Be the first to get access to new connectors. Get early access →
ConnectorBay Early access

Cloudflare Zero Trust (BYOK) — connector documentation

  • MCP endpoint: https://byok-cloudflare-zero-trust.connectorbay.com/mcp
  • REST API: POST https://byok-cloudflare-zero-trust.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://byok-cloudflare-zero-trust.connectorbay.com/openapi.json
  • Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
  • Authentication: your own Cloudflare Zero Trust Cloudflare API token with Zero Trust read permission, sent in the X-Upstream-Key header of every request (never stored, logged or cached)
  • Health: https://byok-cloudflare-zero-trust.connectorbay.com/health · Tool schemas: https://byok-cloudflare-zero-trust.connectorbay.com/tools.json
  • Publisher: Unify Dynamics LLC · connectorbay.com/byok-cloudflare-zero-trust · agent@connectorbay.com

What Cloudflare Zero Trust (BYOK) is for

Cloudflare Zero Trust (BYOK) lets an AI assistant read your own Cloudflare Zero Trust data through the Cloudflare Zero Trust API with a key you supply (Cloudflare API token with Zero Trust read permission). Read-only: 9 tools (list_access_apps, list_access_policies, list_access_groups, list_identity_providers, list_service_tokens, list_gateway_rules, list_gateway_lists, list_gateway_locations, list_tunnels). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to api.cloudflare.com. Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Zero Trust. Cloudflare Zero Trust and its logos are trademarks of their owners and are used only to say which service the connector works with.

Ask your assistant things like:

  • "Which applications are protected by Cloudflare Access?"
  • "Which reusable Access policies exist and how many apps use them?"
  • "Which Access groups are defined?"
  • "Which identity providers does Cloudflare Access use?"
  • "Which Access service tokens are about to expire?"
  • "Which Gateway rules block traffic and in what order?"

What it does

  • list_access_apps: List Cloudflare Access applications with type, domain, audience tag, session duration and destinations.
  • list_access_policies: List reusable Access policies with decision (allow, deny, bypass, non_identity), session duration and how many apps use each. Rule contents (emails) are not returned.
  • list_access_groups: List Access groups (reusable rule sets) by name and dates. The include, exclude and require rules are not returned.
  • list_identity_providers: List the identity providers connected to Access (Okta, Google, GitHub, SAML ...) with type and whether SCIM is on. Client secrets are not returned.
  • list_service_tokens: List Access service tokens with client id, enabled flag, duration, expiry and last use. Token secrets are not shown by the API.
  • list_gateway_rules: List Zero Trust Gateway rules (DNS, HTTP and network filtering) with action, precedence, enabled flag and traffic expression. Identity expressions are not returned.
  • list_gateway_lists: List Zero Trust lists (domains, URLs, IPs, emails ...) with type and item count. The list entries themselves are not returned.
  • list_gateway_locations: List Gateway DNS locations with default flag, DNS-over-HTTPS subdomain and EDNS client subnet support.
  • list_tunnels: List Cloudflare Tunnels with status (healthy, degraded, down, inactive), type and when connections were last active.

BYOK key

You bring your own Cloudflare Zero Trust Cloudflare API token with Zero Trust read permission (https://dash.cloudflare.com/profile/api-tokens). Your assistant sends it in the X-Upstream-Key header with each request. ConnectorBay uses it for that one call only: it is never stored, logged or cached, never shown in an answer, and it is only sent to api.cloudflare.com over https, with no redirects followed. Create a key with the fewest permissions the tools need (read-only if the provider offers it), and revoke it at the provider whenever you like.

Data sources

Live from the Cloudflare Zero Trust API (api.cloudflare.com) with a BYOK key; documentation: https://developers.cloudflare.com/cloudflare-one/api/. Endpoints checked against that documentation on 2026-10-16.

What it is not

Unofficial connector by Unify Dynamics LLC: not affiliated with, endorsed by or sponsored by Cloudflare Zero Trust. Cloudflare Zero Trust and its logos are trademarks of their owners and are used only to say which service the connector works with. It is read-only: it never creates, changes, sends or deletes anything in your Cloudflare Zero Trust account.

Built for: Worldwide. Languages: English.