mcp-server-cloudflare

cloudflare/mcp-server-cloudflare

This project provides a collection of remote servers that let AI assistants inspect and manage Cloudflare services, including Workers, databases, headless browsers, and sandboxed containers. The biggest risk is that an AI processing untrusted content could be tricked into modifying or deleting your Cloudflare resources, reading sensitive account data, or reaching unintended API endpoints due to unencoded tool inputs.

What it can reach

Network

Connects to Cloudflare REST and GraphQL APIs, OAuth endpoints, remote MCP servers (*.mcp.cloudflare.com), and arbitrary external websites via the Browser Rendering service.

Secrets

Uses Cloudflare OAuth tokens, refresh tokens, and API tokens to authenticate requests and manage resources in your Cloudflare account.

Shell commands

Executes arbitrary shell commands inside an isolated, remote Cloudflare sandbox container.

Browser

Controls remote headless browser sessions to navigate to arbitrary URLs, crawl pages, render PDFs, and take screenshots.

Files

Reads, writes, and deletes files inside the remote Cloudflare sandbox container, and writes temporary configuration files under .wrangler/vitest during local testing.

Findings

1. MediumURL path traversal in Browser Rendering session and crawl tools

   apps/browser-rendering/src/tools/browser.tools.ts:623

   The get_crawl_result, cancel_crawl, and kill_browser_session tools accept job_id and session_id as unconstrained strings (z.string()) and interpolate them directly into the Cloudflare API URL path without encodeURIComponent or UUID validation. If an untrusted webpage induces the agent via prompt injection to pass relative path segments (../../...), the server will issue authenticated GET or DELETE requests to arbitrary Cloudflare API endpoints permitted by the user's token.

   Fix: Validate job_id and session_id as UUIDs (e.g., z.string().uuid()) and encode them with encodeURIComponent() before constructing the request path.

2. MediumURL path traversal in AutoRAG search tools

   apps/autorag/src/tools/autorag.tools.ts:76

   The search and ai_search tools accept rag_id as an arbitrary string (z.string()) and interpolate it directly into the API URL path passed to client.post(). A malicious prompt can supply ../ sequences in rag_id to send authenticated POST requests to other Cloudflare API endpoints.

   Fix: Validate rag_id against an allowed character pattern (such as z.string().regex(/^[a-zA-Z0-9_-]+$/)) and wrap it in encodeURIComponent() when building the URL path.

3. MediumUnencoded path parameters in CASB integration and asset tools

   apps/cloudflare-one-casb/src/api/cf1-integration.api.ts:44

   integrationIdParam and assetIdParam are defined as plain z.string() schemas in integrations.tools.ts (despite their descriptions stating they are UUIDs) and are concatenated directly into the API endpoint path without encodeURIComponent(). An attacker who controls tool arguments via prompt injection can use ../ or query parameters to redirect authenticated GET requests to other account API endpoints.

   Fix: Enforce .uuid() on integrationIdParam, assetIdParam, and assetCategoryIdParam, and use encodeURIComponent() when constructing endpoint paths.

4. MediumUnencoded path parameters in Workers Builds API calls

   apps/workers-builds/src/api/workers-builds.api.ts:27

   workerId and buildUUID are validated only as non-empty strings (z.string().min(1)) and interpolated directly into API URL paths in listBuilds, getBuild, and getBuildLogs. Supplying path traversal segments (../) or query characters (?, &) allows a caller to alter the target Cloudflare API endpoint or query parameters.

   Fix: Validate buildUUID with z.string().uuid() and encode both workerId and buildUUID with encodeURIComponent().

5. MediumUnencoded scriptName in Workers service lookup

   packages/mcp-common/src/shared-tools/workers.api.ts:40

   handleGetWorkersService interpolates scriptName directly into /workers/services/${scriptName} without URL-encoding or character validation. A crafted scriptName containing ../ or ? can traverse to other account-scoped Cloudflare API endpoints.

   Fix: Encode scriptName using encodeURIComponent(scriptName) and validate it against valid Worker script name rules.

6. MediumUnvalidated URL scheme in OAuth consent dialog links

   packages/mcp-common/src/workers-oauth-utils.ts:281

   renderApprovalDialog renders the client-supplied clientUri inside an <a href="..."> tag after passing it through sanitizeHtml(). Because sanitizeHtml() only escapes HTML characters (&, <, >, ", ') and does not check the URL scheme, a dynamically registered OAuth client supplying a javascript: URI as its client_uri could execute JavaScript in the user's browser if clicked.

   Fix: Validate that consent.clientUri and server.logo parse as valid URLs with an https: or http: protocol before rendering them in href or src attributes.

7. LowGraphQL query injection in graphql_type_details

   apps/graphql/src/tools/graphql.tools.ts:146

   fetchTypeDetails interpolates the typeName tool argument directly into a GraphQL query string (__type(name: "${typeName}")) without escaping quotes or using GraphQL variables. A crafted typeName can break out of the string literal and inject arbitrary GraphQL fields into the request.

   Fix: Pass typeName as a GraphQL variable (query TypeDetails($name: String!) { __type(name: $name) { ... } }) instead of interpolating it into the query string.

8. LowInconsistent truthiness check on DEV_DISABLE_OAUTH string variable

   packages/mcp-common/src/cloudflare-api.ts:11

   While devApiTokenModeEnabled in api-token-mode.ts checks env.DEV_DISABLE_OAUTH === 'true', getCloudflareClient and fetchCloudflareApi check if (env.DEV_DISABLE_OAUTH). Because environment variables in Wrangler are strings, setting DEV_DISABLE_OAUTH="false" evaluates as truthy and causes API requests to ignore the user's OAuth token in favor of DEV_CLOUDFLARE_API_TOKEN.

   Fix: Check env.DEV_DISABLE_OAUTH === 'true' consistently across cloudflare-api.ts and warp_diag_reader.ts.