Zeema
New design
Catalogue / api-gateway

MCP Server Portal

cloudflareAPI gatewaycloudflare-mcp-portal

One authenticated endpoint that centralises upstream MCP servers and proxies tool calls behind Cloudflare Access.

Provider
cloudflare
Kind
API gateway
Category
Edge
Official docs
https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/
Properties · 5 set by this component
propertytypevaluesrequiredkind defaultthis component
authenumnone | api-key | jwt | oauth2 | mtlsnonone▸ oauth2
codeMode · component propertyenumunavailable | opt-in | on-by-default | requirednoopt-ininherited
concurrencyLimitboolean—nofalseinherited
idempotencyKeys · advancedboolean—nofalseinherited
instancesinteger—no—inherited
keyTtlHours · advancedinteger—no—inherited
managedboolean—nofalse▸ true
maxUpstreamServers · component propertyinteger—no80inherited
protocolenumhttp | grpc | websocket | fix | ouchnohttp▸ http
rateLimitingboolean—nofalse▸ false
requestLogging · component propertyboolean—notrueinherited
tlsboolean—notrue▸ true
Rules that apply · 1

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

Synchronous call chain too deepwarning
sync-chain-too-deep

Every consecutive synchronous hop from this entry point spends part of the stated p95 latency budget, and the chain's failures multiply. More than three hops is a budget nobody is tracking.

  • — all of these hold:
  • — the design requirement `latency.p95Ms` has a value
  • — the longest chain of synchronous calls starting at the node is more than 3 hops long
Use it in a design
nodes:
  - { id: "mcp-portal", component: "cloudflare-mcp-portal" }
Other API gateway products · 40
API Gatewayalibaba-api-gatewayalibabacloudapi-gatewayAmazon API Gatewayaws-api-gatewayawsapi-gatewayAWS AppSync GraphQL APIaws-appsyncawsapi-gatewayAzure API Managementazure-api-managementazureapi-gatewayAI Gatewaycloudflare-ai-gatewaycloudflareapi-gatewayCloudflare API Shieldcloudflare-api-shieldcloudflareapi-gatewayCloudflare Privacy Gatewaycloudflare-privacy-gatewaycloudflareapi-gatewayGeneric API gatewayapi-gatewayapi-gatewayApache APISIXapisixapi-gatewayApollo GraphOSapollo-graphosapi-gatewayEasegresseasegressapi-gatewayEmissary-ingressemissaryapi-gatewayEnvoy Gatewayenvoy-gatewayapi-gatewayGloo Gatewayglooapi-gatewayHasurahasuraapi-gatewayHelicone AI Gatewayhelicone-gatewayapi-gatewayHigresshigressapi-gatewayKong Gatewaykongapi-gatewayKong AI Gatewaykong-ai-gatewayapi-gatewayKong Konnectkong-konnectapi-gatewayKrakenDkrakendapi-gatewayLiteLLM Proxylitellmapi-gatewayMartian Gatewaymartianapi-gatewayNot Diamondnot-diamondapi-gatewayPortkey AI Gatewayportkeyapi-gatewayRequestyrequestyapi-gatewaySpring Cloud Gatewayspring-cloud-gatewayapi-gatewayTyk Gatewaytykapi-gatewayUnifyunify-aiapi-gatewayVercel AI Gatewayvercel-ai-gatewayapi-gatewayWSO2 API Managerwso2-api-managerapi-gatewayZuulzuulapi-gatewayApigeeapigeegcpapi-gatewayAgent Gatewaygoogle-agent-gatewaygcpapi-gatewayAPI Gatewaygoogle-api-gatewaygcpapi-gatewayApigee hybridgoogle-apigee-hybridgcpapi-gatewayCloud Endpointsgoogle-cloud-endpointsgcpapi-gatewayFirebase Data Connectgoogle-firebase-data-connectgcpapi-gatewayIBM API Connectibm-api-connectibmapi-gatewayOCI API Gatewayoci-api-gatewayociapi-gateway
Source
# yaml-language-server: $schema=../../schema/component.schema.json
# MCP server portal (Cloudflare One AI controls): one HTTP endpoint that centralises up to 80
# upstream MCP servers, authenticates clients with OAuth 2.0 through Access or a service token
# and proxies tool calls ("MCP server portals"). Access logs every tool request; Code Mode is
# opt-in, off unless the client asks for it.
schemaVersion: "1"
type: "component"
id: "cloudflare-mcp-portal"
kind: "api-gateway"
provider: "cloudflare"
docs: "https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/"
defaults:
  managed: true
  protocol: "http"
  tls: true
  auth: "oauth2"
  rateLimiting: false
properties:
  maxUpstreamServers:
    type: "integer"
    default: 80
  codeMode:
    type: "enum"
    values: ["unavailable", "opt-in", "on-by-default", "required"]
    default: "opt-in"
  requestLogging:
    type: "boolean"
    default: true

The same page as markdown, for an agent: /catalogue/components/cloudflare-mcp-portal.md