Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Cloudflare Provider
  4. API Docs
  5. ZeroTrustAccessAiControlsMcpServer
Viewing docs for Cloudflare v6.20.0
published on Tuesday, Aug 25, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

cloudflare.ZeroTrustAccessAiControlsMcpServer

cloudflare logo cloudflare logo
Viewing docs for Cloudflare v6.20.0
published on Tuesday, Aug 25, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

    Accepted Permissions

    • MCP Portals Read
    • MCP Portals Write

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustAccessAiControlsMcpServer = new cloudflare.ZeroTrustAccessAiControlsMcpServer("example_zero_trust_access_ai_controls_mcp_server", {
    accountId: "a86a8f5c339544d7bdc89926de14fb8c",
    zeroTrustAccessAiControlsMcpServerId: "my-mcp-server",
    authType: "unauthenticated",
    hostname: "https://example.com/mcp",
    name: "My MCP Server",
    authCredentials: "sk-my-bearer-token",
    clientSecret: "client_secret",
    description: "This is one remote MCP server",
    isSharedOauthCallbackEnabled: true,
    secureWebGateway: false,
    updatedPrompts: [{
        name: "name",
        alias: "my-custom-alias",
        description: "description",
        enabled: true,
    }],
    updatedTools: [{
        name: "name",
        alias: "my-custom-alias",
        description: "description",
        enabled: true,
    }],
});

    import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_access_ai_controls_mcp_server = cloudflare.ZeroTrustAccessAiControlsMcpServer("example_zero_trust_access_ai_controls_mcp_server",
    account_id="a86a8f5c339544d7bdc89926de14fb8c",
    zero_trust_access_ai_controls_mcp_server_id="my-mcp-server",
    auth_type="unauthenticated",
    hostname="https://example.com/mcp",
    name="My MCP Server",
    auth_credentials="sk-my-bearer-token",
    client_secret="client_secret",
    description="This is one remote MCP server",
    is_shared_oauth_callback_enabled=True,
    secure_web_gateway=False,
    updated_prompts=[{
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": True,
    }],
    updated_tools=[{
        "name": "name",
        "alias": "my-custom-alias",
        "description": "description",
        "enabled": True,
    }])

    package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.NewZeroTrustAccessAiControlsMcpServer(ctx, "example_zero_trust_access_ai_controls_mcp_server", &cloudflare.ZeroTrustAccessAiControlsMcpServerArgs{
			AccountId:                            pulumi.String("a86a8f5c339544d7bdc89926de14fb8c"),
			ZeroTrustAccessAiControlsMcpServerId: pulumi.String("my-mcp-server"),
			AuthType:                             pulumi.String("unauthenticated"),
			Hostname:                             pulumi.String("https://example.com/mcp"),
			Name:                                 pulumi.String("My MCP Server"),
			AuthCredentials:                      pulumi.String("sk-my-bearer-token"),
			ClientSecret:                         pulumi.String("client_secret"),
			Description:                          pulumi.String("This is one remote MCP server"),
			IsSharedOauthCallbackEnabled:         pulumi.Bool(true),
			SecureWebGateway:                     pulumi.Bool(false),
			UpdatedPrompts: cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArray{
				&cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs{
					Name:        pulumi.String("name"),
					Alias:       pulumi.String("my-custom-alias"),
					Description: pulumi.String("description"),
					Enabled:     pulumi.Bool(true),
				},
			},
			UpdatedTools: cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedToolArray{
				&cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs{
					Name:        pulumi.String("name"),
					Alias:       pulumi.String("my-custom-alias"),
					Description: pulumi.String("description"),
					Enabled:     pulumi.Bool(true),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustAccessAiControlsMcpServer = new Cloudflare.ZeroTrustAccessAiControlsMcpServer("example_zero_trust_access_ai_controls_mcp_server", new()
    {
        AccountId = "a86a8f5c339544d7bdc89926de14fb8c",
        ZeroTrustAccessAiControlsMcpServerId = "my-mcp-server",
        AuthType = "unauthenticated",
        Hostname = "https://example.com/mcp",
        Name = "My MCP Server",
        AuthCredentials = "sk-my-bearer-token",
        ClientSecret = "client_secret",
        Description = "This is one remote MCP server",
        IsSharedOauthCallbackEnabled = true,
        SecureWebGateway = false,
        UpdatedPrompts = new[]
        {
            new Cloudflare.Inputs.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs
            {
                Name = "name",
                Alias = "my-custom-alias",
                Description = "description",
                Enabled = true,
            },
        },
        UpdatedTools = new[]
        {
            new Cloudflare.Inputs.ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs
            {
                Name = "name",
                Alias = "my-custom-alias",
                Description = "description",
                Enabled = true,
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.ZeroTrustAccessAiControlsMcpServer;
import com.pulumi.cloudflare.ZeroTrustAccessAiControlsMcpServerArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleZeroTrustAccessAiControlsMcpServer = new ZeroTrustAccessAiControlsMcpServer("exampleZeroTrustAccessAiControlsMcpServer", ZeroTrustAccessAiControlsMcpServerArgs.builder()
            .accountId("a86a8f5c339544d7bdc89926de14fb8c")
            .zeroTrustAccessAiControlsMcpServerId("my-mcp-server")
            .authType("unauthenticated")
            .hostname("https://example.com/mcp")
            .name("My MCP Server")
            .authCredentials("sk-my-bearer-token")
            .clientSecret("client_secret")
            .description("This is one remote MCP server")
            .isSharedOauthCallbackEnabled(true)
            .secureWebGateway(false)
            .updatedPrompts(ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs.builder()
                .name("name")
                .alias("my-custom-alias")
                .description("description")
                .enabled(true)
                .build())
            .updatedTools(ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs.builder()
                .name("name")
                .alias("my-custom-alias")
                .description("description")
                .enabled(true)
                .build())
            .build());

    }
}

    resources:
  exampleZeroTrustAccessAiControlsMcpServer:
    type: cloudflare:ZeroTrustAccessAiControlsMcpServer
    name: example_zero_trust_access_ai_controls_mcp_server
    properties:
      accountId: a86a8f5c339544d7bdc89926de14fb8c
      zeroTrustAccessAiControlsMcpServerId: my-mcp-server
      authType: unauthenticated
      hostname: https://example.com/mcp
      name: My MCP Server
      authCredentials: sk-my-bearer-token
      clientSecret: client_secret
      description: This is one remote MCP server
      isSharedOauthCallbackEnabled: true
      secureWebGateway: false
      updatedPrompts:
        - name: name
          alias: my-custom-alias
          description: description
          enabled: true
      updatedTools:
        - name: name
          alias: my-custom-alias
          description: description
          enabled: true

    pulumi {
  required_providers {
    cloudflare = {
      source = "pulumi/cloudflare"
    }
  }
}

resource "cloudflare_zerotrustaccessaicontrolsmcpserver" "example_zero_trust_access_ai_controls_mcp_server" {
  account_id                                  = "a86a8f5c339544d7bdc89926de14fb8c"
  zero_trust_access_ai_controls_mcp_server_id = "my-mcp-server"
  auth_type                                   = "unauthenticated"
  hostname                                    = "https://example.com/mcp"
  name                                        = "My MCP Server"
  auth_credentials                            = "sk-my-bearer-token"
  client_secret                               = "client_secret"
  description                                 = "This is one remote MCP server"
  is_shared_oauth_callback_enabled            = true
  secure_web_gateway                          = false
  updated_prompts {
    name        = "name"
    alias       = "my-custom-alias"
    description = "description"
    enabled     = true
  }
  updated_tools {
    name        = "name"
    alias       = "my-custom-alias"
    description = "description"
    enabled     = true
  }
}

    Create ZeroTrustAccessAiControlsMcpServer Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ZeroTrustAccessAiControlsMcpServer(name: string, args: ZeroTrustAccessAiControlsMcpServerArgs, opts?: CustomResourceOptions);
    @overload
def ZeroTrustAccessAiControlsMcpServer(resource_name: str,
                                       args: ZeroTrustAccessAiControlsMcpServerArgs,
                                       opts: Optional[ResourceOptions] = None)

@overload
def ZeroTrustAccessAiControlsMcpServer(resource_name: str,
                                       opts: Optional[ResourceOptions] = None,
                                       account_id: Optional[str] = None,
                                       auth_type: Optional[str] = None,
                                       hostname: Optional[str] = None,
                                       name: Optional[str] = None,
                                       zero_trust_access_ai_controls_mcp_server_id: Optional[str] = None,
                                       auth_credentials: Optional[str] = None,
                                       client_secret: Optional[str] = None,
                                       description: Optional[str] = None,
                                       is_shared_oauth_callback_enabled: Optional[bool] = None,
                                       secure_web_gateway: Optional[bool] = None,
                                       updated_prompts: Optional[Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs]] = None,
                                       updated_tools: Optional[Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs]] = None)
    func NewZeroTrustAccessAiControlsMcpServer(ctx *Context, name string, args ZeroTrustAccessAiControlsMcpServerArgs, opts ...ResourceOption) (*ZeroTrustAccessAiControlsMcpServer, error)
    public ZeroTrustAccessAiControlsMcpServer(string name, ZeroTrustAccessAiControlsMcpServerArgs args, CustomResourceOptions? opts = null)
    public ZeroTrustAccessAiControlsMcpServer(String name, ZeroTrustAccessAiControlsMcpServerArgs args)
public ZeroTrustAccessAiControlsMcpServer(String name, ZeroTrustAccessAiControlsMcpServerArgs args, CustomResourceOptions options)

    type: cloudflare:ZeroTrustAccessAiControlsMcpServer
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "cloudflare_zero_trust_access_ai_controls_mcp_server" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ZeroTrustAccessAiControlsMcpServerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ZeroTrustAccessAiControlsMcpServerArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ZeroTrustAccessAiControlsMcpServerArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ZeroTrustAccessAiControlsMcpServerArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ZeroTrustAccessAiControlsMcpServerArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var zeroTrustAccessAiControlsMcpServerResource = new Cloudflare.ZeroTrustAccessAiControlsMcpServer("zeroTrustAccessAiControlsMcpServerResource", new()
{
    AccountId = "string",
    AuthType = "string",
    Hostname = "string",
    Name = "string",
    ZeroTrustAccessAiControlsMcpServerId = "string",
    AuthCredentials = "string",
    ClientSecret = "string",
    Description = "string",
    IsSharedOauthCallbackEnabled = false,
    SecureWebGateway = false,
    UpdatedPrompts = new[]
    {
        new Cloudflare.Inputs.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs
        {
            Name = "string",
            Alias = "string",
            Description = "string",
            Enabled = false,
        },
    },
    UpdatedTools = new[]
    {
        new Cloudflare.Inputs.ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs
        {
            Name = "string",
            Alias = "string",
            Description = "string",
            Enabled = false,
        },
    },
});

    example, err := cloudflare.NewZeroTrustAccessAiControlsMcpServer(ctx, "zeroTrustAccessAiControlsMcpServerResource", &cloudflare.ZeroTrustAccessAiControlsMcpServerArgs{
	AccountId:                            pulumi.String("string"),
	AuthType:                             pulumi.String("string"),
	Hostname:                             pulumi.String("string"),
	Name:                                 pulumi.String("string"),
	ZeroTrustAccessAiControlsMcpServerId: pulumi.String("string"),
	AuthCredentials:                      pulumi.String("string"),
	ClientSecret:                         pulumi.String("string"),
	Description:                          pulumi.String("string"),
	IsSharedOauthCallbackEnabled:         pulumi.Bool(false),
	SecureWebGateway:                     pulumi.Bool(false),
	UpdatedPrompts: cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArray{
		&cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs{
			Name:        pulumi.String("string"),
			Alias:       pulumi.String("string"),
			Description: pulumi.String("string"),
			Enabled:     pulumi.Bool(false),
		},
	},
	UpdatedTools: cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedToolArray{
		&cloudflare.ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs{
			Name:        pulumi.String("string"),
			Alias:       pulumi.String("string"),
			Description: pulumi.String("string"),
			Enabled:     pulumi.Bool(false),
		},
	},
})

    resource "cloudflare_zero_trust_access_ai_controls_mcp_server" "zeroTrustAccessAiControlsMcpServerResource" {
  lifecycle {
    create_before_destroy = true
  }
  account_id                                  = "string"
  auth_type                                   = "string"
  hostname                                    = "string"
  name                                        = "string"
  zero_trust_access_ai_controls_mcp_server_id = "string"
  auth_credentials                            = "string"
  client_secret                               = "string"
  description                                 = "string"
  is_shared_oauth_callback_enabled            = false
  secure_web_gateway                          = false
  updated_prompts {
    name        = "string"
    alias       = "string"
    description = "string"
    enabled     = false
  }
  updated_tools {
    name        = "string"
    alias       = "string"
    description = "string"
    enabled     = false
  }
}

    var zeroTrustAccessAiControlsMcpServerResource = new ZeroTrustAccessAiControlsMcpServer("zeroTrustAccessAiControlsMcpServerResource", ZeroTrustAccessAiControlsMcpServerArgs.builder()
    .accountId("string")
    .authType("string")
    .hostname("string")
    .name("string")
    .zeroTrustAccessAiControlsMcpServerId("string")
    .authCredentials("string")
    .clientSecret("string")
    .description("string")
    .isSharedOauthCallbackEnabled(false)
    .secureWebGateway(false)
    .updatedPrompts(ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs.builder()
        .name("string")
        .alias("string")
        .description("string")
        .enabled(false)
        .build())
    .updatedTools(ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs.builder()
        .name("string")
        .alias("string")
        .description("string")
        .enabled(false)
        .build())
    .build());

    zero_trust_access_ai_controls_mcp_server_resource = cloudflare.ZeroTrustAccessAiControlsMcpServer("zeroTrustAccessAiControlsMcpServerResource",
    account_id="string",
    auth_type="string",
    hostname="string",
    name="string",
    zero_trust_access_ai_controls_mcp_server_id="string",
    auth_credentials="string",
    client_secret="string",
    description="string",
    is_shared_oauth_callback_enabled=False,
    secure_web_gateway=False,
    updated_prompts=[{
        "name": "string",
        "alias": "string",
        "description": "string",
        "enabled": False,
    }],
    updated_tools=[{
        "name": "string",
        "alias": "string",
        "description": "string",
        "enabled": False,
    }])

    const zeroTrustAccessAiControlsMcpServerResource = new cloudflare.ZeroTrustAccessAiControlsMcpServer("zeroTrustAccessAiControlsMcpServerResource", {
    accountId: "string",
    authType: "string",
    hostname: "string",
    name: "string",
    zeroTrustAccessAiControlsMcpServerId: "string",
    authCredentials: "string",
    clientSecret: "string",
    description: "string",
    isSharedOauthCallbackEnabled: false,
    secureWebGateway: false,
    updatedPrompts: [{
        name: "string",
        alias: "string",
        description: "string",
        enabled: false,
    }],
    updatedTools: [{
        name: "string",
        alias: "string",
        description: "string",
        enabled: false,
    }],
});

    type: cloudflare:ZeroTrustAccessAiControlsMcpServer
properties:
    accountId: string
    authCredentials: string
    authType: string
    clientSecret: string
    description: string
    hostname: string
    isSharedOauthCallbackEnabled: false
    name: string
    secureWebGateway: false
    updatedPrompts:
        - alias: string
          description: string
          enabled: false
          name: string
    updatedTools:
        - alias: string
          description: string
          enabled: false
          name: string
    zeroTrustAccessAiControlsMcpServerId: string

    ZeroTrustAccessAiControlsMcpServer Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ZeroTrustAccessAiControlsMcpServer resource accepts the following input properties:

    AccountId string
    AuthType string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    Hostname string
    URL of the upstream MCP endpoint.
    Name string
    Display name for the MCP server.
    ZeroTrustAccessAiControlsMcpServerId string
    Unique identifier for the MCP server.
    AuthCredentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    ClientSecret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    Description string
    Optional description of the MCP server.
    IsSharedOauthCallbackEnabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    SecureWebGateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    UpdatedPrompts List<ZeroTrustAccessAiControlsMcpServerUpdatedPrompt>
    Server-wide prompt capability overrides.
    UpdatedTools List<ZeroTrustAccessAiControlsMcpServerUpdatedTool>
    Server-wide tool capability overrides.
    AccountId string
    AuthType string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    Hostname string
    URL of the upstream MCP endpoint.
    Name string
    Display name for the MCP server.
    ZeroTrustAccessAiControlsMcpServerId string
    Unique identifier for the MCP server.
    AuthCredentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    ClientSecret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    Description string
    Optional description of the MCP server.
    IsSharedOauthCallbackEnabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    SecureWebGateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    UpdatedPrompts []ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs
    Server-wide prompt capability overrides.
    UpdatedTools []ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs
    Server-wide tool capability overrides.
    account_id string
    auth_type string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    hostname string
    URL of the upstream MCP endpoint.
    name string
    Display name for the MCP server.
    zero_trust_access_ai_controls_mcp_server_id string
    Unique identifier for the MCP server.
    auth_credentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    client_secret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    description string
    Optional description of the MCP server.
    is_shared_oauth_callback_enabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    secure_web_gateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    updated_prompts list(object)
    Server-wide prompt capability overrides.
    updated_tools list(object)
    Server-wide tool capability overrides.
    accountId String
    authType String
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    hostname String
    URL of the upstream MCP endpoint.
    name String
    Display name for the MCP server.
    zeroTrustAccessAiControlsMcpServerId String
    Unique identifier for the MCP server.
    authCredentials String
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    clientSecret String
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    description String
    Optional description of the MCP server.
    isSharedOauthCallbackEnabled Boolean
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    secureWebGateway Boolean
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    updatedPrompts List<ZeroTrustAccessAiControlsMcpServerUpdatedPrompt>
    Server-wide prompt capability overrides.
    updatedTools List<ZeroTrustAccessAiControlsMcpServerUpdatedTool>
    Server-wide tool capability overrides.
    accountId string
    authType string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    hostname string
    URL of the upstream MCP endpoint.
    name string
    Display name for the MCP server.
    zeroTrustAccessAiControlsMcpServerId string
    Unique identifier for the MCP server.
    authCredentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    clientSecret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    description string
    Optional description of the MCP server.
    isSharedOauthCallbackEnabled boolean
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    secureWebGateway boolean
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    updatedPrompts ZeroTrustAccessAiControlsMcpServerUpdatedPrompt[]
    Server-wide prompt capability overrides.
    updatedTools ZeroTrustAccessAiControlsMcpServerUpdatedTool[]
    Server-wide tool capability overrides.
    account_id str
    auth_type str
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    hostname str
    URL of the upstream MCP endpoint.
    name str
    Display name for the MCP server.
    zero_trust_access_ai_controls_mcp_server_id str
    Unique identifier for the MCP server.
    auth_credentials str
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    client_secret str
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    description str
    Optional description of the MCP server.
    is_shared_oauth_callback_enabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    secure_web_gateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    updated_prompts Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs]
    Server-wide prompt capability overrides.
    updated_tools Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs]
    Server-wide tool capability overrides.
    accountId String
    authType String
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    hostname String
    URL of the upstream MCP endpoint.
    name String
    Display name for the MCP server.
    zeroTrustAccessAiControlsMcpServerId String
    Unique identifier for the MCP server.
    authCredentials String
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    clientSecret String
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    description String
    Optional description of the MCP server.
    isSharedOauthCallbackEnabled Boolean
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    secureWebGateway Boolean
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    updatedPrompts List<Property Map>
    Server-wide prompt capability overrides.
    updatedTools List<Property Map>
    Server-wide tool capability overrides.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ZeroTrustAccessAiControlsMcpServer resource produces the following output properties:

    AuthConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    AuthenticationStatus string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    CreatedAt string
    CreatedBy string
    Error string
    ErrorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    Id string
    The provider-assigned unique ID for this managed resource.
    LastSuccessfulSync string
    LastSynced string
    ModifiedAt string
    ModifiedBy string
    Prompts List<ImmutableDictionary<string, string>>
    Status string
    Tools List<ImmutableDictionary<string, string>>
    AuthConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    AuthenticationStatus string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    CreatedAt string
    CreatedBy string
    Error string
    ErrorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    Id string
    The provider-assigned unique ID for this managed resource.
    LastSuccessfulSync string
    LastSynced string
    ModifiedAt string
    ModifiedBy string
    Prompts []map[string]string
    Status string
    Tools []map[string]string
    auth_config_summary object
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authentication_status string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    created_at string
    created_by string
    error string
    error_details object
    id string
    The provider-assigned unique ID for this managed resource.
    last_successful_sync string
    last_synced string
    modified_at string
    modified_by string
    prompts list(map(string))
    status string
    tools list(map(string))
    authConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authenticationStatus String
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    createdAt String
    createdBy String
    error String
    errorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    id String
    The provider-assigned unique ID for this managed resource.
    lastSuccessfulSync String
    lastSynced String
    modifiedAt String
    modifiedBy String
    prompts List<Map<String,String>>
    status String
    tools List<Map<String,String>>
    authConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authenticationStatus string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    createdAt string
    createdBy string
    error string
    errorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    id string
    The provider-assigned unique ID for this managed resource.
    lastSuccessfulSync string
    lastSynced string
    modifiedAt string
    modifiedBy string
    prompts {[key: string]: string}[]
    status string
    tools {[key: string]: string}[]
    auth_config_summary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authentication_status str
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    created_at str
    created_by str
    error str
    error_details ZeroTrustAccessAiControlsMcpServerErrorDetails
    id str
    The provider-assigned unique ID for this managed resource.
    last_successful_sync str
    last_synced str
    modified_at str
    modified_by str
    prompts Sequence[Mapping[str, str]]
    status str
    tools Sequence[Mapping[str, str]]
    authConfigSummary Property Map
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authenticationStatus String
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    createdAt String
    createdBy String
    error String
    errorDetails Property Map
    id String
    The provider-assigned unique ID for this managed resource.
    lastSuccessfulSync String
    lastSynced String
    modifiedAt String
    modifiedBy String
    prompts List<Map<String>>
    status String
    tools List<Map<String>>

    Look up Existing ZeroTrustAccessAiControlsMcpServer Resource

    Get an existing ZeroTrustAccessAiControlsMcpServer resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ZeroTrustAccessAiControlsMcpServerState, opts?: CustomResourceOptions): ZeroTrustAccessAiControlsMcpServer
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        auth_config_summary: Optional[ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryArgs] = None,
        auth_credentials: Optional[str] = None,
        auth_type: Optional[str] = None,
        authentication_status: Optional[str] = None,
        client_secret: Optional[str] = None,
        created_at: Optional[str] = None,
        created_by: Optional[str] = None,
        description: Optional[str] = None,
        error: Optional[str] = None,
        error_details: Optional[ZeroTrustAccessAiControlsMcpServerErrorDetailsArgs] = None,
        hostname: Optional[str] = None,
        is_shared_oauth_callback_enabled: Optional[bool] = None,
        last_successful_sync: Optional[str] = None,
        last_synced: Optional[str] = None,
        modified_at: Optional[str] = None,
        modified_by: Optional[str] = None,
        name: Optional[str] = None,
        prompts: Optional[Sequence[Mapping[str, str]]] = None,
        secure_web_gateway: Optional[bool] = None,
        status: Optional[str] = None,
        tools: Optional[Sequence[Mapping[str, str]]] = None,
        updated_prompts: Optional[Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs]] = None,
        updated_tools: Optional[Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs]] = None,
        zero_trust_access_ai_controls_mcp_server_id: Optional[str] = None) -> ZeroTrustAccessAiControlsMcpServer
    func GetZeroTrustAccessAiControlsMcpServer(ctx *Context, name string, id IDInput, state *ZeroTrustAccessAiControlsMcpServerState, opts ...ResourceOption) (*ZeroTrustAccessAiControlsMcpServer, error)
    public static ZeroTrustAccessAiControlsMcpServer Get(string name, Input<string> id, ZeroTrustAccessAiControlsMcpServerState? state, CustomResourceOptions? opts = null)
    public static ZeroTrustAccessAiControlsMcpServer get(String name, Output<String> id, ZeroTrustAccessAiControlsMcpServerState state, CustomResourceOptions options)
    resources:  _:    type: cloudflare:ZeroTrustAccessAiControlsMcpServer    get:      id: ${id}
    import {
  to = cloudflare_zero_trust_access_ai_controls_mcp_server.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    AuthConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    AuthCredentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    AuthType string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    AuthenticationStatus string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    ClientSecret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    CreatedAt string
    CreatedBy string
    Description string
    Optional description of the MCP server.
    Error string
    ErrorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    Hostname string
    URL of the upstream MCP endpoint.
    IsSharedOauthCallbackEnabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    LastSuccessfulSync string
    LastSynced string
    ModifiedAt string
    ModifiedBy string
    Name string
    Display name for the MCP server.
    Prompts List<ImmutableDictionary<string, string>>
    SecureWebGateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    Status string
    Tools List<ImmutableDictionary<string, string>>
    UpdatedPrompts List<ZeroTrustAccessAiControlsMcpServerUpdatedPrompt>
    Server-wide prompt capability overrides.
    UpdatedTools List<ZeroTrustAccessAiControlsMcpServerUpdatedTool>
    Server-wide tool capability overrides.
    ZeroTrustAccessAiControlsMcpServerId string
    Unique identifier for the MCP server.
    AccountId string
    AuthConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryArgs
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    AuthCredentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    AuthType string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    AuthenticationStatus string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    ClientSecret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    CreatedAt string
    CreatedBy string
    Description string
    Optional description of the MCP server.
    Error string
    ErrorDetails ZeroTrustAccessAiControlsMcpServerErrorDetailsArgs
    Hostname string
    URL of the upstream MCP endpoint.
    IsSharedOauthCallbackEnabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    LastSuccessfulSync string
    LastSynced string
    ModifiedAt string
    ModifiedBy string
    Name string
    Display name for the MCP server.
    Prompts []map[string]string
    SecureWebGateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    Status string
    Tools []map[string]string
    UpdatedPrompts []ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs
    Server-wide prompt capability overrides.
    UpdatedTools []ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs
    Server-wide tool capability overrides.
    ZeroTrustAccessAiControlsMcpServerId string
    Unique identifier for the MCP server.
    account_id string
    auth_config_summary object
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    auth_credentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    auth_type string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    authentication_status string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    client_secret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    created_at string
    created_by string
    description string
    Optional description of the MCP server.
    error string
    error_details object
    hostname string
    URL of the upstream MCP endpoint.
    is_shared_oauth_callback_enabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    last_successful_sync string
    last_synced string
    modified_at string
    modified_by string
    name string
    Display name for the MCP server.
    prompts list(map(string))
    secure_web_gateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    status string
    tools list(map(string))
    updated_prompts list(object)
    Server-wide prompt capability overrides.
    updated_tools list(object)
    Server-wide tool capability overrides.
    zero_trust_access_ai_controls_mcp_server_id string
    Unique identifier for the MCP server.
    accountId String
    authConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authCredentials String
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    authType String
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    authenticationStatus String
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    clientSecret String
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    createdAt String
    createdBy String
    description String
    Optional description of the MCP server.
    error String
    errorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    hostname String
    URL of the upstream MCP endpoint.
    isSharedOauthCallbackEnabled Boolean
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    lastSuccessfulSync String
    lastSynced String
    modifiedAt String
    modifiedBy String
    name String
    Display name for the MCP server.
    prompts List<Map<String,String>>
    secureWebGateway Boolean
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    status String
    tools List<Map<String,String>>
    updatedPrompts List<ZeroTrustAccessAiControlsMcpServerUpdatedPrompt>
    Server-wide prompt capability overrides.
    updatedTools List<ZeroTrustAccessAiControlsMcpServerUpdatedTool>
    Server-wide tool capability overrides.
    zeroTrustAccessAiControlsMcpServerId String
    Unique identifier for the MCP server.
    accountId string
    authConfigSummary ZeroTrustAccessAiControlsMcpServerAuthConfigSummary
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authCredentials string
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    authType string
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    authenticationStatus string
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    clientSecret string
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    createdAt string
    createdBy string
    description string
    Optional description of the MCP server.
    error string
    errorDetails ZeroTrustAccessAiControlsMcpServerErrorDetails
    hostname string
    URL of the upstream MCP endpoint.
    isSharedOauthCallbackEnabled boolean
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    lastSuccessfulSync string
    lastSynced string
    modifiedAt string
    modifiedBy string
    name string
    Display name for the MCP server.
    prompts {[key: string]: string}[]
    secureWebGateway boolean
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    status string
    tools {[key: string]: string}[]
    updatedPrompts ZeroTrustAccessAiControlsMcpServerUpdatedPrompt[]
    Server-wide prompt capability overrides.
    updatedTools ZeroTrustAccessAiControlsMcpServerUpdatedTool[]
    Server-wide tool capability overrides.
    zeroTrustAccessAiControlsMcpServerId string
    Unique identifier for the MCP server.
    account_id str
    auth_config_summary ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryArgs
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    auth_credentials str
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    auth_type str
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    authentication_status str
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    client_secret str
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    created_at str
    created_by str
    description str
    Optional description of the MCP server.
    error str
    error_details ZeroTrustAccessAiControlsMcpServerErrorDetailsArgs
    hostname str
    URL of the upstream MCP endpoint.
    is_shared_oauth_callback_enabled bool
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    last_successful_sync str
    last_synced str
    modified_at str
    modified_by str
    name str
    Display name for the MCP server.
    prompts Sequence[Mapping[str, str]]
    secure_web_gateway bool
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    status str
    tools Sequence[Mapping[str, str]]
    updated_prompts Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs]
    Server-wide prompt capability overrides.
    updated_tools Sequence[ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs]
    Server-wide tool capability overrides.
    zero_trust_access_ai_controls_mcp_server_id str
    Unique identifier for the MCP server.
    accountId String
    authConfigSummary Property Map
    Safe subset of authcredentials surfaced to the dashboard. Includes authmode (dcr|manual), hasclientsecret, clientsecretversion, and the OAuth endpoints + client*id for manual servers. Never includes the secret value.
    authCredentials String
    Static credential for the upstream MCP server. For authType "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped server-side as Authorization: Bearer <token>, or a JSON-encoded object of the form {"headers":{"Header-Name":"value",...}} for custom or multiple static headers (e.g. Cloudflare Access service tokens: {"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}).
    authType String
    Authentication method used to connect to the upstream MCP server. Available values: "oauth", "bearer", "unauthenticated".
    authenticationStatus String
    Whether administrative authentication is required before capabilities can be synced. Manual OAuth is user-managed and has no administrative authentication flow. Available values: "notRequired", "required", "connected", "stale", "manual".
    clientSecret String
    Pre-registered OAuth clientsecret. Write-only - accepted on create/update when authcredentials.authmode is 'manual'. Stored AES-GCM-encrypted in serveroauth_secrets; never returned by read endpoints.
    createdAt String
    createdBy String
    description String
    Optional description of the MCP server.
    error String
    errorDetails Property Map
    hostname String
    URL of the upstream MCP endpoint.
    isSharedOauthCallbackEnabled Boolean
    When true, the gateway worker uses the shared Cloudflare-owned OAuth callback endpoint as the redirectUri for upstream on-behalf OAuth, instead of the customer portal hostname. Defaults to false (off); opt in per server by setting true.
    lastSuccessfulSync String
    lastSynced String
    modifiedAt String
    modifiedBy String
    name String
    Display name for the MCP server.
    prompts List<Map<String>>
    secureWebGateway Boolean
    Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
    status String
    tools List<Map<String>>
    updatedPrompts List<Property Map>
    Server-wide prompt capability overrides.
    updatedTools List<Property Map>
    Server-wide tool capability overrides.
    zeroTrustAccessAiControlsMcpServerId String
    Unique identifier for the MCP server.

    Supporting Types

    ZeroTrustAccessAiControlsMcpServerAuthConfigSummary, ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryArgs

    auth_mode string
    Available values: "dcr", "manual".
    client_secret_version number
    config object
    has_client_secret bool
    registration_info object

    ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryConfig, ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryConfigArgs

    ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryRegistrationInfo, ZeroTrustAccessAiControlsMcpServerAuthConfigSummaryRegistrationInfoArgs

    ClientId string
    RedirectUris List<string>
    Scope string
    TokenEndpointAuthMethod string
    clientId String
    redirectUris List<String>
    scope String
    tokenEndpointAuthMethod String
    clientId String
    redirectUris List<String>
    scope String
    tokenEndpointAuthMethod String

    ZeroTrustAccessAiControlsMcpServerErrorDetails, ZeroTrustAccessAiControlsMcpServerErrorDetailsArgs

    Cause string
    Underlying error message
    IsUpstream bool
    True = MCP server returned an error. False = couldn't reach the server
    McpCode double
    MCP protocol error code
    Retryable bool
    Whether the error is transient and worth retrying
    StatusCode double
    HTTP status code from the server
    Cause string
    Underlying error message
    IsUpstream bool
    True = MCP server returned an error. False = couldn't reach the server
    McpCode float64
    MCP protocol error code
    Retryable bool
    Whether the error is transient and worth retrying
    StatusCode float64
    HTTP status code from the server
    cause string
    Underlying error message
    is_upstream bool
    True = MCP server returned an error. False = couldn't reach the server
    mcp_code number
    MCP protocol error code
    retryable bool
    Whether the error is transient and worth retrying
    status_code number
    HTTP status code from the server
    cause String
    Underlying error message
    isUpstream Boolean
    True = MCP server returned an error. False = couldn't reach the server
    mcpCode Double
    MCP protocol error code
    retryable Boolean
    Whether the error is transient and worth retrying
    statusCode Double
    HTTP status code from the server
    cause string
    Underlying error message
    isUpstream boolean
    True = MCP server returned an error. False = couldn't reach the server
    mcpCode number
    MCP protocol error code
    retryable boolean
    Whether the error is transient and worth retrying
    statusCode number
    HTTP status code from the server
    cause str
    Underlying error message
    is_upstream bool
    True = MCP server returned an error. False = couldn't reach the server
    mcp_code float
    MCP protocol error code
    retryable bool
    Whether the error is transient and worth retrying
    status_code float
    HTTP status code from the server
    cause String
    Underlying error message
    isUpstream Boolean
    True = MCP server returned an error. False = couldn't reach the server
    mcpCode Number
    MCP protocol error code
    retryable Boolean
    Whether the error is transient and worth retrying
    statusCode Number
    HTTP status code from the server

    ZeroTrustAccessAiControlsMcpServerUpdatedPrompt, ZeroTrustAccessAiControlsMcpServerUpdatedPromptArgs

    Name string
    Name of the tool or prompt capability to override.
    Alias string
    Custom name exposed for the capability.
    Description string
    Custom description exposed for the capability.
    Enabled bool
    Whether the capability is available through the MCP server.
    Name string
    Name of the tool or prompt capability to override.
    Alias string
    Custom name exposed for the capability.
    Description string
    Custom description exposed for the capability.
    Enabled bool
    Whether the capability is available through the MCP server.
    name string
    Name of the tool or prompt capability to override.
    alias string
    Custom name exposed for the capability.
    description string
    Custom description exposed for the capability.
    enabled bool
    Whether the capability is available through the MCP server.
    name String
    Name of the tool or prompt capability to override.
    alias String
    Custom name exposed for the capability.
    description String
    Custom description exposed for the capability.
    enabled Boolean
    Whether the capability is available through the MCP server.
    name string
    Name of the tool or prompt capability to override.
    alias string
    Custom name exposed for the capability.
    description string
    Custom description exposed for the capability.
    enabled boolean
    Whether the capability is available through the MCP server.
    name str
    Name of the tool or prompt capability to override.
    alias str
    Custom name exposed for the capability.
    description str
    Custom description exposed for the capability.
    enabled bool
    Whether the capability is available through the MCP server.
    name String
    Name of the tool or prompt capability to override.
    alias String
    Custom name exposed for the capability.
    description String
    Custom description exposed for the capability.
    enabled Boolean
    Whether the capability is available through the MCP server.

    ZeroTrustAccessAiControlsMcpServerUpdatedTool, ZeroTrustAccessAiControlsMcpServerUpdatedToolArgs

    Name string
    Name of the tool or prompt capability to override.
    Alias string
    Custom name exposed for the capability.
    Description string
    Custom description exposed for the capability.
    Enabled bool
    Whether the capability is available through the MCP server.
    Name string
    Name of the tool or prompt capability to override.
    Alias string
    Custom name exposed for the capability.
    Description string
    Custom description exposed for the capability.
    Enabled bool
    Whether the capability is available through the MCP server.
    name string
    Name of the tool or prompt capability to override.
    alias string
    Custom name exposed for the capability.
    description string
    Custom description exposed for the capability.
    enabled bool
    Whether the capability is available through the MCP server.
    name String
    Name of the tool or prompt capability to override.
    alias String
    Custom name exposed for the capability.
    description String
    Custom description exposed for the capability.
    enabled Boolean
    Whether the capability is available through the MCP server.
    name string
    Name of the tool or prompt capability to override.
    alias string
    Custom name exposed for the capability.
    description string
    Custom description exposed for the capability.
    enabled boolean
    Whether the capability is available through the MCP server.
    name str
    Name of the tool or prompt capability to override.
    alias str
    Custom name exposed for the capability.
    description str
    Custom description exposed for the capability.
    enabled bool
    Whether the capability is available through the MCP server.
    name String
    Name of the tool or prompt capability to override.
    alias String
    Custom name exposed for the capability.
    description String
    Custom description exposed for the capability.
    enabled Boolean
    Whether the capability is available through the MCP server.

    Import

    $ pulumi import cloudflare:index/zeroTrustAccessAiControlsMcpServer:ZeroTrustAccessAiControlsMcpServer example '<account_id>/<id>'

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo cloudflare logo
    Viewing docs for Cloudflare v6.20.0
    published on Tuesday, Aug 25, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-cloudflare

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial