SoftTech AI Registry
Cloudflare · Workers Bindings MCP Server

Storage and database resource management tools

Write-capable Workers Bindings MCP tools through which an external AI application can create, update and delete Workers KV namespaces, R2 buckets, D1 databases and Hyperdrive configurations in a Cloudflare account, plus list/inspect them and query D1 databases. Workers themselves are read-only through this server.

Recorded characteristics

Function
Architecture: user → external AI application/model → the AI reasons and selects a Workers Bindings MCP tool → the Cloudflare-hosted MCP server receives the tool call → the Cloudflare API performs the authorised operation → the Cloudflare resource changes. Cloudflare describes its MCP servers as letting "your MCP client … make suggestions based on data, and even make those suggested changes for you"; the Workers Bindings MCP Server is not the reasoning agent. Hosting: Cloudflare-hosted remote MCP server at bindings.mcp.cloudflare.com/mcp, one of several separate managed remote MCP servers in Cloudflare's catalogue. Not customer-hosted, local or an example server. The official cloudflare/mcp-server-cloudflare GitHub repository is first-party implementation evidence for the hosted service. Tool inventory (22, source: official Workers Bindings README on GitHub): - Create: kv_namespace_create, r2_bucket_create, d1_database_create, hyperdrive_config_create - Update: kv_namespace_update (updates the namespace title), hyperdrive_config_edit (edit/patch) - Delete: kv_namespace_delete, r2_bucket_delete, d1_database_delete, hyperdrive_config_delete - Database query: d1_database_query - Read: kv_namespaces_list, kv_namespace_get, workers_list, workers_get_worker, workers_get_worker_code, r2_buckets_list, r2_bucket_get, d1_databases_list, d1_database_get, hyperdrive_configs_list, hyperdrive_config_get Account tools (accounts_list, set_active_account) are not listed in the Workers Bindings source and are not recorded. Workers KV: create namespace; update namespace title; delete namespace; list/get. No KV value writes, key deletion or namespace-content manipulation is established. R2: create bucket; delete bucket; list buckets and get bucket details. No object upload, deletion or modification is established. D1: create database; delete database; list/get databases; d1_database_query queries a D1 database (Cloudflare's example is a SELECT). Database creation and deletion independently establish action-taking; SQL mutation is not credited. Hyperdrive: create, edit (patch), delete, list and get Hyperdrive configurations. The persistent object is the Cloudflare Hyperdrive configuration; the MCP operation is not claimed to modify the external database behind Hyperdrive. Workers boundary: Workers are READ-ONLY through this server — list Workers, read Worker details, read Worker code. It is not claimed to create, modify, deploy, delete or execute Workers. Functionality of Cloudflare's general API MCP server is not inherited.
Data access
Read access: Worker details and source code, KV namespace, R2 bucket, D1 database and Hyperdrive configuration metadata in the active Cloudflare account, and D1 database query results via d1_database_query. External action (no): every positively established persistent effect lands in Cloudflare-managed resources or configuration — KV namespaces, R2 buckets, D1 databases and Hyperdrive configurations. Hyperdrive may connect to an external database, but creating or editing the Hyperdrive configuration is a Cloudflare-side effect; no MCP operation is established as modifying the external database. External effects of the general Cloudflare API MCP server are not inherited. Product-boundary note: the product is the Workers Bindings MCP Server, while the managed objects belong to Cloudflare infrastructure services. These documented infrastructure-management operations are treated as internal to the Cloudflare service estate; same-vendor product naming alone does not force external = yes. This does not reverse #142, which involved a workflow orchestrator executing actions against separate application systems through configured connections; #146 directly manages Cloudflare infrastructure through Cloudflare's own management plane.
Actions
Can take actions
External actions
No
Human confirmation
Not established
Permission basis
User permissions
Administrative control
Authentication: Cloudflare OAuth built into the server; when connecting, the user is redirected to Cloudflare to authorise access and select the permissions to grant. Bearer API-token authentication documented for the general Cloudflare API MCP server is not attributed to Workers Bindings. Permission basis (user_permissions): Workers Bindings positively establishes user-authorised OAuth access. Account tokens, service tokens or separate service-account authority were not established for this server (they are documented for the general API MCP server only). Permission detail: the user selects and grants permissions during Cloudflare OAuth. Each request gets a fresh server with request-scoped authentication and account context. Bindings-specific permission names and OAuth scopes are not established and are not recorded. Operations execute within the authenticated, request-scoped Cloudflare account context and granted permissions; no categorical statement is made about whether the server can exceed the user's permissions. Account scope: tools operate against the Cloudflare account in the request-scoped account context ("in your Cloudflare account"). The Workers Bindings source does not document an account-selection tool. No zone-level scope is claimed. Human confirmation (not_established): no Cloudflare-enforced confirmation for create, update, delete or query. Approval prompts in Claude, Cursor or other MCP clients are not Cloudflare confirmation. Destructive operations: kv_namespace_delete, r2_bucket_delete, d1_database_delete, hyperdrive_config_delete. No Cloudflare-enforced confirmation, restore/recovery behaviour or additional safeguard is established. Audit/logging: MCP-specific tool-call logging is not publicly established. Cloudflare has ordinary account Audit Logs and a separate Audit Logs MCP server; it is not claimed that every #146 tool call appears in account Audit Logs.
Default state
Conditional
Availability
Default conditional: requires a Cloudflare account, an external MCP-capable AI application, a connection to the Workers Bindings MCP Server, Cloudflare OAuth, the applicable permissions granted, and the applicable account context. No per-tool enablement controls are documented. Lifecycle: active. No Beta, Preview or deprecated label was found for the Workers Bindings MCP Server; this is not a claim that Cloudflare calls it generally available. The README states "This MCP server is still a work in progress, and we plan to add more tools in the future." Cloudflare operates a catalogue of managed remote MCP servers using Streamable HTTP at /mcp (/sse retained as an alias). Excluded Cloudflare servers: Workers Builds (read-only: list builds, get build, get build logs), DNS Analytics (read-only; DNS changes appear only through the general API MCP server), CASB, DEX, Audit Logs, Observability, Logpush, AI Gateway, GraphQL, Radar, Browser Run, Container, Documentation and Agents SDK documentation servers, and the general Cloudflare API MCP server.
Licensing
Available to Cloudflare accounts using the relevant Workers Platform services; no separate MCP-specific licence was established.
External model or provider
No fixed model or provider. The external AI application supplies the reasoning model; Workers AI is not the reasoning provider.
Limitations and uncertainty
1. No dedicated Cloudflare documentation page contains the full Workers Bindings tool inventory. 2. The tool inventory relies on the official Cloudflare GitHub README. 3. Bindings-specific permission and OAuth scope names are not established. 4. Account-token support is not established for Workers Bindings. 5. No Cloudflare-enforced confirmation for destructive operations. 6. Delete recovery/restore behaviour is not established. 7. MCP-specific tool-call logging is not established. 8. D1 SQL mutation: d1_database_query executes queries against a D1 database; Cloudflare's example is a SELECT; whether persistent SQL mutation is permitted is not established and is not credited. 9. No demonstrated end-to-end run. 10. Product-boundary interpretation: infrastructure-management operations treated as internal to the Cloudflare service estate. 11. Account selection for multi-account users is not documented in the Workers Bindings source. 12. Cloudflare describes the server as a work in progress with more tools planned.

Evidence