Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare DNS Services (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-dns-services.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-dns-services.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-dns-services.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare DNS Services Cloudflare API token with DNS read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-dns-services.connectorbay.com/health · Tool schemas: https://byok-cloudflare-dns-services.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-dns-services · agent@connectorbay.com

What Cloudflare DNS Services (BYOK) is for

Cloudflare DNS Services (BYOK) lets an AI assistant read your own Cloudflare DNS Services data through the Cloudflare DNS Services API with a key you supply (Cloudflare API token with DNS read permission). Read-only: 11 tools (get_zone_dns_settings, get_account_dns_settings, get_dnssec, get_dns_analytics_report, get_dns_analytics_by_time, list_dns_firewall_clusters, get_dns_firewall_cluster, list_secondary_dns_peers, list_secondary_dns_acls, get_secondary_zone_config, list_custom_nameservers). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare DNS Services. Cloudflare DNS Services and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "How is DNS configured for my Cloudflare zone?"
  • "What DNS defaults does my Cloudflare account apply to new zones?"
  • "Is DNSSEC active on my Cloudflare zone?"
  • "How many DNS queries did my Cloudflare zone get by record type yesterday?"
  • "Show hourly DNS query counts for my Cloudflare zone."
  • "Which DNS Firewall clusters do I have on Cloudflare?"

What it does

  • get_zone_dns_settings: Get the DNS settings of a zone: zone mode, CNAME flattening, multi-provider, secondary overrides, NS TTL and SOA values.
  • get_account_dns_settings: Get the account-level DNS defaults applied to new zones: zone mode, flattening, NS TTL, SOA and whether DNS-only is enforced.
  • get_dnssec: Get the DNSSEC status of a zone with algorithm, digest type, key tag, DS record and flags (public key and DS record are public data).
  • get_dns_analytics_report: Get a DNS analytics report for a zone: query metrics grouped by dimensions over a period. Read-only and free.
  • get_dns_analytics_by_time: Get a DNS analytics report for a zone broken down by time interval (hour, day and so on).
  • list_dns_firewall_clusters: List the DNS Firewall clusters of an account with upstream IPs, Cloudflare-assigned IPs, cache TTLs, rate limit and attack mitigation.
  • get_dns_firewall_cluster: Get one DNS Firewall cluster with upstream IPs, assigned IPs, cache TTLs, rate limit and attack mitigation settings.
  • list_secondary_dns_peers: List the secondary DNS peers of an account with IP, port, IXFR setting and the linked TSIG id (never the TSIG secret).
  • list_secondary_dns_acls: List the secondary DNS ACLs of an account with name and allowed IP range.
  • get_secondary_zone_config: Get the incoming zone transfer (secondary) configuration of a zone: peers, refresh interval, SOA serial and last check time.
  • list_custom_nameservers: List the account custom nameservers with name, set number, verification status and glue records.

BYOK key

You bring your own Cloudflare DNS Services Cloudflare API token with DNS read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare DNS Services API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/dns/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare DNS Services. Cloudflare DNS Services and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare DNS Services account.

Built for: Worldwide. Languages: English.