	Fetch configuration and metadata for a single Worker script by name. Returns details such as bindings, compatibility date, routes, and last-modified timestamp.
`list_worker_routes`	name_restates_behavior no_return_description	Retrieve the URL-pattern-to-Worker mappings configured on a zone. Returns an array of route objects with id, pattern, and the script assigned to each.
`list_kv_namespaces`	name_restates_behavior params_unexplained no_return_description	Retrieve Workers KV namespaces in an account, to find namespace IDs for KV read/write tools. page selects which results page to return and per_page sets its size; fetch_all instead follows pagination and combines every page. Returns an array of namespace objects with id and title.
`kv_list_keys`	name_restates_behavior no_return_description	Enumerate key names stored in a KV namespace, optionally filtered by prefix and capped by limit. Returns an array of key names with metadata and expiration, plus a cursor if more results remain.
`kv_get`	no_return_description	Read the value of a key in a KV namespace. Returns the raw stored value as a string, or an indication that the key was not found.
`list_r2_buckets`	name_restates_behavior no_return_description	Retrieve R2 storage buckets in an account, optionally filtered by name substring. Returns an array of bucket objects with name and creation date.
`list_d1_databases`	name_restates_behavior params_unexplained no_return_description	Retrieve D1 databases in an account, optionally filtered by name, to find database IDs for query_d1. page selects which results page to return and per_page sets its size; fetch_all instead follows pagination and combines every page. Returns an array of database objects with id, name, and size.
`list_pages_projects`	name_restates_behavior no_return_description	Retrieve Cloudflare Pages projects in an account. Returns an array of project objects including name, production branch, and latest deployment info.
`get_pages_project`	name_restates_behavior no_return_description	Fetch configuration and deployment details for a single Cloudflare Pages project by name. Returns build settings, domains, and latest deployment status.
`list_firewall_rulesets`	no_return_description	List WAF rulesets configured on a zone, for use with get_ruleset to inspect individual rules. Returns an array of ruleset objects with id, name, phase, and kind.
`get_ruleset`	name_restates_behavior no_return_description	Fetch a single WAF ruleset by ID, including every rule it contains. Returns the ruleset's metadata plus an array of rule objects with expressions and actions.
`list_access_rules`	name_restates_behavior params_unexplained no_return_description	Retrieve IP/ASN/country access rules configured on a zone, optionally filtered by mode (block/challenge/allow). page selects which results page to return and per_page sets its size; fetch_all instead follows pagination and combines every page. Returns an array of rule objects with id, mode, target, value, and notes.
`list_page_rules`	name_restates_behavior no_return_description	Retrieve page rules configured on a zone, optionally filtered by status. Returns an array of rule objects with id, URL pattern, actions, priority, and status.
`list_certificate_packs`	name_restates_behavior no_return_description	Retrieve SSL/TLS certificate packs on a zone, optionally filtered by status. Returns an array of certificate pack objects with id, type, hosts covered, and validation status.
`get_ssl_verification`	name_restates_behavior no_return_description	Check the current SSL/TLS certificate validation status for a zone. Returns per-certificate verification status and any pending validation records.
`list_custom_hostnames`	name_restates_behavior params_unexplained no_return_description	Retrieve custom hostnames (SSL for SaaS) configured on a zone, optionally filtered by hostname. page selects which results page to return and per_page sets its size; fetch_all instead follows pagination and combines every page. Returns an array of custom hostname objects with id, hostname, SSL status, and ownership verification details.
`list_email_rules`	name_restates_behavior no_return_description	Retrieve Email Routing rules configured on a zone. Returns an array of rule objects with id, matcher, forwarding action, and enabled status.
`list_email_destinations`	name_restates_behavior no_return_description	Retrieve verified Email Routing destination addresses in an account. Returns an array of destination objects with email address and verification status.
`list_queues`	name_restates_behavior no_return_description	Retrieve Cloudflare Queues configured in an account. Returns an array of queue objects with id, name, and creation date.
`list_tunnels`	name_restates_behavior no_return_description	Retrieve Cloudflare Tunnels (cloudflared) configured in an account, optionally including deleted ones. Returns an array of tunnel objects with id, name, status, and connection details.
`get_tunnel`	name_restates_behavior no_return_description	Fetch details of a single Cloudflare Tunnel by ID. Returns the tunnel's name, status, connections, and configuration.
`list_turnstile_widgets`	name_restates_behavior no_return_description	Retrieve Turnstile widgets configured in an account. Returns an array of widget objects with sitekey, name, allowed domains, and mode.
`list_ai_models`	no_return_description	Search the catalog of Workers AI models available to the account, optionally filtered by name/task substring or task type. Returns an array of model objects with id, name, task, and description.
`list_logpush_jobs`	name_restates_behavior no_return_description	Retrieve Logpush jobs scoped to a zone or account. Returns an array of job objects with id, dataset, destination, and enabled status.

Selection evidence

Confusable tool pairs.

16 pairs where similar names or overlapping descriptions may send an agent toward the wrong tool.

Tool A	Tool B	Confidence	Why they collide
`delete_worker`	`delete_worker_route`	medium	A task like 'remove the worker for example.com/api/*' could target either deleting the script itself or just the route mapping; agent may pick the wrong deletion granularity.
`delete_worker`	`delete_worker_secret`	low	Both operate on a worker script by name, but 'delete the worker secret' vs 'delete the worker' differ enough in phrasing that confusion is unlikely except for careless partial reads of the task.
`get_zone`	`get_zone_analytics`	low	A vague 'get info about this zone' could momentarily point to either, but analytics requires time range params which clearly signals distinct intent.
`get_zone`	`get_zone_setting`	medium	'Get the SSL setting for this zone' vs 'get zone details' could be conflated if the agent doesn't parse that a specific setting name was requested.
`list_workers`	`list_worker_routes`	medium	'List the workers on this zone' is ambiguous between listing worker scripts (account-level) and listing worker routes (zone-level URL mappings), especially since routes reference worker scripts.
`list_custom_hostnames`	`create_custom_hostname`	low	List vs create are clearly different verbs; unlikely to be confused despite shared domain vocabulary.
`delete_access_rule`	`delete_page_rule`	medium	Both are 'delete rule by ID' on a zone; a generic instruction like 'delete rule X' without specifying access vs page rule could lead the agent to pick the wrong tool.
`get_zone_setting`	`update_zone_setting`	low	Get vs update are distinct verbs typically unambiguous, though a task phrased as 'set/check the ssl setting' could blur slightly.
`list_access_rules`	`create_access_rule`	low	List vs create are clearly distinguished by verb; low chance of confusion.
`put_worker_secret`	`delete_worker_secret`	low	Create/update vs delete secret are opposite operations with clear verbs, unlikely to be confused.
`create_access_rule`	`create_email_rule`	low	Both create 'rules' but for very different domains (IP access vs email routing); minimal real confusion given distinct required params.
`create_access_rule`	`create_page_rule`	low	Both create 'rules' on a zone but for unrelated purposes (IP blocking vs URL caching/forwarding); distinct enough params to avoid confusion.
`create_page_rule`	`create_email_rule`	low	Different domains (page caching/forwarding vs email routing) despite shared 'create rule' phrasing; unlikely to be confused.
`list_page_rules`	`list_email_rules`	low	Both list 'rules' on a zone but for clearly distinct features (page rules vs email routing); low ambiguity.
`list_access_rules`	`list_email_rules`	low	Different rule domains (access/firewall vs email); unlikely real confusion.
`list_access_rules`	`list_page_rules`	low	Different rule domains (IP access vs page caching); unlikely real confusion despite shared 'list rules' phrasing.

Compare the field

One score is useful.
The evidence makes it actionable.

Back to the leaderboard