MCP Abilities - Cloudflare

Cloudflare abilities for MCP. Inspect and clear Cloudflare cache for WordPress sites.

Tested up to: 7.0 Stable tag: 1.0.19 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

What It Does

Cloudflare abilities for MCP. Inspect and clear Cloudflare cache for WordPress sites.

This plugin is part of the Devenia MCP abilities ecosystem. It gives an MCP-capable agent a focused, authenticated way to work with Cloudflare work inside WordPress through MCP.

Example: "Handle this WordPress maintenance task directly." - The agent can inspect the site, call the relevant ability, and return the result without making the human click through wp-admin for every step.

The Real Workflow

In practice, the human should not have to memorize every ability name.

The normal pattern is:

1. install the base MCP stack
2. install only the add-ons the site actually needs
3. let the agent discover the available abilities
4. give the agent a clear task with boundaries
5. verify the result in WordPress

The human's job is mostly to describe the goal. The agent's job is to figure out the mechanics.

Why This Feels Different

Most WordPress automation still leaves the repetitive part to the human.

This plugin is different because the agent can act inside the site through a narrow, authenticated ability surface:

• inspect current site state before changing anything
• run the specific action needed for the task
• return structured results that are easy to verify
• keep the workflow inside WordPress instead of a separate checklist

That changes the experience from:

• Here is what you should do in wp-admin

to:

• Tell the agent what needs doing, and let it carry out the work

Before vs After

Before

• ask the AI what to do
• copy the answer into WordPress by hand
• click through wp-admin for the repetitive bits
• postpone maintenance because the task is tedious

After

• tell the agent what needs doing
• let it inspect the relevant WordPress state
• let it run the targeted ability
• verify the result and move on

Who It Is For

This is a good fit for:

• agencies managing WordPress sites with AI-assisted maintenance
• operators who want agents to do real WordPress work instead of producing instructions
• teams already using MCP Expose Abilities
• sites where this WordPress area is updated often enough to deserve automation

It is especially useful when the manual version is repetitive enough that important maintenance gets delayed.

Documentation

Start with the plugin page and stable package:

• Stable plugin download
• Plugin page

Start Here

If you are new to the stack, use this order:

1. Use WordPress 6.9 or newer, where the Abilities API provides the ability registry, schemas, and permission callbacks.
2. Install the MCP Adapter to expose registered WordPress abilities through MCP.
3. Install MCP Abilities - Cloudflare.
4. Configure Cloudflare credentials through cloudflare/configure-credentials, the official plugin settings, or the supported WordPress constants.
5. Confirm the new abilities appear in discovery before making a cache change.

If you skip base-stack verification and start with add-ons immediately, troubleshooting gets harder than it needs to be.

Dependencies

• WordPress Abilities API — required through WordPress 6.9 or newer; it registers, describes, validates, and permission-checks the abilities exposed by this add-on.
• WordPress MCP Adapter — required for MCP access; it turns registered WordPress abilities into MCP tools that an authenticated client can discover and call.

Cloudflare API work also needs a configured API token or key. Cloudflare for WordPress can provide those values, or the supported WordPress constants can provide them directly.

Abilities (9)

Ability	Description
cloudflare/configure-credentials	Validate and store credentials through the official Cloudflare plugin without returning the secret
cloudflare/clear-cache	Purge entire Cloudflare cache or specific URLs
cloudflare/get-zone	Get active Cloudflare zone details
cloudflare/get-development-mode	Read current Cloudflare Development Mode status
cloudflare/get-cache-settings	Read relevant Cloudflare cache/performance zone settings
cloudflare/get-cache-rulesets	Read Cloudflare rulesets and the cache-settings entrypoint
cloudflare/test-url-cache-status	Probe public URLs and report Cloudflare cache headers
cloudflare/ensure-wordpress-html-cache-rule	Create or update a conservative anonymous WordPress HTML cache rule
cloudflare/set-development-mode	Enable or disable Cloudflare Development Mode

Usage Examples

Clear entire cache

{
  "ability_name": "cloudflare/clear-cache",
  "parameters": {
    "purge_everything": true
  }
}

Clear specific URLs

{
  "ability_name": "cloudflare/clear-cache",
  "parameters": {
    "purge_everything": false,
    "files": [
      "https://example.com/page-1/",
      "https://example.com/page-2/"
    ]
  }
}

Clear a URL prefix

Use this when Cloudflare accepts an exact URL purge but the final HTML object remains cached.

{
  "ability_name": "cloudflare/clear-cache",
  "parameters": {
    "purge_everything": false,
    "prefixes": [
      "https://example.com/page/"
    ]
  }
}

Changelog

1.0.19

• Added a confirmed credential configuration ability that validates access before storing settings through the official Cloudflare plugin.
• The credential is never included in the ability response.
• Calls without confirmation return a structured refusal before any credential validation or storage.

1.0.17

• Changed the shared cache Adapter to treat an unconfigured Cloudflare edge as optional when a prior local cache Adapter has already returned a successful purge receipt.

1.0.16

• Added one reusable, bounded deep-purge implementation shared by the MCP ability and cache-coherence hooks.
• Added generic frontend URL invalidation through HTML prefix purges, including structured success and failure results.
• Added a post-completion plugin install/update observer that purges the public HTML root prefix and records bounded status without interrupting the upgrader.

1.0.15

• Removed organization-specific runtime identity from cache probes and managed WordPress HTML cache rules.
• Existing equivalent rules are recognized by policy behavior rather than a branded label or reference.

1.0.13

• Changed cloudflare/clear-cache so extensionless/html URLs passed in files are automatically purged as Cloudflare prefixes.
• Exact file purges are still used for asset URLs, and mixed HTML/assets input is split into the correct purge operations.

1.0.12

• Fixed prefix purge normalization so callers can pass either full URLs or Cloudflare host/path prefixes.

1.0.11

• Added URL prefix purge support for cases where exact URL purge reports success but cached HTML variants remain HIT.
• Added structured purge metadata to cloudflare/clear-cache responses, including purge type, payload keys, Cloudflare purge ID, and auth mode.

1.0.10

• Added cloudflare/ensure-wordpress-html-cache-rule with dry-run by default.
• The new rule preserves existing Cloudflare cache rules and only targets anonymous public WordPress HTML requests.

1.0.9

• Added read-only cache diagnostics for Cloudflare zone cache settings.
• Added read-only ruleset inspection for the http_request_cache_settings entrypoint.
• Added URL cache-status probes that report cf-cache-status, cache-control, age, set-cookie, and related headers.

1.0.8

• Fixed Cloudflare API Token installs where the official Cloudflare plugin stores the token in cloudflare_api_key.
• Matched the official Cloudflare plugin's Global API Key vs API Token credential-format detection.
• Retried cache purge requests with alternate auth when Cloudflare returns Authentication error.
• Updated zero-parameter ability schemas to accept the empty/null representations that MCP/WordPress paths can produce for {}.

1.0.7

• Fixed zero-parameter schemas so they stay object-shaped without using stdClass-backed properties.
• Fixed validator-path Cannot use object of type stdClass as array failures for object-shaped inputs.

1.0.6

• Fixed stdClass-shaped MCP inputs and Cloudflare API response data normalization before array access.
• Fixed cloudflare/get-zone so {} calls do not throw Cannot use object of type stdClass as array.

1.0.5

• Fixed Cloudflare API auth handling for installs using API tokens instead of only email + global API key.
• Added auth-header fallback for Cloudflare responses that report invalid request headers.
• Fixed zero-parameter abilities so {} inputs are accepted by MCP clients.

1.0.4

• Fixed zero-parameter ability schemas so MCP Adapter 0.4.x clients do not receive invalid properties: [] JSON

1.0.3

• Fixed: Removed hard plugin header dependency on abilities-api to avoid slug-mismatch activation blocking

1.0.2

• Improve zone ID lookup caching and API header reuse

1.0.1

• Added: Stored zone_id optimization

1.0.0

• Initial release

Contributing

PRs welcome. Keep changes focused on the plugin's WordPress ability surface and preserve authenticated, explicit workflows.

License

GPL-2.0+

Author

basicus

Links

• Plugin Page
• MCP Expose Abilities
• GitHub Releases

Star and Share

If this plugin saves you time or makes WordPress maintenance easier to verify, please:

• star the repo
• share it with people running WordPress sites
• point them to the main plugin page so they can see what the ecosystem can actually do

Why do it?

Because agent-friendly open WordPress tooling helps more of the boring but important work get done.