Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare IP Firewall (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-ip-firewall.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-ip-firewall.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-ip-firewall.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare IP Firewall Cloudflare API token with Firewall Services read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-ip-firewall.connectorbay.com/health · Tool schemas: https://byok-cloudflare-ip-firewall.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-ip-firewall · agent@connectorbay.com

What Cloudflare IP Firewall (BYOK) is for

Cloudflare IP Firewall (BYOK) lets an AI assistant read your own Cloudflare IP Firewall data through the Cloudflare IP Firewall API with a key you supply (Cloudflare API token with Firewall Services read permission). Read-only: 9 tools (list_zone_access_rules, list_account_access_rules, get_zone_access_rule, get_account_access_rule, list_lockdown_rules, get_lockdown_rule, list_user_agent_rules, list_firewall_rules, list_page_rules). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare IP Firewall. Cloudflare IP Firewall and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which IPs or countries are blocked on my Cloudflare zone?"
  • "Which IP Access rules apply to my whole Cloudflare account?"
  • "What does IP Access rule 92f17202 do?"
  • "What does account IP Access rule 92f17202 do?"
  • "Which URLs are locked down to specific IPs on my zone?"
  • "Which IPs may reach the locked down admin URL?"

What it does

  • list_zone_access_rules: List the IP Access rules of a zone (block, challenge or allow by IP, range, ASN or country) with notes and dates.
  • list_account_access_rules: List the account-level IP Access rules (block, challenge or allow by IP, range, ASN or country) with notes and dates.
  • get_zone_access_rule: Get one zone IP Access rule by id.
  • get_account_access_rule: Get one account-level IP Access rule by id.
  • list_lockdown_rules: List Zone Lockdown rules (URLs restricted to allowed IPs) with description, URLs, allowed IP configurations and paused flag.
  • get_lockdown_rule: Get one Zone Lockdown rule.
  • list_user_agent_rules: List User Agent blocking rules of a zone with the matched user agent, action and paused flag.
  • list_firewall_rules: List the legacy Firewall Rules of a zone (action, description, priority, paused flag). Filter expressions are not included; use the rulesets API for current WAF rules.
  • list_page_rules: List the Page Rules of a zone (targets and actions) in priority order.

BYOK key

You bring your own Cloudflare IP Firewall Cloudflare API token with Firewall Services read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare IP Firewall API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/firewall/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare IP Firewall. Cloudflare IP Firewall and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare IP Firewall account.

Built for: Worldwide. Languages: English.