MCP

The Model Context Protocol (MCP) endpoint allows AI agents to discover and interact with your AI Search content. This endpoint follows the MCP specification ↗ and provides tools for querying your indexed content.

Enable public endpoints for your AI Search instance:

1. Go to AI Search in the Cloudflare dashboard. Go to AI Search ↗
2. Select your AI Search instance.
3. Go to Settings > Public Endpoint.
4. Turn on Enable Public Endpoint.
5. Copy the public endpoint URL.

You can enable a public endpoint on a single instance or on a whole namespace. A namespace endpoint serves /mcp as well, and searches across the instances you allow in that namespace. Its hostname is prefixed with ns-:

https://ns-<NAMESPACE_ENDPOINT_ID>.search.ai.cloudflare.com/mcp

The tools and request format are the same for both. The examples on this page use the instance hostname.

The AI Search MCP endpoint exposes a search tool that queries your indexed content.

You can customize this in your AI Search instance settings. For more details, refer to Public endpoint configuration.

Send a request to the /mcp endpoint with the Accept: application/json, text/event-stream header:

curl https://<PUBLIC_ENDPOINT_ID>.search.ai.cloudflare.com/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "search",
      "arguments": {
        "query": "How do I configure AI Search?"
      }
    }
  }'

You can serve the MCP endpoint from a hostname that you own, such as https://search.example.com/mcp, instead of the generated one. The hostname must belong to a zone on the same Cloudflare account. To attach a custom domain:

1. Go to AI Search in the Cloudflare dashboard. Go to AI Search ↗
2. Select your instance or namespace.
3. Go to Public Endpoints and enable the public endpoint. A custom domain requires an active public endpoint.
4. Go to Custom Domains and attach your hostname.

A custom domain routes requests through your own zone, so you can then put Cloudflare Access in front of the endpoint. MCP clients authenticate with an Access service token, sent as CF-Access-Client-Id and CF-Access-Client-Secret headers, so only the agents you issue tokens to can reach the endpoint. Access only protects the custom hostname, so set default_domain_enabled to false as well. Otherwise the default <PUBLIC_ENDPOINT_ID>.search.ai.cloudflare.com hostname keeps answering unauthenticated requests.

To attach a domain through the API instead, refer to Custom domains.