Cloudflare Workers Bindings MCP Server

🛡️ Official✓ VerifiedHTTP + SSEOAuth 2.14 tools·Online14ms·30d uptime: 100%·Last checked 18m ago

The Workers Bindings MCP connects agents to your Cloudflare account resources — Workers, D1, KV and R2 — after an OAuth login. Great for infrastructure Q&A and inspection.

https://bindings.mcp.cloudflare.com/mcp

SSEhttps://bindings.mcp.cloudflare.com/sse

Provider: Cloudflare ↗
Source: https://github.com/cloudflare/mcp-server-cloudflare ↗
Categories: ☁️ Cloud, Infrastructure & DevOps

中文简介

Cloudflare 认证版绑定管理 MCP 服务器。AI 代理可列出 Workers、查询 D1 数据库、查看 KV 命名空间和 R2 存储桶。

HTTP + SSEhttps://bindings.mcp.cloudflare.com/mcp

Legacy SSE endpoint

SSEhttps://bindings.mcp.cloudflare.com/sse

Install in Cursor →

Or add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "cloudflare-workers": {
      "url": "https://bindings.mcp.cloudflare.com/mcp"
    }
  }
}

🔬 Test Live in Online Inspector 🔐 Audit OAuth 2.1 Config

🧰 Tools exposed by Cloudflare Workers Bindings MCP (4)

Tool	Safety	Description	Parameters
workers_list	🟢 Read	List Workers scripts in the account.	accountId: string
d1_database_query	🟠 Write	Run a SQL query against a D1 database. Can modify data depending on the statement.	accountId: stringdatabaseId: stringquery: string
kv_namespace_list	🟢 Read	List KV namespaces in the account.	accountId: string
r2_bucket_list	🟢 Read	List R2 buckets in the account.	accountId: string

🔐 OAuth 2.1 & Security

Auth type: OAuth 2.1
Dynamic Client Registration: ✅ Supported
PKCE S256: ✅ Supported
Protected resource metadata: https://bindings.mcp.cloudflare.com/.well-known/oauth-protected-resource (expected location)

🔐 Audit OAuth 2.1 Config →

🧩 Recommended Agent Skills

Cloudflare Workers skills ↗

📖 Guide

Cloudflare Workers Bindings MCP — Remote MCP Server

The Workers Bindings server is Cloudflare's authenticated MCP for account inspection: after OAuth it can enumerate your Workers, query D1 databases, and list KV namespaces and R2 buckets. It is read-oriented but the D1 query tool executes real SQL, so treat it with the same care as dashboard access.

Endpoint & Transport

Endpoint URL: https://bindings.mcp.cloudflare.com/mcp
Legacy SSE endpoint: https://bindings.mcp.cloudflare.com/sse
Transport: Streamable HTTP + legacy SSE

Authentication

Cloudflare Workers Bindings MCP uses OAuth 2.1 — the first request returns a 401 Unauthorized challenge with a WWW-Authenticate header pointing at the authorization metadata. Compliant clients (Cursor, Claude, VS Code, ChatGPT) handle the whole flow — PKCE and Dynamic Client Registration, so no manual client setup is needed — and simply open a browser consent screen.

Available Tools (4)

Tool	Safety	Description
`workers_list`	read	List Workers scripts in the account.
`d1_database_query`	write	Run a SQL query against a D1 database. Can modify data depending on the statement.
`kv_namespace_list`	read	List KV namespaces in the account.
`r2_bucket_list`	read	List R2 buckets in the account.

Connect in 30 Seconds

Claude Code — one command:

claude mcp add --transport http cloudflare-workers https://bindings.mcp.cloudflare.com/mcp

Cursor — add to ~/.cursor/mcp.json:

{ "mcpServers": { "cloudflare-workers": { "url": "https://bindings.mcp.cloudflare.com/mcp" } } }

VS Code — add to .vscode/mcp.json:

{ "servers": { "cloudflare-workers": { "type": "http", "url": "https://bindings.mcp.cloudflare.com/mcp" } } }

Claude Desktop & stdio clients — bridge with mcp-remote:

{ "mcpServers": { "cloudflare-workers": { "command": "npx", "args": ["-y", "mcp-remote", "https://bindings.mcp.cloudflare.com/mcp"] } } }

On first connect your client opens a browser OAuth consent screen — approve it and tools become available immediately.

Troubleshooting

401 Unauthorized on connect — that's expected; the server is OAuth-protected. Let your client complete the browser consent flow, or inspect the endpoint in our OAuth debugger to see the exact WWW-Authenticate challenge.
Which URL should I use? Prefer https://bindings.mcp.cloudflare.com/mcp (Streamable HTTP). The SSE URL is only for older clients pinned to the pre-2025-03-26 spec.
"Session expired" / stale Mcp-Session-Id — just re-send initialize; stateless clients can ignore session headers entirely.
OAuth uses your Cloudflare account — the agent sees the resources your user can see.
d1_database_query executes arbitrary SQL against selected databases.

🚀 How to Connect

Copy the Cloudflare Workers Bindings MCP endpoint URL
The remote endpoint is https://bindings.mcp.cloudflare.com/mcp. A legacy SSE endpoint is also available at https://bindings.mcp.cloudflare.com/sse.
Add it to your MCP client
Claude Code: claude mcp add --transport http cloudflare-workers https://bindings.mcp.cloudflare.com/mcp. Cursor: add "cloudflare-workers": { "url": "https://bindings.mcp.cloudflare.com/mcp" } under mcpServers in ~/.cursor/mcp.json. Other clients work similarly.
Complete the OAuth consent
On first connection your client opens a Cloudflare consent screen in the browser. Approve it to grant access; the token is stored by the client and refreshed automatically.
Verify with the online inspector
Paste https://bindings.mcp.cloudflare.com/mcp into remotemcp.net/inspector, run initialize and tools/list, and confirm Cloudflare Workers Bindings MCP's 4 tools respond.

❓ FAQ

What is the Cloudflare Workers Bindings MCP remote MCP endpoint?

The primary endpoint is https://bindings.mcp.cloudflare.com/mcp, with a legacy SSE endpoint at https://bindings.mcp.cloudflare.com/sse. It is an official first-party server operated by Cloudflare, speaking the Streamable HTTP + legacy SSE transport.

Should I use Cloudflare Workers Bindings MCP's /mcp or /sse endpoint?

Use https://bindings.mcp.cloudflare.com/mcp — Streamable HTTP is the current MCP transport and what every modern client defaults to. https://bindings.mcp.cloudflare.com/sse exists only for clients still on the legacy HTTP+SSE transport from the 2024 spec.

How do I authenticate with Cloudflare Workers Bindings MCP?

Cloudflare Workers Bindings MCP uses OAuth 2.1. When your client first connects it receives a 401 challenge, discovers the authorization server via RFC 9728 metadata, and opens a browser consent screen. Dynamic Client Registration is supported, so compliant clients register themselves automatically.

I'm getting a 401 Unauthorized from Cloudflare Workers Bindings MCP — what's wrong?

A 401 means your client hasn't completed (or has lost) the OAuth authorization. Remove and re-add the server in your client to restart the consent flow, and check that your browser session can reach the provider's login page. If the 401 arrives without a WWW-Authenticate header, run it through our OAuth debugger to see what's missing.

Which MCP clients work with Cloudflare Workers Bindings MCP?

Any client that supports remote MCP servers: Cursor, Claude Code (`claude mcp add --transport http cloudflare-workers https://bindings.mcp.cloudflare.com/mcp`), VS Code Copilot, ChatGPT connectors, Windsurf, and Claude Desktop via the `mcp-remote` bridge.

What tools does Cloudflare Workers Bindings MCP expose?

4 tools are cataloged in this directory — including `workers_list`, `d1_database_query`, `kv_namespace_list` and more. Use our online inspector to fetch the live tool list straight from the endpoint.

🔗 Connect Guides

Cursor

Connect Cloudflare Workers Bindings MCP →

Claude

Connect Cloudflare Workers Bindings MCP →

Claude Code

Connect Cloudflare Workers Bindings MCP →

VS Code

Connect Cloudflare Workers Bindings MCP →

ChatGPT

Connect Cloudflare Workers Bindings MCP →

Windsurf

Connect Cloudflare Workers Bindings MCP →

📛 Embed Status Badge in README

[![Remote MCP Status](https://remotemcp.net/api/badge/status/cloudflare-workers.svg)](https://remotemcp.net/servers/cloudflare-workers)

[![Test in Inspector](https://remotemcp.net/api/badge/inspect/cloudflare-workers.svg)](https://remotemcp.net/inspector?url=https%3A%2F%2Fbindings.mcp.cloudflare.com%2Fmcp)