Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Magic Transit (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-magic-transit.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-magic-transit.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-magic-transit.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Magic Transit Cloudflare API token with Magic Transit and Magic WAN read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-magic-transit.connectorbay.com/health · Tool schemas: https://byok-cloudflare-magic-transit.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-magic-transit · agent@connectorbay.com

What Cloudflare Magic Transit (BYOK) is for

Cloudflare Magic Transit (BYOK) lets an AI assistant read your own Cloudflare Magic Transit data through the Cloudflare Magic Transit API with a key you supply (Cloudflare API token with Magic Transit and Magic WAN read permission). Read-only: 9 tools (list_sites, list_site_lans, list_gre_tunnels, list_ipsec_tunnels, list_interconnects, list_static_routes, list_connectors, list_account_apps, get_bgp_settings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Magic Transit. Cloudflare Magic Transit and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which Magic WAN sites do I have?"
  • "Which LANs does site c4c7f0a2-2b1f-4a54-9a5e-7d3e9f1b2c3d have?"
  • "Which GRE tunnels are configured in Magic WAN?"
  • "Which IPsec tunnels are configured in Magic WAN?"
  • "Which network interconnects does my Magic WAN use?"
  • "Which static routes does Magic WAN have?"

What it does

  • list_sites: List Magic WAN sites with name, description, high availability mode and connector ids. Needs Magic WAN or Magic Transit on the account.
  • list_site_lans: List the LANs of a Magic WAN site with VLAN, physical port, breakout and prioritization flags and routed subnets. Needs Magic WAN or Magic Transit on the account.
  • list_gre_tunnels: List Magic GRE tunnels with endpoints, interface address, MTU, TTL, BGP status and health check settings. Needs Magic WAN or Magic Transit on the account.
  • list_ipsec_tunnels: List Magic IPsec tunnels with endpoints, interface address, replay protection, BGP status and health check settings. Pre-shared keys are never returned. Needs Magic WAN or Magic Transit on the account.
  • list_interconnects: List Cloudflare Network Interconnects used by Magic with colo, interface address, MTU and health check settings. Needs Magic WAN or Magic Transit on the account.
  • list_static_routes: List Magic static routes with prefix, next hop, priority, weight and scope. Needs Magic WAN or Magic Transit on the account.
  • list_connectors: List Magic WAN Connector devices with activation state, last heartbeat, software version and timezone. License keys are not returned. Needs Magic WAN or Magic Transit on the account.
  • list_account_apps: List Magic WAN applications (account and managed) with type, hostnames and IP subnets used for traffic steering. Needs Magic WAN or Magic Transit on the account.
  • get_bgp_settings: Show the account's Magic BGP settings: Cloudflare ASN and last modification time. Needs Magic WAN or Magic Transit on the account.

BYOK key

You bring your own Cloudflare Magic Transit Cloudflare API token with Magic Transit and Magic WAN read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Magic Transit API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/magic_transit/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Magic Transit. Cloudflare Magic Transit and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Magic Transit account.

Built for: Worldwide. Languages: English.