Cloudflare Domains Toolkit

Client-neutral MCP tools

Use the same local stdio server from Cursor, Codex, or another MCP client instead of maintaining client-specific automation scripts.

Authoritative availability

Check one exact domain against the registry and return current availability, registration price, renewal price, and any rejection reason.

Domain idea search

Turn a phrase or partial name into Cloudflare-supported suggestions, while keeping discovery results separate from purchase decisions.

Short-lived quotes

Create a five-minute, single-use quote containing the exact domain, currency, term, initial charge, renewal price, and auto-renew state.

Human approval in the client

Use standard MCP elicitation to display the exact billable purchase after the final live price check and require an explicit true response.

Hard $20 limit

Calculate the complete initial charge in integer cents and reject any purchase above $20, including extensions with multi-year minimums.

Price-change protection

Recheck availability, price, and minimum term before approval. Any difference invalidates the quote and requires a new one.

Local secret storage

Read the token from macOS login Keychain or a process environment supplied by another operating system or secret manager.

Safe defaults

Reject premium and non-USD purchases, keep quotes in memory, disable auto-renewal, and never retry an ambiguous registration automatically.

Companion DNS CLI

Use cf-domains to list zones and records, create records, update selected fields, and delete only after a negative-default confirmation.

Separate least-privilege tokens

Keep billable Registrar permission apart from Zone and DNS permissions, with distinct macOS Keychain service names and portable secret-provider fallbacks.

Automated verification

Run focused domain, money, quote, approval, and replay tests plus a real MCP handshake and tool-discovery smoke test.

Name a new product

Brainstorm domain options with an AI, then confirm the final candidate against live Cloudflare registry data.

Check availability from chat

Ask whether a domain is available without opening Cloudflare or giving an AI access to a browser session.

Compare real prices

See registration and renewal costs before deciding which extension fits a small project.

Approval-gated registration

Let an agent prepare the purchase while keeping the final domain and price decision in your own client UI.

Learn MCP architecture

Study a compact server with typed tools, stdio transport, external API calls, elicitation, and destructive-action boundaries.

Build another guarded tool

Reuse the quote, recheck, approval, and adapter patterns for another local AI workflow with real-world consequences.

Connect a purchased domain

Inspect the new zone, add its website or verification records, and review the exact Cloudflare result from the terminal.

Give an AI readable DNS tools

Let many coding agents call a small, documented CLI instead of handing them a general-purpose raw Cloudflare API script.

Local runtime

Node.js

Runs the stdio child process, uses native fetch for Cloudflare requests, and reads macOS Keychain through the system security command.

Application boundaries

TypeScript

Keeps Registrar responses, quote state, money rules, approval details, and registration workflows explicit.

Client protocol

MCP SDK

Provides the stdio transport, tool discovery, tool calls, capability negotiation, results, and form elicitation.

Tool validation

Zod

Validates domain, quote ID, currency, and total cents before application code handles a request.

Registry and purchase boundary

Cloudflare Registrar API

Supplies domain suggestions, authoritative availability, pricing, extension metadata, and registration workflows.

DNS command interface

Commander and Prompts

Provide explicit subcommands and flags, readable help, password input, and negative-default confirmation before deletion.

Zone and record boundary

Cloudflare DNS API

Lists accessible zones and performs allow-listed create, partial update, and delete operations on DNS records.

Verification

Node test runner

Covers the safety policy with fake Registrar clients, exact money tests, and no real registration calls.