cloudflare/mcp-server-cloudflare

[email protected] scope: demo-day Breaking

This release includes 4 breaking changes for platform teams planning a safe upgrade.

Published 1d MCP Developer Tools

✓ No known CVEs patched

✓ No known CVEs patched in this version

Affected surfaces

deps

Summary

AI summary

Minor fixes and improvements.

Type	Severity	Summary	CVE
Dependency
Dependency	Medium	Upgrade zod from 3 to 4; record now requires explicit key schema, ip validation changes. Upgrade zod from 3 to 4; record now requires explicit key schema, ip validation changes. Source: llm_adapter@2026-06-02 Confidence: high	—
Dependency	Medium	Upgrade agents from 0.2.19 to 0.13.3; `McpAgent` env generic constrained to `Cloudflare.Env`. Upgrade agents from 0.2.19 to 0.13.3; `McpAgent` env generic constrained to `Cloudflare.Env`. Source: llm_adapter@2026-06-02 Confidence: high	—
Dependency	Medium	Upgrade @modelcontextprotocol/sdk from 1.20.2 to 1.29.0; tool `annotations` hints must be flat (no nested objects). Upgrade @modelcontextprotocol/sdk from 1.20.2 to 1.29.0; tool `annotations` hints must be flat (no nested objects). Source: llm_adapter@2026-06-02 Confidence: high	—
Dependency	Medium	Upgrade ai from 4 to 6; eval tooling updated (LanguageModel, inputSchema, stopWhen/stepCountIs, tool-call `input`). Upgrade ai from 4 to 6; eval tooling updated (LanguageModel, inputSchema, stopWhen/stepCountIs, tool-call `input`). Source: llm_adapter@2026-06-02 Confidence: high	—

Full changelog

`zod` 4 requires an explicit key schema for `z.record(...)` and replaces `z.string().ip()` with `z.ipv4()`/`z.ipv6()`; drops the removed `objectOutputType` helper.
`agents` 0.13 constrains `McpAgent` env generic to `Cloudflare.Env`.
MCP SDK 1.29 requires tool `annotations` hints to be flat (`{ title, readOnlyHint, ... }`).
`ai` 6 updates eval tooling with new fields and types.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track cloudflare/mcp-server-cloudflare

Get notified when new releases ship.

About cloudflare/mcp-server-cloudflare

Integration with Cloudflare services including Workers, KV, R2, and D1

[email protected] Adds delete-class migration for UserDetails Durable Object in graphql server.
[email protected] Removes `accounts_list` and `set_active_account` tools.
[email protected] Removes `accounts_list` and `set_active_account` tools.
[email protected] Removes `accounts_list` and `set_active_account` tools.
[email protected] Removes `accounts_list` and `set_active_account` tools.