Cloudflare Ops MCP: OAuth-First Cloudflare Operations for AI Agents
Scan first, show the diff, write only after approval. An open-source MCP server for Cloudflare DNS, email trust, cache, and — as of v0.4 — bounded AI delegation with an audit chain.
Most AI-meets-infrastructure stories go one of two ways: the agent is allowed to do nothing useful, or the agent is handed a master key and everyone hopes. Cloudflare Ops MCP, an open-source project by AMH - Artificial Mind Hive, is built on the third way: the agent can see everything relevant, propose exactly what it wants to change as a diff, and touch nothing until the owner approves. Every applied change leaves an audit record.
What it actually does
The server speaks the Model Context Protocol, the open standard that lets AI assistants call tools over a defined schema. Point an MCP-capable agent at it and the agent gains a Cloudflare operations vocabulary: scan a zone, plan email authentication, verify a domain, upsert DNS records, set DMARC policy, set up BIMI with a DMARC enforcement gate, configure Email Routing with verified-destination protection, run a Pages DNS cutover, purge cache, create Turnstile widgets, mint scoped auto-expiring API tokens, and diagnose which service actually serves a domain.
Read-only calls run immediately. Mutations return a dry-run diff. The write happens only when the caller explicitly approves.
The email-trust tooling is the everyday workhorse. SPF, DKIM, DMARC, and BIMI records fail quietly and cost real deliverability; the server detects the current state, plans the minimal change, refuses footguns like duplicate SPF records, and applies only the approved fields. For operators managing DNS hygiene across many zones, that is the difference between a checklist and an operator.
The OAuth line
The hosted connector never asks a user to paste an API token into a chat window. Users authorize their own Cloudflare account through Cloudflare's OAuth screen; tokens stay server-side, and each user receives a one-user connector key stored only as a hash and bound to that single grant. The agent gets tools — it never gets the credential. Self-hosters can deploy the same Worker with Wrangler in their own account, and a zero-dependency CLI and library ship in the same repository.
v0.4: the agent harness
The August 2026 release adds a second, private Worker: the AMH WT Agent Harness. The idea is bounded delegation — a coordinating model hands narrow, versioned job packets to small worker models (Cloudflare-hosted K2-class or free-tier models), an independent verifier pass checks the result, and the master accepts or rejects. The interesting part is what the workers cannot do: no raw shell, no secrets, no browsing outside a per-job HTTPS allowlist, no writes without a separate approval, and no editing of their own instructions. Improvements are filed as candidate revisions with evidence, and nothing becomes active until it is reviewed.
Under the hood it is a straightforward use of Cloudflare Durable Objects and the Cloudflare Agents SDK: one coordinator per user, a tamper-evident hash-chained audit log, retention that expires bulky evidence on a 4/7/30-day schedule while keeping decisions and receipts, and a console with live progress bars plus a read-only terminal watcher. Model labeling is honest by design — if a free-tier model ran the job, the record says so; the paid K2 lane is a visible profile switch, not a silent upgrade.
Why it belongs on NU
NU's whole editorial premise is records over spin, and this is infrastructure software built the same way: the primary record — the diff, the deployment ID, the audit event, the version scorecard — is the product. The claims here are checkable in public: the source code, the v0.4.0 release notes, and the live server's own health report at cfops.nothingunseen.com/health, which lists every tool the deployment exposes.
It is also, plainly, an unofficial third-party tool: Cloudflare Ops MCP is independent open-source software by AMH, operated by Service Pricer LLC, and is not affiliated with or endorsed by Cloudflare, Inc. The owner is responsible for every change they approve. That disclosure ships in the README, and it should.
Project links: Hosted connector - GitHub repository - v0.4.0 release - Service Pricer - WALO - AMH Site Revival - AMH, Artificial Mind Hive.