# cloudflare-mcp probes, 2026-09-18T06:16Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://docs.mcp.cloudflare.com/mcp
$ curl -sS -i -m 25 -X POST https://docs.mcp.cloudflare.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Fri, 18 Sep 2026 06:16:41 GMT
content-type: text/event-stream
access-control-allow-origin: *
cache-control: no-cache, no-transform
access-control-allow-headers: Content-Type, Accept, Authorization, MCP-Protocol-Version, Mcp-Method, Mcp-Name, cf-account-id
access-control-allow-methods: POST, OPTIONS
access-control-expose-headers: MCP-Protocol-Version
access-control-max-age: 86400
server: cloudflare
cf-ray: a3ce392e4d3b586a-BOS

event: message
data: {"result":{"protocolVersion":"2025-06-18","capabilities":{"tools":{"listChanged":true},"prompts":{"listChanged":true}},"serverInfo":{"name":"docs-ai-search","version":"0.4.13"}},"jsonrpc":"2.0","id":1}



## 1b. MCP tools/list, POST https://docs.mcp.cloudflare.com/mcp (initialize answered 200; the session id from step 1 is sent back when the server issued one)
$ curl -sS -i -m 25 -X POST https://docs.mcp.cloudflare.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -H 'MCP-Protocol-Version: 2025-06-18' [-H 'Mcp-Session-Id: <from step 1>'] -d '<tools/list>'
# tools counted over the whole response before the cut, by occurrences of "inputSchema": 2 (0 means no list came back)
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Fri, 18 Sep 2026 06:16:42 GMT
content-type: text/event-stream
access-control-allow-origin: *
cache-control: no-cache, no-transform
access-control-allow-headers: Content-Type, Accept, Authorization, MCP-Protocol-Version, Mcp-Method, Mcp-Name, cf-account-id
access-control-allow-methods: POST, OPTIONS
access-control-expose-headers: MCP-Protocol-Version
access-control-max-age: 86400
server: cloudflare
cf-ray: a3ce39322a40df84-BOS

event: message
data: {"result":{"tools":[{"name":"search_cloudflare_documentation","description":"Search the Cloudflare documentation.\n\n\t\tThis tool should be used to answer any question about Cloudflare products or features, including:\n\t\t- Workers, Pages, R2, Images, Stream, D1, Durable Objects, KV, Workflows, Hyperdrive, Queues\n\t\t- AI Search, Workers AI, Vectorize, AI Gateway, Browser Run\n\t\t- Zero Trust, Access, Tunnel, Gateway, Browser Isolation, WARP, DDOS, Magic Transit, Magic WAN\n\t\t- CDN, Cache, DNS, Zaraz, Argo, Rulesets, Terraform, Account and Billing\n\n\t\tResults are returned as semantically similar chunks to the query.\n\t\t","inputSchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"query":{"type":"string"}},"required":["query"]},"annotations":{"title":"Search Cloudflare docs","readOnlyHint":true},"outputSchema":{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{"results":{"type":"array","items":{"type":"object","properties":{"similarity":{"type":"number","description":"Similarity score from AI Search"},"id":{"type":"string","description":"Source file ID"},"url":{"type":"string","description":"Developer documentation URL"},"title":{"type":"string","description":"Documentation page title"},"text":{"type":"string","description":"Matching documentation chunk text"}},"required":["similarity","id","url","title","text"],"additionalProperties":false}}},"required":["results"],"additionalProperties":false}},{"name":"migrate_pages_to_workers_guide","description":"ALWAYS read this guide before migrating Pages projects to Workers.","inputSchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","properties":{}},"annotations":{"title":"Get Pages migration guide","readOnlyHint":true}}]},"jsonrpc":"2.0","id":2}



## 2. Protected-resource metadata, GET https://docs.mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp (not named in the challenge; the RFC 9728 default path)
HTTP/1.1 200 Connection Established

HTTP/2 404 
date: Fri, 18 Sep 2026 06:16:43 GMT
content-type: text/plain;charset=UTF-8
content-length: 9
access-control-allow-origin: *
access-control-allow-headers: Content-Type, Accept, Authorization, MCP-Protocol-Version, Mcp-Method, Mcp-Name, cf-account-id
access-control-allow-methods: POST, OPTIONS
access-control-expose-headers: MCP-Protocol-Version
access-control-max-age: 86400
server: cloudflare
cf-ray: a3ce3935c9bc3d15-BOS

Not Found

## 3. Authorization-server metadata: no authorization_servers in step 2