CloudPortal · AI & MCP
Ask your AI about the infrastructure you manage in CloudPortal
With the CloudPortal MCP connection, a compatible AI assistant can read DNS zones and records in your organization's Cloudflare DNS. AI can prepare a DNS change that you review in the portal.
Look up the records for a domain, find the right zone or ask for a change. Nothing is written to DNS until someone with permission has approved the proposal.
Try an example
Pick a question. On the right you can see what the AI assistant retrieves through CloudPortal and how it answers.
Read the DNS records in the example.com zone.
| Name | Type | Content | TTL |
|---|---|---|---|
| www.example.com | CNAME | web.example.net | Auto · proxied |
www.example.com has a CNAME record pointing to web.example.net. Traffic goes through the Cloudflare proxy and the record uses automatic TTL.
Read the zones in the organization's Cloudflare account.
| Zone | Status | Records |
|---|---|---|
| example.com | Active | 24 |
| shop.example | Active | 11 |
| intranet.example | Active | 6 |
The connection can see three active zones: example.com, shop.example and intranet.example. No other zones are visible, because the connection only has access to Example Ltd.
Created a change proposal in CloudPortal.
Change proposal
Awaiting reviewI've prepared a proposal: the CNAME record for www.example.com should point to web2.example.net instead of web.example.net. Nothing changes until someone with permission approves the proposal in CloudPortal.
View the proposal in the portal
Change CNAME for www.example.com
What is MCP?
The Model Context Protocol (MCP) is an open standard for how an AI assistant connects to tools and data. Instead of pasting information into the chat, the assistant can query a system that supports MCP directly, with the permissions you have given it.
CloudPortal supports MCP for Cloudflare DNS. When you connect your AI assistant, you sign in to CloudPortal as usual and choose which organizations and permissions the connection should have. The assistant never sees more than you are allowed to see yourself.
What can I ask?
The connection covers DNS zones and records in your organization's Cloudflare DNS. A few examples of questions that work:
- ”Which DNS records do we have for www.example.com?”
- ”Which zones can you see for our organization?”
- ”Does example.com have an MX record, and where does it point?”
- ”Prepare a change so that www.example.com points to web2.example.net.”
- ”Has the proposal I created this morning been approved?”
Zones on CloudPortal's name servers, certificates, email security and App Hosting are managed in the portal. They are not part of the MCP connection.
Which clients are supported?
We have tested the MCP connection with these AI clients. For ChatGPT, this applies to the Business and Enterprise plans.
Tested clients
- ChatGPT Business
- ChatGPT Enterprise
- Claude (claude.ai)
- Claude Code
- Codex
- VS Code
- Cursor
Other AI clients that support MCP with sign-in may work, but we have not tested them. Some clients require an administrator to allow MCP servers in the client's settings.
How are changes handled?
AI can prepare a DNS change that you review in the portal. Here is how it works:
- 1
The assistant creates a proposal
The proposal shows which record changes, the current value and the proposed value. Nothing is written to DNS at this stage.
- 2
Someone with permission reviews it in CloudPortal
The proposal appears under Cloudflare DNS in the portal. Someone with the right permission approves or rejects it. By default, the person who created the proposal cannot approve it themselves.
- 3
The change is applied and logged
The change is written only after approval. Every call from the AI assistant is logged, including calls that are refused, and appears in your organization's log.
Your organization's AI policy decides
AI is turned off until your organization enables it in its AI policy. There you choose whether AI connections may only read, may propose changes, or whether changes need approval from two people. The policy can also be managed by your IT provider.
Sensitive records always wait for a person
Changes to the zone apex and to MX, NS, CAA, SPF, DMARC and DKIM records always need approval from a person. The same applies to every deletion.
Direct changes, if you choose them
An administrator in your organization can choose to let ordinary changes be applied directly, without review. The setting is off by default and requires a fresh sign-in to turn on.
- Applies only to new records and changes to ordinary records.
- Sensitive records and all deletions still wait for a person.
- The response to every proposal shows whether a person or the policy made the decision.
How to connect
Read the connection guideAdd CloudPortal to your AI client
You add CloudPortal as an MCP server in the client. The connection guide shows the steps for each tested client.
Sign in with your usual account
You sign in through CloudPortal, with the same account and SSO as always. You never hand passwords or API keys to the AI assistant.
Choose organization and permissions
You choose which organizations the connection covers and what it may do. It can never get more than you are allowed yourself.
The connection expires on its own
A connection lasts 30 days and ends earlier if it hasn't been used for 14 days. You can also end it whenever you like.
The portal's MCP and the documentation
The MCP connection gives your AI assistant access to your organization's DNS in CloudPortal and requires sign-in. The documentation is open to everyone and needs no connection. It is also available as a text index that AI tools can read.
Frequently asked questions
Can the AI assistant change DNS without our approval?
Not by default. Changes become proposals that someone with permission approves in CloudPortal. An administrator can enable direct changes for ordinary records, but sensitive records and deletions always wait for a person.
What information can the AI assistant see?
Only what the connection has been granted: DNS zones and records in Cloudflare DNS for the organizations you chose, and never more than your own permissions. What then happens to the answers in the AI service is governed by the terms of the service you use.
Do we need to create an API key?
No. You sign in through CloudPortal as usual when you connect the client, and the connection only gets the permissions you choose.
Does it work with ChatGPT?
Yes, with ChatGPT Business and ChatGPT Enterprise. They are among the tested clients above, together with Claude, Claude Code, Codex, VS Code and Cursor.
Do we have to use AI to use CloudPortal?
No. AI stays off until your organization turns it on, and everything the connection can do can also be done directly in the portal.
How do we get started?
Ask for an MCP walkthrough. We'll show the connection with sample data and go through what your organization needs, from AI policy to the clients you use.
See the MCP connection in your own context
We'll show how an AI assistant reads your zones and prepares a change that you review in the portal.