What can AI agents do with Cloudflare Workers Bindings through Ferentin?

Ferentin exposes 23 Cloudflare Workers Bindings MCP tools to your AI agents, grouped as Discover (7 tools), Access (6 tools) and Manage (9 tools). Every call is checked against your Ferentin policies before it reaches Cloudflare Workers Bindings.

How is Cloudflare Workers Bindings access secured?

Requests through the Cloudflare Workers Bindings integration are covered by OAuth 2.0 consent, per user authorization, dynamic client registration, PKCE and audit logging. These controls are applied by Ferentin, not by Cloudflare Workers Bindings, so they hold across every connected agent.

How do I connect Cloudflare Workers Bindings to Ferentin?

Open the Ferentin admin console, add Cloudflare Workers Bindings as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.

Is the Cloudflare Workers Bindings integration generally available?

Yes. The Cloudflare Workers Bindings integration is generally available on Ferentin, including the free tier.

Cloudflare Workers Bindings

Generally Available

With OAuth2 authorization granted, an AI agent can list, create, inspect, and delete those bindings, query D1 directly, and read a Worker's source — enough to stand up and evolve a Workers backend from natural language.

Cloudflare
Workers
Developer Platform

Configure Cloudflare Workers Bindings Browse the 23 tools

Authentication: OAuth 2.0
Hosting: Vendor-hosted endpoint
Data actions: Read and write
MCP tools: 23

How it works

Every agent request passes through Ferentin policy before it reaches Cloudflare Workers Bindings.

AI agentAsks for something
Ferentin policies
- OAuth 2.0 consent
- Per user authorization
- Dynamic client registration
- PKCE
Cloudflare Workers Bindings MCP serverAuthorized connection
Governed resultMasked, logged, returned

What agents can do

23 tools · you choose which ones agents may call

Search and browse what exists, without opening the content itself.

kv_namespaces_list
workers_list
r2_buckets_list
d1_databases_list
d1_database_query
hyperdrive_configs_list
search_cloudflare_documentation

Before you connect

OAuth (user mode) only — unlike the main Cloudflare API server, this endpoint does not accept a Cloudflare API token as a bearer credential.
Ferentin registers automatically via Dynamic Client Registration (RFC 7591) against https://bindings.mcp.cloudflare.com/register; PKCE S256 and refresh tokens are supported.
This server is write-capable: it can create and DELETE D1 databases, KV namespaces, and R2 buckets, edit and DELETE Hyperdrive configs, and run arbitrary SQL against a D1 database. Note there is no Hyperdrive create tool — configs must already exist. Scope MCP tool policy accordingly.
This server can read Worker SOURCE CODE (workers_get_worker_code). Treat its output as sensitive — Worker source routinely embeds internal hostnames, route logic, and occasionally inline secrets. Keep DLP inspection enabled.

3 more technical notes

Also bundles the two public Documentation tools (search_cloudflare_documentation, migrate_pages_to_workers_guide) and the 'workers-prompt-full' prompt, so a tenant connecting this server does not additionally need cloudflare-docs.
Authorize the least-privileged Cloudflare account that still covers the bindings the agent needs.
Tool catalog captured live from the upstream on 2026-08-08 (23 tools, 1 prompt).

About Cloudflare Workers Bindings

Cloudflare Workers bind to platform primitives — D1 SQL databases, KV namespaces, R2 buckets, and Hyperdrive connection configs — which together make up the storage and data layer of a Workers application.

Website Developer docs

Frequently asked about Cloudflare Workers Bindings

What can AI agents do with Cloudflare Workers Bindings through Ferentin?: Ferentin exposes 23 Cloudflare Workers Bindings MCP tools to your AI agents, grouped as Discover (7 tools), Access (6 tools) and Manage (9 tools). Every call is checked against your Ferentin policies before it reaches Cloudflare Workers Bindings.
How is Cloudflare Workers Bindings access secured?: Requests through the Cloudflare Workers Bindings integration are covered by OAuth 2.0 consent, per user authorization, dynamic client registration, PKCE and audit logging. These controls are applied by Ferentin, not by Cloudflare Workers Bindings, so they hold across every connected agent.
How do I connect Cloudflare Workers Bindings to Ferentin?: Open the Ferentin admin console, add Cloudflare Workers Bindings as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
Is the Cloudflare Workers Bindings integration generally available?: Yes. The Cloudflare Workers Bindings integration is generally available on Ferentin, including the free tier.

Related integrations

Cloudflare

Manage Cloudflare — DNS, Workers, Zero Trust, observability, and more — across 2,500+ API endpoints via a search-and-execute agent surface.

MCP Servers

View

Cloudflare Workers Builds

Diagnose Cloudflare Workers deployments — build history, status, and logs.

MCP Servers

View

Supabase

Open source Firebase alternative with Postgres database, auth, edge functions, and real-time subscriptions.

MCP ServersEnterprise-managed

View