Cloudflare API MCP Server Adds Step-Up Authorization: Grant Scopes Only When Needed!

Hi everyone, it's Shii-chan! Deciding what permissions to give an agent can feel a little worrying, right? There's a nice update for that.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, the Cloudflare API MCP server now supports step-up authorization, a flow defined in the Model Context Protocol (MCP) specification.

The story so far

Granting every scope a task might need up front means handing over permissions that may never be used. With this support, you can start with only what you need.

What changes

You grant only the required scopes when you connect, and approve additional ones on the spot when the agent needs them during a task. Starting from least privilege gets much easier!

Dive Deep

Here is how it flows:

• Connect and grant only the scopes you need
• When a tool call needs a scope you have not granted, the server returns an insufficient_scope challenge naming it
• Your MCP client asks you to approve that scope
• Scopes you already granted are kept

To start with the least access, choose "Minimal" on the consent page when you connect to this URL:

https://mcp.cloudflare.com/mcp

It is available in all MCP clients that support step-up authorization. See the MCP authorization docs from Cloudflare for details.

Wrap-up

• Cloudflare API MCP server supports step-up authorization
• Missing scopes are signaled with insufficient_scope and the client asks for approval
• Already granted scopes are kept
• Choose "Minimal" on the consent page to start with least access

If you let agents operate Cloudflare and care about tight permissions, this one is for you!