# Cloudflare Tunnel MCP for AI Agents AI Agent Connect > Cloudflare Tunnel MCP lets you manage your Zero Trust connections and private network routing directly through your AI agent. You can create tunnels, update ingress rules, and monitor connector health without switching tabs or running manual CLI commands. It's built for teams who need to handle infrastructure securely and quickly. ## Overview - **Category:** industry-titans - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_hT7kuznY9UnZpXYZT9IsTzVtPYMm0Ja2T7OuWTJd/ai-agent-connect - **Tags:** cloudflare-tunnel, zero-trust, cloudflared, network-security, remote-access ## Description Managing secure connections to private infrastructure usually involves a lot of context switching. You have to open the Cloudflare dashboard, navigate to the tunnels section, find the right ID, copy a management token, and then jump back to your terminal to update your local config. It's a lot of manual steps where it's easy to make a typo or miss a setting. This MCP changes the flow. You just tell your AI client to create a new tunnel or update an ingress rule, and it happens in one step. You get your work done in the same window where you're already coding or planning your network architecture. It handles the heavy lifting of fetching management tokens and updating secrets so you can focus on the actual network architecture. If you're tired of the manual overhead of Zero Trust configuration, this is the way to do it. You can find this and thousands of other integrations in the Vinkius catalog to keep your stack connected. ## Tools ### cleanup_connections Removes Cloudflare Tunnel connectors from your account. Use this to clear out old sessions or reset your connection list. ### create_route Creates a new tunnel route for your private network. This helps you map specific internal resources to your tunnel. ### create_tunnel Generates a new Cloudflare Tunnel. Use this to set up new entry points for your private infrastructure. ### delete_route Removes a specific tunnel route. This is useful for decommissioning old network paths. ### delete_tunnel Deletes a Cloudflare Tunnel from your account. Use this when you no longer need a specific connection. ### get_configuration Fetches the configuration for a remotely-managed tunnel. It lets you see exactly how a tunnel is currently set up. ### get_connector Retrieves detailed information about a specific Cloudflare Tunnel connector. Use this to troubleshoot connection issues. ### get_management_token Gets a Cloudflare Tunnel management token. You'll need this token to run and manage your connectors. ### get_route_by_ip Finds a specific tunnel route based on an IP address. This helps identify which tunnel is handling specific traffic. ### get_tunnel_token Retrieves the token needed to run a Cloudflare Tunnel connector. This is a key step in deploying your tunnel infrastructure. ### get_tunnel Fetches all the details for a single Cloudflare Tunnel. Use this to check the status and metadata of a specific connection. ### list_connections Shows all active Cloudflare Tunnel connections. It's the fastest way to see what's currently connected to your network. ### list_routes Lists all current tunnel routes. Use this to get a bird's eye view of your private network routing. ### list_tunnels Lists and filters all tunnels in your account. You can quickly find specific tunnels by their status or name. ### put_configuration Adds or updates the configuration for a remotely-managed tunnel. Use this to change ingress rules or other settings on the fly. ### update_route Modifies an existing tunnel route. This is how you change where traffic is being routed without creating a new path. ### update_tunnel Updates the settings for an existing Cloudflare Tunnel. Use this to change names, secrets, or other metadata. ## Prompt Examples **Prompt:** ``` List all my active tunnels and tell me which ones are healthy. ``` **Response:** ``` I've checked your Cloudflare account. Here are your active tunnels: | Tunnel Name | Status | | :--- | :--- | | **prod-web-gateway** | ✅ Healthy | **db-sync-bridge** | ✅ Healthy | **dev-test-lab** | ⚠️ Degraded Your `dev-test-lab` tunnel is showing a degraded status. Would you like me to fetch the configuration for that one to see what's wrong? ``` **Prompt:** ``` Create a new tunnel called 'internal-api' and give me the token. ``` **Response:** ``` I've created the new tunnel for you. * **Name:** internal-api * **ID:** `cf-tunnel-88291` I've also retrieved the connection token you'll need for your connector: `eyJhcm91bmRfYXNpZCI6Im...` Let me know if you need help setting up the ingress rules for this new path. ``` **Prompt:** ``` Show me the ingress rules for the web-server tunnel. ``` **Response:** ``` Fetching the configuration for your `web-server` tunnel... Here are the current ingress rules: * `app.yourdomain.com` $ ightarrow$ `http://localhost:8080` * `api.yourdomain.com` $ ightarrow$ `http://localhost:3000` * `admin.yourdomain.com` $ ightarrow$ `https://internal.dashboard.local` Everything looks correctly mapped to your local ports. ``` ## Capabilities ### Create new tunnels Generate new Cloudflare Tunnels with specific configurations in seconds. ### Update ingress rules Modify where your traffic goes without touching the dashboard. ### Manage network routes Add or delete CIDR blocks for private network access. ### Monitor connector health Check if your remote connectors are active and healthy. ### Fetch management tokens Retrieve the necessary tokens for running connectors instantly. ### Cleanup stale sessions Remove old connectors or decommissioned tunnels to keep your environment clean. ## Use Cases ### Fixing a disconnected service A deployment fails because a new service isn't reachable. The engineer asks the agent to `create_route` for the new IP range and `put_configuration` to update the ingress rules. ### Security compliance auditing A security audit requires a list of all active entry points. The admin asks the agent to `list_tunnels` and `list_connections` to generate a report of all active tunnels. ### Decommissioning legacy infrastructure A legacy tunnel is still active and creating a security risk. The sysadmin asks the agent to `delete_tunnel` and `cleanup_connections` to completely remove the old path. ### Provisioning a new remote gateway A developer needs to set up a new remote bridge. They ask the agent to `create_tunnel`, then `get_tunnel_token` to provide the credentials for the remote host. ## Benefits - Faster tunnel deployment: Create new tunnels and get your `get_tunnel_token` instantly without navigating the Cloudflare dashboard. - Dynamic ingress updates: Use `put_configuration` to change where traffic flows during a live deployment or emergency fix. - Simplified route management: Add or remove CIDR blocks with `create_route` and `delete_route` to keep your private network clean. - Real-time health monitoring: Check if your infrastructure is reachable using `list_connections` and `get_connector` to spot issues early. - Automated cleanup: Keep your environment tidy by using `cleanup_connections` to remove stale sessions that could pose a security risk. ## How It Works The bottom line is you get a conversational interface for your entire Cloudflare Zero Trust network. 1. Subscribe to the Cloudflare Tunnel MCP on Vinkius 2. Provide your Cloudflare API Token with the necessary permissions 3. Start asking your AI client to manage your tunnels or routes ## Frequently Asked Questions **Can I use the Cloudflare Tunnel MCP to manage my private network routes?** Yes, you can manage your private network routes directly. You can add or remove CIDR blocks and update how your internal resources are connected to your tunnel without manual dashboard entries. **How does the Cloudflare Tunnel MCP help with security audits?** It allows you to quickly list all active tunnels and connections. You can ask your agent to audit your network routes or find specific tunnels by IP to ensure your Zero Trust policies are being followed. **Can the Cloudflare Tunnel MCP help me troubleshoot connection issues?** Definitely. You can use it to fetch detailed connector information or check the status of specific tunnels to see if they're healthy, degraded, or down. **Does the Cloudflare Tunnel MCP support updating ingress rules?** Yes, you can update or add configuration for remotely-managed tunnels. This means you can change your traffic routing rules through a natural conversation with your agent. **Is the Cloudflare Tunnel MCP good for managing many remote connectors?** It's ideal for that. You can list all connections, fetch management tokens for new ones, and even clean up stale sessions to keep your network architecture organized. **Can I update the ingress rules for a remotely managed tunnel?** Yes. Use the `put_configuration` tool to update the ingress rules and origin request settings for any tunnel that is configured for remote management. **How do I check if my tunnels are currently online?** You can use `list_tunnels` with the `status` parameter set to 'healthy' to see active tunnels, or use `get_tunnel` with a specific ID to see its current operational state. **Can I manage private network routes through this integration?** Yes. The server includes tools like `list_routes`, `create_route`, and `delete_route` to manage your Cloudflare Tunnel network routing (WARP-to-Tunnel).