Zero trust network access and security.
## Cloudflare Zero Trust MCP Server: Secure Access Service Edge The **Cloudflare Zero Trust MCP Server** integrates Cloudflare's SASE platform into Google Antigravity, enabling developers to manage access policies, tunnel configurations, and security rules for zero-trust network architectures. ### Why Cloudflare Zero Trust MCP? - **Zero Trust policies** - Define and enforce identity-based access rules - **Tunnel management** - Create and configure Cloudflare Tunnels for secure connectivity - **Gateway rules** - Manage DNS filtering and HTTP policies - **Access applications** - Configure self-hosted application protection - **WARP deployment** - Manage device enrollment and client configurations ### Key Features #### 1. Access Policy Management ```python # Create access application for internal tool app = await mcp.call("cloudflare-zerotrust", "create_access_app", { "name": "Internal Dashboard", "domain": "dashboard.company.com", "type": "self_hosted", "session_duration": "24h", "policies": [{ "name": "Engineering Team", "decision": "allow", "include": [ {"group": {"id": "eng_team_id"}}, {"email_domain": {"domain": "company.com"}} ], "require": [ {"auth_method": {"auth_method": "mfa"}} ] }] }) print(f"Application created: {app[\"id\"]}") print(f"Access URL: https://{app[\"domain\"]}") ``` #### 2. Tunnel Configuration ```python # Create and configure tunnel tunnel = await mcp.call("cloudflare-zerotrust", "create_tunnel", { "name": "production-tunnel", "config": { "ingress": [ {"hostname": "api.company.com", "service": "http://localhost:8080"}, {"hostname": "docs.company.com", "service": "http://localhost:3000"}, {"service": "http_status:404"} ] } }) # Get tunnel token for connector token = await mcp.call("cloudflare-zerotrust", "get_tunnel_token", { "tunnel_id": tunnel["id"] }) print(f"Run connector with: cloudflared tunnel run --token {token}") ``` #### 3. Gateway Policies ```python # Configure DNS filtering rules await mcp.call("cloudflare-zerotrust", "create_gateway_rule", { "name": "Block Malware Domains", "precedence": 1, "action": "block", "filters": ["dns"], "traffic": "any(dns.security_category[*] in {117 131 178})" }) # Create HTTP inspection policy await mcp.call("cloudflare-zerotrust", "create_gateway_rule", { "name": "Block File Uploads to Unapproved Sites", "action": "block", "filters": ["http"], "traffic": "http.request.method == \"POST\" and http.upload and not any(http.request.host in $approved_domains)" }) ``` #### 4. Device Posture ```python # Configure device posture check await mcp.call("cloudflare-zerotrust", "create_posture_rule", { "name": "Require Disk Encryption", "type": "disk_encryption", "match": { "platform": "any" }, "schedule": "1h", "expiration": "90d" }) # Add posture requirement to access policy await mcp.call("cloudflare-zerotrust", "update_access_policy", { "app_id": app["id"], "require": [ {"device_posture": {"integration_uid": "disk_encryption_check"}} ] }) ``` ### Configuration ```json { "mcpServers": { "cloudflare-zerotrust": { "command": "npx", "args": ["-y", "@anthropic/mcp-cloudflare-zerotrust"], "env": { "CF_API_TOKEN": "your-api-token", "CF_ACCOUNT_ID": "your-account-id", "CF_ZONE_ID": "your-zone-id" } } } } ``` ### Use Cases **Remote Access**: Securely expose internal applications to remote employees without VPN. **Application Protection**: Add authentication layer to any web application instantly. **Network Security**: Filter malicious traffic with DNS and HTTP inspection policies. **Device Compliance**: Enforce security requirements on managed devices before granting access. The Cloudflare Zero Trust MCP Server enables modern zero-trust security architecture through simple commands.
{
"mcpServers": {
"cloudflare-zerotrust": {}
}
}