Agent MCP Directory

Cloudflare API MCP server adds step-up authorization

The Cloudflare API MCP server now asks for additional scopes when an operation needs them, the step-up flow described in the MCP authorization spec. Reported 19 October 2026 by developers.cloudflare.com, read 4 November 2026; products involved: Cloudflare. The full text of Cloudflare API MCP server adds step-up authorization is at the source linked below.

What it changes in the data held here

517 endpoints in the directory offer dynamic client registration, 16 publish OAuth metadata without a registration endpoint, and 191 state client ID metadata document support. 533 endpoints stop at a sign-in challenge, so this directory sees their auth route but not their tools.

Cloudflare on this directory's rubric, as read on 4 November 2026: remote transport: Streamable HTTP only; oauth with client registration: yes, DCR and CIMD; per-tool auth scoping: yes, at the portal.

The connector log shows which protocol revisions the directory's reachable servers answered with: 189 on 2025-11-25, 40 on 2025-06-18, 16 on 2026-07-28, 11 on 2025-03-26, 9 on 2024-11-05. Servers on 2025-11-25 still use the initialize handshake that 2026-07-28 removes.

Source: developers.cloudflare.com, a primary source, dated 19 October 2026 and read 4 November 2026. The opening paragraph above is the item; the figures in this section come from this directory's own run of 4 November 2026.