From 1cbebf660def1110c12f490dc41977b433820a20 Mon Sep 17 00:00:00 2001 From: Matt Carey Date: Mon, 19 Oct 2026 16:40:20 +0100 Subject: [PATCH 1/3] [Agents] Changelog: Cloudflare API MCP server asks for a missing OAuth scope when a tool needs it --- .../2026-10-19-cloudflare-mcp-step-up.mdx | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx diff --git a/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx b/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx new file mode 100644 index 00000000000..e3999c9e346 --- /dev/null +++ b/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx @@ -0,0 +1,19 @@ +--- +title: Cloudflare API MCP server asks for a missing OAuth scope when a tool needs it +description: When Cloudflare refuses a call for a missing OAuth scope, the Cloudflare API MCP server asks your MCP client to re-authorize with it, and says why the call was refused. +products: + - agents +date: 2026-10-19 +--- + +When the Cloudflare API refuses a call, the [Cloudflare API MCP server](/agents/model-context-protocol/cloudflare/servers-for-cloudflare/#cloudflare-api-mcp-server) now says why, instead of returning only `10000: Authentication error`: + +- The connection lacks an OAuth scope the endpoint accepts. The error names the scope to grant. +- The connection already holds an accepted scope, so reconnecting will not help. The user's role on the account or zone is usually the cause. +- No OAuth scope covers the endpoint. Use an API token with one of the listed permissions. + +If the connection lacks the scope and the call is safe to retry, the server asks your MCP client to re-authorize with that scope added to the ones you already granted, following the MCP [scope challenge flow](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#scope-challenge-handling). Claude, Claude Code and Codex step up this way. In Claude Code, run `/mcp` to re-authenticate when prompted. + +You can also start with almost no access. The consent page offers a **Minimal** template next to **Read only** and **Full access**. It grants only your user and account identity, and clients that support step-up request each further scope the first time a tool needs it. + +To use it, connect `https://mcp.cloudflare.com/mcp` to your MCP client. From 64602e7c4f64fad4c98e7ac46561d2ebc7830d9f Mon Sep 17 00:00:00 2001 From: Matt Carey Date: Mon, 19 Oct 2026 16:41:42 +0100 Subject: [PATCH 2/3] [Agents] Changelog: reword as step-up authorization --- .../agents/2026-10-19-cloudflare-mcp-step-up.mdx | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx b/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx index e3999c9e346..d9cc533629d 100644 --- a/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx +++ b/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx @@ -1,19 +1,15 @@ --- -title: Cloudflare API MCP server asks for a missing OAuth scope when a tool needs it -description: When Cloudflare refuses a call for a missing OAuth scope, the Cloudflare API MCP server asks your MCP client to re-authorize with it, and says why the call was refused. +title: Cloudflare API MCP server now supports step-up authorization +description: Grant only the required scopes when you connect, and authorize more on demand as your agent performs a task. products: - agents date: 2026-10-19 --- -When the Cloudflare API refuses a call, the [Cloudflare API MCP server](/agents/model-context-protocol/cloudflare/servers-for-cloudflare/#cloudflare-api-mcp-server) now says why, instead of returning only `10000: Authentication error`: +The [Cloudflare API MCP server](/agents/model-context-protocol/cloudflare/servers-for-cloudflare/#cloudflare-api-mcp-server) now supports [step-up authorization](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#step-up-authorization-flow). -- The connection lacks an OAuth scope the endpoint accepts. The error names the scope to grant. -- The connection already holds an accepted scope, so reconnecting will not help. The user's role on the account or zone is usually the cause. -- No OAuth scope covers the endpoint. Use an API token with one of the listed permissions. +Grant only the required scopes when you connect, then authorize more on demand as your agent performs a task. When a tool call needs a scope you have not granted, the server returns an [`insufficient_scope` challenge](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#scope-challenge-handling) naming it, and your MCP client asks you to approve it. Scopes you already granted are kept. -If the connection lacks the scope and the call is safe to retry, the server asks your MCP client to re-authorize with that scope added to the ones you already granted, following the MCP [scope challenge flow](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#scope-challenge-handling). Claude, Claude Code and Codex step up this way. In Claude Code, run `/mcp` to re-authenticate when prompted. +To start with the least access, choose **Minimal** on the consent page when you connect `https://mcp.cloudflare.com/mcp`. Learn more about [authorization in MCP](/agents/model-context-protocol/protocol/authorization/). -You can also start with almost no access. The consent page offers a **Minimal** template next to **Read only** and **Full access**. It grants only your user and account identity, and clients that support step-up request each further scope the first time a tool needs it. - -To use it, connect `https://mcp.cloudflare.com/mcp` to your MCP client. +Available now in all MCP clients that support step-up authorization. From 400c59c3458a2c20d3fb53c362d0deffcfdfdc48 Mon Sep 17 00:00:00 2001 From: "ask-bonk[bot]" Date: Mon, 19 Oct 2026 16:18:22 +0000 Subject: [PATCH 3/3] =?UTF-8?q?Fixed=20"Learn=20more"=20=E2=86=92=20"Refer?= =?UTF-8?q?=20to"=20link=20wording.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: mattzcarey --- .../changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx b/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx index d9cc533629d..899d8718ef3 100644 --- a/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx +++ b/src/content/changelog/agents/2026-10-19-cloudflare-mcp-step-up.mdx @@ -10,6 +10,6 @@ The [Cloudflare API MCP server](/agents/model-context-protocol/cloudflare/server Grant only the required scopes when you connect, then authorize more on demand as your agent performs a task. When a tool call needs a scope you have not granted, the server returns an [`insufficient_scope` challenge](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#scope-challenge-handling) naming it, and your MCP client asks you to approve it. Scopes you already granted are kept. -To start with the least access, choose **Minimal** on the consent page when you connect `https://mcp.cloudflare.com/mcp`. Learn more about [authorization in MCP](/agents/model-context-protocol/protocol/authorization/). +To start with the least access, choose **Minimal** on the consent page when you connect `https://mcp.cloudflare.com/mcp`. Refer to [authorization in MCP](/agents/model-context-protocol/protocol/authorization/). Available now in all MCP clients that support step-up authorization.