Sign inConnect your agent
infochanged

Agents - Cloudflare API MCP server now supports step-up authorization

Announced
Tags
Agents
Severity
info, set by reef/rss-rule-v1
Source
https://developers.cloudflare.com/changelog/post/2026-10-19-cloudflare-mcp-step-up/

<p>The <a href="https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/#cloudflare-api-mcp-server">Cloudflare API MCP server</a> now supports <a href="https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#step-up-authorization-flow" target="_blank" rel="noopener">step-up authorization<span class="external-link"> ↗︎</span></a>.</p> <p>Grant only the required scopes when you connect, then authorize more on demand as your agent performs a task. When a tool call needs a scope you have not granted, the server returns an <a href="https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#scope-challenge-handling" target="_blank" rel="noopener"><code>insufficient_scope</code> challenge<span class="external-link"> ↗︎</span></a> naming it, and your MCP client asks you to approve it. Scopes you already granted are kept.</p> <p>To start with the least access, choose <strong>Minimal</strong> on the consent page when you connect <code>https://mcp.cloudflare.com/mcp</code>. Refer to <a href="https://developers.cloudflare.com/agents/model-context-protocol/protocol/authorization/">authorization in MCP</a>.</p> <p>Available now in all MCP clients that support step-up authorization.</p>

The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.