Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Bot Protection (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-bot-protection.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-bot-protection.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-bot-protection.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Bot Protection Cloudflare API token with Turnstile and Zone WAF read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-bot-protection.connectorbay.com/health · Tool schemas: https://byok-cloudflare-bot-protection.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-bot-protection · agent@connectorbay.com

What Cloudflare Bot Protection (BYOK) is for

Cloudflare Bot Protection (BYOK) lets an AI assistant read your own Cloudflare Bot Protection data through the Cloudflare Bot Protection API with a key you supply (Cloudflare API token with Turnstile and Zone WAF read permission). Read-only: 7 tools (list_turnstile_widgets, get_turnstile_widget, get_content_scanning_status, list_content_scanning_expressions, get_leaked_credential_status, list_leaked_credential_detections, get_fraud_detection_settings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Bot Protection. Cloudflare Bot Protection and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which Turnstile widgets do I have and on which domains?"
  • "What mode is Turnstile widget 0x4AAAAAAAAAAAAAAAAAAAAA in?"
  • "Is Content Scanning on for my zone?"
  • "Which custom expressions does Content Scanning use on my zone?"
  • "Are leaked credential checks enabled on my zone?"
  • "Where does my zone look for login credentials in requests?"

What it does

  • list_turnstile_widgets: List Turnstile widgets of an account with sitekey, name, allowed domains, mode, region and dates. The widget secret key is never returned.
  • get_turnstile_widget: Get one Turnstile widget: name, domains, mode, region, clearance level and who last modified it. The widget secret key is never returned.
  • get_content_scanning_status: Show whether Content Scanning (malicious upload detection) is enabled for a zone and when the setting last changed.
  • list_content_scanning_expressions: List the custom Content Scanning payload expressions of a zone.
  • get_leaked_credential_status: Show whether Leaked Credential Checks is enabled for a zone.
  • list_leaked_credential_detections: List the custom detection locations of Leaked Credential Checks: the username and password field expressions (not real credentials).
  • get_fraud_detection_settings: Get the Fraud Detection settings of a zone: user profile mode, username expressions and success and failure status codes.

BYOK key

You bring your own Cloudflare Bot Protection Cloudflare API token with Turnstile and Zone WAF read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Bot Protection API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/challenges/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Bot Protection. Cloudflare Bot Protection and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Bot Protection account.

Built for: Worldwide. Languages: English.