Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Threat Intel (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-threat-intel.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-threat-intel.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-threat-intel.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Threat Intel Cloudflare API token with Intel read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-threat-intel.connectorbay.com/health · Tool schemas: https://byok-cloudflare-threat-intel.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-threat-intel · agent@connectorbay.com

What Cloudflare Threat Intel (BYOK) is for

Cloudflare Threat Intel (BYOK) lets an AI assistant read your own Cloudflare Threat Intel data through the Cloudflare Threat Intel API with a key you supply (Cloudflare API token with Intel read permission). Read-only: 9 tools (get_domain_details, get_domain_history, get_ip_overview, get_asn_subnets, get_passive_dns_by_ip, get_whois_record, get_url_intelligence, list_indicator_feeds, list_ip_lists). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Threat Intel. Cloudflare Threat Intel and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "What risk categories does Cloudflare assign to example.com?"
  • "How was example.com categorized over time?"
  • "Who owns IP 93.184.216.34 and is it risky?"
  • "Which subnets does AS13335 announce?"
  • "Which hostnames pointed to 93.184.216.34?"
  • "When does example.com expire and who is the registrar?"

What it does

  • get_domain_details: Get Cloudflare's view of a domain: content categories, risk types, risk score, popularity rank and what it resolves to.
  • get_domain_history: Get the history of content categorizations of a domain with start and end dates.
  • get_ip_overview: Get Cloudflare's overview of an IPv4 or IPv6 address: the network that owns it and risk types.
  • get_asn_subnets: List the subnets announced by an autonomous system number, with the total IP count.
  • get_passive_dns_by_ip: Get hostnames that Cloudflare saw resolving to an IPv4 address, with first and last seen times.
  • get_whois_record: Get a domain's public WHOIS registration facts: registrar, creation, update and expiry dates, nameservers, status and DNSSEC. Contact details are left out.
  • get_url_intelligence: Get Cloudflare's categories and risk types for a full URL.
  • list_indicator_feeds: List the custom indicator feeds your account owns, with public and downloadable flags.
  • list_ip_lists: List the managed IP lists available for Cloudflare Intel (id, name, description).

BYOK key

You bring your own Cloudflare Threat Intel Cloudflare API token with Intel read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Threat Intel API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/intel/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Threat Intel. Cloudflare Threat Intel and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Threat Intel account.

Built for: Worldwide. Languages: English.