Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Gateway Config (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-gateway-config.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-gateway-config.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-gateway-config.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Gateway Config Cloudflare API token with Zero Trust read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-gateway-config.connectorbay.com/health · Tool schemas: https://byok-cloudflare-gateway-config.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-gateway-config · agent@connectorbay.com

What Cloudflare Gateway Config (BYOK) is for

Cloudflare Gateway Config (BYOK) lets an AI assistant read your own Cloudflare Gateway Config data through the Cloudflare Gateway Config API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 11 tools (get_gateway_account, get_gateway_configuration, list_content_categories, list_application_types, get_application_review_status, list_gateway_certificates, list_proxy_endpoints, list_pac_files, get_logging_settings, list_egress_ip_pairs, list_dns_destination_ips). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Gateway Config. Cloudflare Gateway Config and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "What is my Zero Trust Gateway tag?"
  • "Is TLS decryption enabled in my Gateway settings?"
  • "Which content categories can Gateway block?"
  • "Which applications can I target in Gateway policies?"
  • "Which applications are approved or unapproved in Gateway?"
  • "When do my Gateway certificates expire?"

What it does

  • get_gateway_account: Show the Zero Trust Gateway account id, gateway tag and provider name.
  • get_gateway_configuration: Get the Gateway account settings: TLS decryption, antivirus, browser isolation, protocol detection, body scanning, sandbox, activity log, FIPS and maximum TTL.
  • list_content_categories: List the Gateway content and security categories with id, name, class (free, premium, blocked) and description. Subcategories are left out.
  • list_application_types: List the applications and application types Gateway knows, with ids and names.
  • get_application_review_status: Show the Gateway application review lists: approved, in review and unapproved application ids.
  • list_gateway_certificates: List Zero Trust certificates (custom and Gateway-managed) with type, binding status, expiry, fingerprint and issuer. The certificate text is left out.
  • list_proxy_endpoints: List Gateway proxy endpoints (IP-based and identity-based) with kind, subdomain and allowed IPs.
  • list_pac_files: List Gateway PAC files with name, description, slug and URL. The file contents are left out.
  • get_logging_settings: Show Gateway logging settings: whether PII is redacted and which rule types (DNS, HTTP, L4) are logged.
  • list_egress_ip_pairs: List the Gateway egress IPv4 and IPv6 ranges assigned to the account with data center and geolocation.
  • list_dns_destination_ips: List the Gateway DNS destination IP address pairs (shared, dedicated or BYOIP).

BYOK key

You bring your own Cloudflare Gateway Config Cloudflare API token with Zero Trust read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Gateway Config API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Gateway Config. Cloudflare Gateway Config and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Gateway Config account.

Built for: Worldwide. Languages: English.