Cloudflare — can an agent use it?
Seventeen official MCP servers, an OpenAPI-backed v4 API and first-party x402/MPP support make this the most agent-usable vendor in the index. Conflict noted: Cloudflare also sells the rival Agent Readiness score and gates AI crawlers on customer sites.
Can an agent get correct information?
Machine-readable surface — 9.5/10
developers.cloudflare.com ships a hub llms.txt plus a per-product llms.txt for every product, JSON-LD schema.org on doc pages, changelog RSS at /changelog/rss/index.xml, and an MCP server card at /.well-known/mcp/server-card.json listing 16 endpoints. source
Information retrieval quality — 9/10
Plan prices are plain text on the public page (Pro $20/mo annual or $25/mo monthly, Business $200/$250, Zero Trust $7/user/mo) and hard limits are published (1,200 API requests per 5 minutes, 50 user tokens, 500 account tokens); only Enterprise and the new pay-per-use rates are 'contact sales'. source
Documentation for machines — 9.3/10
Public OpenAPI schemas in github.com/cloudflare/api-schemas drive per-language executable examples (Node/Go/Python/curl), a dated changelog with RSS, and a deprecations table giving 6-18 months between announcement and end-of-life. source
Can an agent do the job?
Action coverage — 9/10
The v4 REST API covers DNS, Workers, R2, KV, D1, Pages, WAF/Rulesets, Zero Trust and analytics, and even commercial actions — POST /accounts/{id}/subscriptions and POST /zones/{id}/subscription create paid plans — leaving few dashboard-only gaps. source
Agent protocol support — 10/10
17 official Cloudflare-hosted MCP servers (mcp.cloudflare.com/mcp plus 16 product servers) with OAuth permission selection or bearer API tokens, advertised through a machine-readable /.well-known/mcp/server-card.json — the reference implementation of the anchor_10 case. source
Access & auth friction — 9.3/10
Self-serve API tokens issue in minutes with per-resource permissions, TTLs and IP restrictions, and the MCP servers complete an OAuth consent an agent can drive; the legacy Global API Key still exists and Service Key auth was deprecated 19/03/2026 (EOL 30/09/2026). source
Agent payment capability — 8.5/10
Cloudflare ships first-party agent payment rails — x402 (x402-hono, @x402/fetch, agents/x402, USDC across Base/Ethereum/Solana and 7 more chains) and Stripe/Tempo's MPP — plus programmatic subscription creation, but its own invoices still settle through a human-added card/PayPal and the Monetization Gateway announced 01/07/2026 is still waitlist-only. source
Cost & rate fairness — 8.5/10
No agent-versus-human price discrimination and famously generous free tiers, but the 1,200-requests-per-5-minutes ceiling is cumulative across dashboard, API key and token per user, and raising it requires an Enterprise support request. source
Will it still work next quarter?
Permission & ToS stance — 8.5/10
cloudflare.com/robots.txt publishes 'Content-Signal: ai-train=yes, search=yes, ai-input=yes' and name-checks GPTBot, Claude-Web and PerplexityBot as allowed, and Cloudflare co-authors the Web Bot Auth IETF draft — offset by its role as the web's bot gatekeeper, blocking mixed-use AI crawlers by default on ad-bearing pages for free and new customers from 15/09/2026. source
Reliability & continuity — 8.5/10
Statuspage v2 JSON at cloudflarestatus.com/api/v2/status.json plus a v4 API stable since 2016 and published deprecation notice periods, against two multi-hour global incidents in nine months — 18/11/2025 and the 6h07m BYOIP withdrawal on 20/02/2026 that pulled 1,100 of 4,306 prefixes. source
Sources
Point-in-time assessment — services change terms, prices and APIs often. That volatility is itself scored under Reliability & continuity. Re-verified at least quarterly.
- developers.cloudflare.com/agents/model-context-prot… — Official docs — list of 17 Cloudflare-hosted MCP servers (mcp.cloudflare.com/mcp, docs, bindings, builds, observability, radar, containers, browser, logs, ai-gateway, autorag, auditlogs, dns-analytics, dex, casb, graphql, agents), OAuth or bearer API token auth (accessed 2026-07-25)
- developers.cloudflare.com/agents/tools/payments — Official docs — Agentic Payments: x402 and Machine Payments Protocol (MPP) supported in the Agents SDK; x402 sub-page lists x402-hono, @x402/fetch, @x402/evm, agents/x402 and the Coinbase facilitator at x402.org/facilitator (accessed 2026-07-25)
- blog.cloudflare.com/agent-readiness — Cloudflare blog, 17/04/2026 — launch of the Agent Readiness score and isitagentready.com; four dimensions (discoverability, content, bot access control, capabilities), checks Content Signals, Web Bot Auth, llms.txt, MCP Server Card, WebMCP, Agent Skills; also exposed via URL Scanner API agentReadiness option and Radar (accessed 2026-07-25)
- developers.cloudflare.com/fundamentals/api/referenc… — Official docs — API deprecation table; Service Key auth deprecated 19/03/2026 EOL 30/09/2026, DNS Analytics API deprecated 09/12/2025 EOL 01/12/2026; notice periods 6-18 months (accessed 2026-07-25)
- developers.cloudflare.com/fundamentals/api/referenc… — Official docs — API rate limits: 1,200 requests/5 min per user cumulative across dashboard, API key and token, HTTP 429 on breach; 200/s per IP; GraphQL max 320/5 min; 50 user / 500 account token quota (accessed 2026-07-25)
- cloudflare.com/robots.txt — Official — robots.txt carries 'Content-Signal: ai-train=yes, search=yes, ai-input=yes', Allow: / for all agents and explicit allowances for GPTBot, Claude-Web, Anthropic-AI, PerplexityBot; points crawlers at /llms.txt (accessed 2026-07-25)
- cloudflare.com/website-terms — Official Terms of Use (last updated 01/08/2025) — §8 restricts bot scraping for AI training except where robots.txt permits the user agent; §7 prohibits circumventing documented API call limits (accessed 2026-07-25)
- cloudflare.com/plans — Official pricing — Free $0, Pro $20/mo annual or $25/mo monthly, Business $200/$250, Zero Trust pay-as-you-go $7/user/mo, Enterprise custom via sales (accessed 2026-07-25)
- blog.cloudflare.com/cloudflare-outage-february-20-2… — Cloudflare post-mortem — 20/02/2026 outage, 6h07m (17:48-23:03 UTC), 1,100 of 4,306 BYOIP prefixes withdrawn by a buggy cleanup task; affected CDN, Spectrum, Magic Transit, Dedicated Egress (accessed 2026-07-25)
- blog.cloudflare.com/monetization-gateway — Cloudflare blog, 01/07/2026 — Monetization Gateway announced (waitlist, no GA date): charge any caller for pages, datasets, APIs or MCP tool calls, settled in stablecoins over x402, sub-cent micropayments (accessed 2026-07-25)
- techcrunch.com/2026/07/01/cloudflares-new-policy-pu… — Third-party — from 15/09/2026 Cloudflare blocks mixed-use AI crawlers by default on ad-bearing pages for new customers, new sites and all existing free customers; pay-per-crawl succeeded by pay-per-use with Ceramic.ai and You.com (accessed 2026-07-25)
- cloudflarestatus.com/api/v2/status.json — Official — Statuspage v2 JSON status API, machine-readable; verified live 25/07/2026 (accessed 2026-07-25)