feat(cloudflare): add official MCP provider

[LJAYi]

Summary

• add a locally executable cloudflare_mcp provider backed by Cloudflare’s official unified Streamable HTTP MCP endpoint
• expose the current Code Mode tools: docs, search, and execute
• support both OAuth 2.0 and Cloudflare API Token / Bearer Token credentials
• validate credentials through MCP tools/list and require the expected official tools
• route all MCP traffic through the provider SSRF-guarded fetch implementation

Authentication

API tokens are sent as Authorization: Bearer <token>. Both user and account API tokens are supported; account tokens should include Account Resources: Read so the official MCP server can auto-detect the account.

OAuth uses Cloudflare’s published authorization metadata:

• authorization: https://mcp.cloudflare.com/authorize
• token / refresh: https://mcp.cloudflare.com/token
• PKCE: S256
• required base scopes: user:read account:read offline_access

The open-source runtime uses bring-your-own OAuth clients. For Cloudflare MCP, register a public client through https://mcp.cloudflare.com/register using the callback URL shown by Open Connector, then save the returned client ID in the OAuth Client configuration. No client secret is required (token_endpoint_auth_method=none).

Implementation notes

• the endpoint is fixed to https://mcp.cloudflare.com/mcp
• search and execute preserve JSON results when possible and plain text otherwise
• structured MCP results (including docs) are returned directly
• MCP authorization, transport, protocol, and tool errors are mapped to stable provider errors
• no third-party logo asset is copied into the repository

Verification

• oxlint .
• oxfmt --check .
• node scripts/generate-catalog.ts
• node scripts/typecheck.ts src scripts-all examples
• vitest run — 59 files, 562 tests passed

[coderabbitai]

Summary by CodeRabbit

• New Features
  • Added a Cloudflare MCP provider integration with OAuth2 (PKCE) and bearer-token authentication.
  • Enabled Cloudflare documentation search and added MCP-powered actions to discover and execute available Cloudflare API operations.
• Bug Fixes
  • Improved handling and normalization of MCP tool outputs, with clearer error mapping when required tools are missing.
  • Enhanced cancellation behavior to prevent MCP network activity when requests are aborted.
• Tests
  • Added/expanded coverage for provider configuration and executor request/cancellation behavior, including strict Bearer token usage.

Walkthrough

Adds a Cloudflare MCP provider with docs, search, and execute actions. The provider supports OAuth2 and bearer-token authentication. Executors connect to Cloudflare’s MCP server, discover tools, invoke actions, normalize results, manage client lifecycle, validate credentials, and map failures to provider errors. Tests cover provider configuration, exposed actions, authenticated MCP requests, tool discovery, cancellation, and credential validation.

Sequence Diagram(s)

sequenceDiagram
  participant cloudflareMcpActionHandlers
  participant withCloudflareMcpClient
  participant CloudflareMCPServer
  cloudflareMcpActionHandlers->>withCloudflareMcpClient: Invoke MCP tool with arguments
  withCloudflareMcpClient->>CloudflareMCPServer: Send authenticated tools/call request
  CloudflareMCPServer-->>withCloudflareMcpClient: Return tool result
  withCloudflareMcpClient-->>cloudflareMcpActionHandlers: Normalize and return output

Loading

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows the required type(scope): subject format and accurately summarizes the new Cloudflare MCP provider.
Description check	✅ Passed	The description clearly matches the Cloudflare MCP provider changes, including tools, auth, validation, and verification.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/providers/cloudflare_mcp/executors.test.ts`:
- Around line 43-50: Update createMcpFetch so the authorization assertion
compares against the expected exact Bearer token rather than only matching the
“Bearer ” prefix. Reuse the test’s configured credential source where available,
ensuring incorrect or empty tokens fail the test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 15827156-2e46-48fa-9da6-7b6c91d400f7

📥 Commits

Reviewing files that changed from the base of the PR and between 698febc and 5dd03f0.

📒 Files selected for processing (5)

• src/providers/cloudflare_mcp/actions.ts
• src/providers/cloudflare_mcp/definition.test.ts
• src/providers/cloudflare_mcp/definition.ts
• src/providers/cloudflare_mcp/executors.test.ts
• src/providers/cloudflare_mcp/executors.ts

[coderabbitai]

🧹 Nitpick comments (2)

src/providers/cloudflare_mcp/executors.ts (2)

94-96: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract the client input contract into a named interface.

withCloudflareMcpClient uses an inline object type in a multi-line function signature. Define a provider-local CloudflareMcpClientInput interface and reuse it for listCloudflareMcpTools as appropriate.

As per coding guidelines, prefer named options/input interfaces when a function signature spans multiple lines or crosses module boundaries.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/providers/cloudflare_mcp/executors.ts` around lines 94 - 96, Define a
provider-local CloudflareMcpClientInput interface for the accessToken, fetcher,
and optional signal fields, then replace the inline input object type in
withCloudflareMcpClient with that interface and reuse it in
listCloudflareMcpTools where the same contract applies.

Source: Coding guidelines

---

67-75: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add tests for cancellation during an active MCP request.

The current test only covers a signal that is already aborted before execution. Add coverage that aborts while listTools or callTool is in flight and verifies the underlying fetch receives the signal and rejects without leaking the client.

Also applies to: 80-89

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/providers/cloudflare_mcp/executors.ts` around lines 67 - 75, Add tests
for active-request cancellation in listCloudflareMcpTools and the corresponding
callTool flow: abort the signal while listTools or callTool is pending, verify
the underlying fetch receives that signal and rejects, and confirm the MCP
client is cleaned up without leaking. Retain the existing pre-aborted-signal
coverage.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/providers/cloudflare_mcp/executors.ts`:
- Around line 94-96: Define a provider-local CloudflareMcpClientInput interface
for the accessToken, fetcher, and optional signal fields, then replace the
inline input object type in withCloudflareMcpClient with that interface and
reuse it in listCloudflareMcpTools where the same contract applies.
- Around line 67-75: Add tests for active-request cancellation in
listCloudflareMcpTools and the corresponding callTool flow: abort the signal
while listTools or callTool is pending, verify the underlying fetch receives
that signal and rejects, and confirm the MCP client is cleaned up without
leaking. Retain the existing pre-aborted-signal coverage.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a8c73cbd-841d-402e-bd5a-e1f064adca09

📥 Commits

Reviewing files that changed from the base of the PR and between 47bbbd0 and 1ed59d1.

📒 Files selected for processing (2)

• src/providers/cloudflare_mcp/executors.test.ts
• src/providers/cloudflare_mcp/executors.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/providers/cloudflare_mcp/executors.test.ts