Cloudflare: MCP vendor profile
Cloudflare hosts remote MCP servers on Workers through the Agents SDK, ships the Workers OAuth Provider for both sides of MCP authorization, and fronts servers with MCP server portals and AI Gateway, as documented by the vendor. Cloudflare's MCP overview, last updated 27 Oct 2026, says remote MCP connections use Streamable HTTP with OAuth and local connections use stdio (developers.cloudflare.com).
At a glance
| Listed as | Cloudflare (Workers, Agents SDK, MCP portals, AI Gateway) |
|---|---|
| Type | Hosts and runtimes |
| Also covers | gateway or proxy, auth provider |
| Home | developers.cloudflare.com |
| Price | Workers Paid minimum |
| Read | 5 November 2026 |
What it does for this layer
Cloudflare advises MCP server authors to keep tool definitions out of the context window, noting that newer clients use Code Mode, where the model writes code that calls tools and loads only the definitions it needs (developers.cloudflare.com). Cloudflare recommends per-operation OAuth scopes and returning an insufficientScope() challenge for step-up authorization instead of requesting every scope up front (developers.cloudflare.com). Cloudflare says strict MCP clients validate tool calls against inputSchema and results against outputSchema, and advises defining both and returning matching structuredContent (developers.cloudflare.com).
The Workers OAuth Provider stores grants and tokens in a KV namespace bound as OAUTH_KV, and needs the global_fetch_strictly_public flag to fetch Client ID Metadata Documents (developers.cloudflare.com). Cloudflare's authorization guide keeps Dynamic Client Registration as an option for older MCP clients and supports upstream sign-in with GitHub, Google or another provider through beginUpstream() and finishUpstream() (developers.cloudflare.com). The Workers Paid plan has a minimum charge of 5 USD a month per account; the Workers Free plan allows 100,000 requests a day with 10 ms of CPU time per invocation (developers.cloudflare.com).
Cloudflare's Agents docs list pages for building an MCP client, an MCPClientManager, charging for MCP tools and MCP governance (developers.cloudflare.com). Cloudflare describes its connectivity cloud as delivering "60+ networking, security, and performance services" (www.cloudflare.com, vendor's own claim). Cloudflare describes MCP authorization as "a subset of OAuth 2.1" and builds it with @cloudflare/workers-oauth-provider, using the OAuthAuthorizationServer and OAuthResourceServer classes (developers.cloudflare.com).
Products and plans
| Product | What it does | Price |
|---|---|---|
| Workers and Agents SDK | Host remote MCP servers with createMcpHandler. | Workers Paid minimum; from 5 USD; Workers Free: 100,000 requests a day (source, as of 5 November 2026) |
| Workers OAuth Provider | Authorization server and resource server library for MCP on Workers. | price not read |
| MCP server portals | One endpoint in front of many remote MCP servers. | price not read |
| AI Gateway | Gateway for model traffic with analytics, caching and rate limits. | price not read |
Standards
| Standard | Part of it | Status | What the page says | Source |
|---|---|---|---|---|
| MCP | streamable HTTP | Supports | Remote MCP connections use Streamable HTTP. | developers.cloudflare.com |
| MCP | client ID metadata documents | Supports | The OAuth provider fetches CIMDs with global_fetch_strictly_public. | developers.cloudflare.com |
| MCP | dynamic client registration | Supports | DCR kept as an option for older clients. | developers.cloudflare.com |
| MCP | step-up authorization | Supports | insufficientScope() challenge for per-operation scopes. | developers.cloudflare.com |
Checks on its own domain
| Check | Domain | Result | Scanned | Method |
|---|---|---|---|---|
| Ora cached score | cloudflare.com | 82 of 100, grade B | 5 November 2026 | how it was taken |
| Cloudflare agent-readiness scan | cloudflare.com | 53 of 100, L4 Agent-Integrated; 8 of 15 counted checks passed | 5 November 2026 | how it was taken |
What it does not do
- Cloudflare does not list third-party MCP servers in a public registry of its own.
- Cloudflare portals do not front stdio-only servers until they are put behind HTTP.
Relation to Ora
Cloudflare, Inc. runs the Is Your Site Agent-Ready? scanner at isitagentready.com, which checks standards from robots.txt and Markdown negotiation to MCP, OAuth, Agent Skills and agentic commerce, while Ora's home page offers its own scan for a domain or an MCP server URL; this directory records both scores for each vendor domain (isitagentready.com and ora.ai, read 5 November 2026).