Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Tunnels (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-tunnels.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-tunnels.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-tunnels.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Tunnels Cloudflare API token with Cloudflare Tunnel and Zero Trust read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-tunnels.connectorbay.com/health · Tool schemas: https://byok-cloudflare-tunnels.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-tunnels · agent@connectorbay.com

What Cloudflare Tunnels (BYOK) is for

Cloudflare Tunnels (BYOK) lets an AI assistant read your own Cloudflare Tunnels data through the Cloudflare Tunnels API with a key you supply (Cloudflare API token with Cloudflare Tunnel and Zero Trust read permission). Read-only: 10 tools (list_tunnels, get_tunnel, list_tunnel_connectors, get_tunnel_ingress, list_mesh_nodes, list_private_network_routes, list_virtual_networks, list_hostname_routes, list_subnets, get_connectivity_settings). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Tunnels. Cloudflare Tunnels and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which of my Cloudflare tunnels are down?"
  • "Is tunnel f70ff985-a4ef-4643-bbbc-4a0ed4fc8415 healthy?"
  • "Which cloudflared versions run for tunnel f70ff985-a4ef-4643-bbbc-4a0ed4fc8415?"
  • "What does tunnel f70ff985-a4ef-4643-bbbc-4a0ed4fc8415 route to?"
  • "Which WARP Connector nodes do I have?"
  • "Which private networks are routed through my tunnels?"

What it does

  • list_tunnels: List Cloudflare Tunnels (cloudflared) of an account with status, type, configuration source and activity times. Tunnel tokens and connector client IPs are not returned.
  • get_tunnel: Get one Cloudflare Tunnel: name, status, type, configuration source and activity times. Tunnel tokens and connector client IPs are not returned.
  • list_tunnel_connectors: List the active connectors (cloudflared instances) of a tunnel with version, architecture, start time and features. Tunnel tokens and connector client IPs are not returned.
  • get_tunnel_ingress: Get the ingress rules (hostname to service mapping) of a remotely managed tunnel and its configuration version.
  • list_mesh_nodes: List WARP Connector (Mesh) nodes of an account with status and activity times.
  • list_private_network_routes: List private network routes (CIDR to tunnel) with tunnel and virtual network names.
  • list_virtual_networks: List Zero Trust virtual networks with name, default flag and comment.
  • list_hostname_routes: List hostname routes (private hostname to tunnel).
  • list_subnets: List Zero Trust subnets (Cloudflare source, initial resolved IP, WARP) with address range, capacity and usage.
  • get_connectivity_settings: Show the account's Zero Trust connectivity settings: whether the ICMP proxy and the WARP off-ramp are enabled.

BYOK key

You bring your own Cloudflare Tunnels Cloudflare API token with Cloudflare Tunnel and Zero Trust read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Tunnels API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Tunnels. Cloudflare Tunnels and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Tunnels account.

Built for: Worldwide. Languages: English.