Cloudflare MCP OAuth: zone SSL / custom-hostname requests fail while other APIs work

4 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Status: fixed. A maintainer acknowledged the root cause: in the MCP server's OAuth setup, scopes and permissions are different sets, and scopes contain overlapping permissions, so some scopes were missed even when the UI showed full access. The maintainer said they would add the correct scopes, and a later retest confirmed the previously failing zone SSL / custom-hostname endpoints worked after a clean reauthorization cycle.

  The reauthorization cycle that worked in OpenAI Codex:

  1. codex mcp logout cloudflare-api
  2. Revoke the "Cloudflare MCP Server" app completely under Cloudflare profile settings (connected applications).
  3. Confirm the app is gone, then fully quit Codex.
  4. Reopen Codex and run the Cloudflare MCP login again.
  5. Approve the permissions in the browser flow, then close and reopen Codex before retesting.

  A simpler logout/revoke/login attempt left a stale session somewhere and the old 10000 / 9109 failures remained. After the clean cycle, GET /zones/{zone_id}/ssl/universal/settings, /ssl/certificate_packs, and the /custom_hostnames* endpoints worked; zones not provisioned for SSL for SaaS returned real product/quota errors instead of OAuth errors.

  Config used:

  jsonCopy to clipboard

  {
    "mcpServers": {
      "cloudflare-api": {
        "type": "http",
        "url": "https://mcp.cloudflare.com/mcp"
      }
    }
  }
  

  One UI note from the retest: in the new authorization flow the picker listed 82 scopes and "Full access" selected only 79/82, leaving three items unchecked (including at least one Zero Trust/PII-related scope). The reporter manually checked them to reach 82/82. That may be intentional, but the UI did not make the distinction clear.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Granted full access in both the MCP permission picker (78/78) and the Cloudflare OAuth screen, then tested via cloudflare.request() from the execute tool. Account, zone, Workers, D1, and Pages reads worked, but zone SSL and custom-hostname endpoints failed on two separate admin-level accounts.

  Source: https://github.com/cloudflare/mcp/issues/170 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @houmark tried on GitHub (Worked)

  Tested the same Cloudflare user/account against the local Wrangler CLI, which is also authenticated with Cloudflare OAuth and includes ssl_certs:write; the failing endpoints worked from the CLI, showing the problem is specific to the MCP OAuth grant.

  Source: https://github.com/cloudflare/mcp/issues/170#issuecomment-4863922977 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @houmark tried on GitHub (Worked)

  Performed a clean reauthorization cycle (codex mcp logout cloudflare-api, revoked the app in Cloudflare profile settings, fully quit and reopened Codex, logged in again, approved scopes, then quit and reopened). The failing SSL/custom-hostname endpoints then worked; a simpler logout/revoke/login had not.

  Source: https://github.com/cloudflare/mcp/issues/170#issuecomment-4870998016 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport