TestingOps.ai

MCP tools for agents · MCP tool for agents

Cloudflare and TestingOps: find out why test traffic is blocked

Connect Cloudflare's MCP server with a read-only token and TestingOps agents can look into the rules and logs behind a blocked or failing test, so you know what to allow.

  • MCP tool for agents
  • Available
Request a demo Cloudflare's MCP servers
Connection
MCP tool for agents
Writes back
Only after a person approves
Last checked
7 Nov 2026

In short

Cloudflare and TestingOps in short

The Cloudflare connection is an MCP tool for TestingOps agents, set up with a Cloudflare API token that has read permissions on the zones agents should inspect.

When a run is stopped by a challenge or a block page, agents can look at the zone's settings and Workers logs through Cloudflare's API to say which part of the configuration is involved.

It is meant for diagnosis: TestingOps' agent guidance is to stop when bot protection blocks a run and never try to get around it, and you decide what access to grant.

What it does

What it does for your testing

  1. 1

    A blocked run explained

    Input
    A run that ended on a Cloudflare challenge or block page
    TestingOps
    Agents can read the zone's security settings and rules that apply to the tested address, if the token can read them
    Output
    The rule or setting to review for test traffic
  2. 2

    Errors from your Workers

    Input
    A failed step served by a Cloudflare Worker
    TestingOps
    Agents can read the Worker's logs for that time
    Output
    The Worker error behind the failure
  3. 3

    A precise access request

    Input
    The diagnosis above
    TestingOps
    Agents can write down what access the test runner needs, for example from which address
    Output
    A clear request for your team to approve and apply

Step by step

How it works

  1. Create a read-only API tokenIn Cloudflare, create an API token from the Read All Resources template, or a custom token with read permissions for the zones agents may inspect. Leave Client IP Address Filtering empty: filtered tokens do not work with the MCP server.
  2. Connect it in TestingOpsPick Cloudflare under Extra tools your agents may use in Integrations → API & MCP, paste the token into Cloudflare API token and select Connect.
  3. Agents look things up when a run is blockedWhen a run ends on a block or challenge, an agent can call Cloudflare's tools through TestingOps to see what applied; the token stays on the TestingOps server.
  4. People change the rulesAgents report what they found and what access the test runner needs. With a read-only token they cannot change your configuration.

Connect

Setup

  1. In Cloudflare, open My Profile → API Tokens and select Create Token.
  2. Pick the Read All Resources template, or Create Custom Token with read permissions for the zones agents may inspect.
  3. Leave Client IP Address Filtering empty, select Continue to summary and check it, then select Create Token and copy the token (shown once).
  4. In TestingOps, as customer admin, open Integrations → API & MCP, pick Cloudflare under Extra tools your agents may use (outgoing, over MCP), paste the token into Cloudflare API token and select Connect.

Documentation: Cloudflare's MCP servers

Where you connect it in TestingOps: Integrations → API & MCP → Extra tools your agents may use → Cloudflare

Use cases

Use cases

Staging behind bot protection

Trigger
Runs against staging stop at a challenge page
Uses
The zone's security settings and rules
Agent activity
Can identify which configuration likely applies to the test traffic, then stop as its guidance requires
Result
A specific request, such as allowing the test runner's address, for your team to apply
Condition
The token needs read permissions on that zone

A Worker error behind a failed step

Trigger
A step fails on a route that a Worker serves
Uses
Workers logs
Agent activity
Can read the Worker's errors for the failure time
Result
The Worker error quoted in the analysis

Check a cache or redirect rule

Trigger
A case sees an old page version or an unexpected redirect
Uses
The zone's cache and redirect configuration
Agent activity
Can read the rules that match the tested address
Result
A configuration cause to confirm before a defect is filed

Capabilities

Capabilities and limits

What is read

What the API token may read in your Cloudflare account, such as zone settings, security rules and Workers logs

What is produced

Diagnoses in agents' analysis; nothing is stored in TestingOps by the tool itself

Where it can write

Nothing with a read-only token. A token with edit permissions would let Cloudflare accept changes; such tools ask first in TestingOps, but an approved call still changes your account, so keep the token read-only.

How it connects

Cloudflare's API MCP server (https://mcp.cloudflare.com/mcp) with the API token in the Authorization header

Account and permissions

  • A Cloudflare API token from the Read All Resources template, or with read permissions on the zones agents may inspect, without IP filtering
  • Customer admin (or Manage integrations) rights in TestingOps; the tool is visible only to agents working on your organisation's projects

Limits

  • Diagnosis only: agents do not bypass bot protection or change rules to get through
  • Tokens with Client IP Address Filtering do not work with Cloudflare's MCP server
  • Agents running on Grok receive no MCP tools

Example

Example: how a team uses it

Illustrative scenario, not a customer story.

A team's staging site sits behind Cloudflare with bot protection on, and every run stops at a challenge. With Cloudflare connected through a read-only token, the agent can check the zone's settings and see that bot protection applies to all traffic, including the test runner.

The agent stops, as its guidance requires, and its report asks the team to allow the runner's address on staging. The team adds the rule, and the next run gets through.

Frequently asked questions

Will agents get around our bot protection?

No. When bot protection or a WAF blocks a run, TestingOps agents are guided to stop and say what access to grant. The Cloudflare tool helps them say it precisely; it is not used to get through.

Can agents change our Cloudflare rules?

Not with a read-only token, which the setup uses. Keep it that way: with edit permissions, tools that change your account ask first, but an approved call still changes it.

Why does our IP-restricted token not work?

Cloudflare's MCP server does not accept tokens with Client IP Address Filtering. Create the token without that section.

Do we need this to test sites behind Cloudflare?

No. Allowing the test runner is enough for runs to get through. The tool helps agents explain a block when one happens.

Next step

Request a demo to see how agents report a blocked run and what they need from your Cloudflare setup.

Request a demoMore mcp tools integrations