Connect your agent over the Model Context Protocol and it can read your estimated Cloudflare spend, set or clear a hard budget cap, and pause or resume Workers - the same actions you have in the dashboard, in the same activity log.
No API keys and no tokens to paste - the client signs you in with Cloudflare the first time it connects. Four of the twelve tools stop production traffic; read that part first.
https://app.controlflare.com/mcpControlflare speaks Streamable HTTP on the same origin as the dashboard. Claude Code has a plugin that wires it up for you; every other client takes the endpoint directly and works out the rest.
The shortest route. Adds the marketplace, then installs the plugin: no endpoint to type and nothing to keep in sync if it ever moves.
/plugin marketplace add Controlflare/claude-marketplace
/plugin install controlflare@controlflareThe plugin holds no code and runs no local process. It is three JSON files naming the hosted endpoint, on GitHub where you can read all of it in a minute.
The same server added by hand, if you would rather not take a marketplace. Run it once in any project.
claude mcp add --transport http controlflare https://app.controlflare.com/mcpAdd one entry to the mcpServers object in the client's config file.
{
"mcpServers": {
"controlflare": {
"type": "http",
"url": "https://app.controlflare.com/mcp"
}
}
}To look at the tools before you wire an agent to them. Start the Inspector and connect it to the endpoint over Streamable HTTP.
npx @modelcontextprotocol/inspectorClients discover the sign-in for themselves. A first call to /mcp comes back 401 with a WWW-Authenticate header naming the protected-resource metadata; the client reads that, registers itself, and opens the consent page in your browser. There is nothing to copy into a config file and no secret to keep.
The first connection walks through a browser once. After that the client holds a token and reconnects on its own.
It registers itself with Controlflare and sends you to a consent page that names the client and lists exactly what it will be able to do - including that it can pause Workers.
A page you have to read and act on, not a silent redirect. Declining sends the client away with access_denied and nothing changes.
The same "Sign in with Cloudflare" the dashboard uses, asking for one scope: User Details: Read. Controlflare reads your Cloudflare user id and email address, to know which Controlflare account you are - and nothing else. It is not how Controlflare reaches your Workers: pausing and resuming runs through the cost agent you installed in your own Cloudflare account, on the API token you set on it yourself, and this sign-in is never given access to either.
Scoped to your account and to what you approved. Remove the connection in your client to revoke it; the next call gets a 401 and the flow starts over.
If you have no Controlflare account yet, the first connection creates one. If a Controlflare account already uses your Cloudflare email address, the connection is refused rather than joined to it - Cloudflare does not publish whether an address has been confirmed, so treating it as proof would be a way into an account that is not yours. You will see a page saying so; carry on signing in to the dashboard the way you already do. An agent never sees more than the account you signed in as: an account id belonging to somebody else returns the same "no such account" error as an id that does not exist.
Five read. Three change a setting. Four stop production traffic - those carry destructiveHint, and they mean it.
| Tool | Parameters | What it does |
|---|---|---|
Reads only readOnlyHint | ||
list_cloudflare_accounts |
- | Connected accounts with cap, enforcement state, latest estimated spend and workload counts |
get_account |
accountId |
One account in detail, plus its workloads |
get_estimated_spend |
accountId |
Current-period estimated USD with its per-product split (Workers, D1, R2, KV and Durable Object requests), the raw units behind it, and which products could not be measured - with an explicit note that this is an estimate, not an invoice |
list_workloads |
accountId |
Scripts with status, pausedBy, pausedAt and a restore summary |
list_events |
accountId, limit? (1–500, default 50) |
Recent activity, newest first |
| Changes a setting | ||
set_billing_cap |
accountId, capUsd: number | null |
Sets the hard monthly cap; null clears it. A cap at or below current spend pauses everything within about five minutes |
set_enforcement |
accountId, enabled: boolean |
Turns automatic pausing on or off |
sync_account |
accountId |
Refreshes workloads and takes a usage snapshot now |
Stops production traffic destructiveHint | ||
pause_workload |
accountId, workloadId |
Pauses one Worker - stops its production traffic |
resume_workload |
accountId, workloadId |
Restores one Worker's routes, domains and schedules |
pause_all_workloads |
accountId |
Pauses every running Worker on the account |
resume_all_workloads |
accountId |
Resumes every paused Worker on the account |
The table scrolls sideways - the third column says what each tool does.
accountId is the Controlflare account UUID returned by list_cloudflare_accounts - not the 32-hex Cloudflare account id. Start there and pass the id it gives you.
An agent with these tools can take production down as surely as you can. That is the whole point of the tools - it is also the reason to read this before you connect one.
Pausing a Worker removes its routes, detaches its custom domains, disables its workers.dev URL and clears its cron triggers. Each of those is stored first, so a resume puts back exactly what was there - but until someone resumes it, that Worker answers nothing.
set_billing_cap is not a read. Set at or below the current estimated spend, it pauses every running Worker on the account within about five minutes. An agent tidying up your caps can do that without ever calling a destructive tool.
It is built from Cloudflare usage analytics and published list prices - not an invoice, and not your whole Cloudflare bill. It covers Workers, D1, R2, KV and Durable Object requests; Durable Object duration, Queues, Workers AI and others are still outside it, and a product Controlflare could not read comes back as unavailable rather than as zero. Treat what an agent reports as an approximation, and check the invoice for the authoritative number.
Tools reuse the same services as the dashboard and the cron enforcer, so a cap change or a pause made by an agent produces the same cap_updated and workload_paused events as one made by hand. Read them back with list_events, or in the dashboard.