Cloudflare One CASB MCP Server
This Model Context Protocol (MCP) server provides tools for inspecting Cloudflare One CASB integrations, assets, and asset categories. It supports Cloudflare OAuth and API-token authentication.
The /mcp URL uses a stateless SDK v2 handler that creates a fresh server with request-scoped auth/account context for every request. The retired /sse URL returns 410 Gone pointing at /mcp. OAuth grants and token validation remain durable security state; the server stores no MCP protocol session.
Available tools
- List integrations and inspect one by ID.
- List and search assets, including by integration or category.
- List asset categories and filter them by vendor or type.
These tools are account-scoped. Single-account credentials and account-scoped API tokens are detected automatically. If your credentials can access multiple accounts, pass account_id to the tool or set a cf-account-id request header in your MCP client configuration.
Connect
Use the production endpoint directly in clients with remote MCP support:
{
"mcpServers": {
"cloudflare-casb": {
"url": "https://casb.mcp.cloudflare.com/mcp"
}
}
}
To run the server locally, set CLOUDFLARE_CLIENT_ID and CLOUDFLARE_CLIENT_SECRET, configure the OAUTH_KV namespace in wrangler.jsonc, then run pnpm dev.
