Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

OAuth Full Access grant returns error 10000 for Rulesets GET endpoints

Open
  • Is something wrong?
#199 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
typescript
Domain
api, authentication

Research direction

Reproduce the OAuth flow through the MCP server's execute entry point, comparing successful /user, /zones/{zone_id}, and settings calls with the failing Rulesets GET endpoints. Trace the authorization handling for those requests and verify that a fresh Full Access grant with Zone WAF Read allows all listed Rulesets calls without error 10000.

Written by the indexing model from the issue text.

Description

Filed by GPT-5.6 Sol on behalf of Reuben.

MCP Client

Other: GitHub Copilot desktop app 1.0.79-9

Authentication Type

OAuth

OAuth Scopes

Full Access selected during authorization; Zone WAF Read was visibly enabled.

MCP Server Configuration
{
  "mcpServers": {
    "cloudflare-api": {
      "type": "http",
      "url": "https://mcp.cloudflare.com/mcp"
    }
  }
}
Failing Endpoint / Tool

execute calling Rulesets endpoints, including:

  • GET /zones/{zone_id}/rulesets
  • GET /zones/{zone_id}/rulesets/phases/http_request_firewall_custom/entrypoint
  • GET /zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint
  • GET /accounts/{account_id}/rulesets
Bug Description

A freshly authorized Full Access OAuth grant can successfully read identity, zone details, analytics, and zone settings, but all tested modern Rulesets GET endpoints fail with Cloudflare API error 10000: Authentication error. Zone details report both #waf:read and #waf:edit, and the user is a Super Administrator.

This resembles #178, but affects read requests after the reported fix.

Steps to Reproduce
  1. Configure https://mcp.cloudflare.com/mcp in GitHub Copilot desktop.
  2. Authorize using OAuth and select Full Access, including Zone WAF Read.
  3. Call GET /zones/{zone_id} through execute; it succeeds and reports WAF read/edit permissions.
  4. Call GET /zones/{zone_id}/settings/security_level; it succeeds.
  5. Call GET /zones/{zone_id}/rulesets; it fails with error 10000.
  6. Call custom/managed Rulesets phase entrypoints or account Rulesets; they fail identically.
  7. Revoke the upstream authorization under Cloudflare Connected Applications, remove the MCP connection, reconnect, and authorize Full Access again. The failures persist.
Expected Behavior

Rulesets GET requests should succeed with a fresh OAuth grant containing Zone WAF Read (and Full Access).

Actual Behavior

Every tested Rulesets GET returns:

MCP server 'cloudflare': Error: Cloudflare API error: 10000: Authentication error
Additional Context
  • The same OAuth connection successfully calls /user, /zones/{zone_id}, GraphQL Analytics, and zone settings endpoints.
  • Legacy WAF endpoint /zones/{zone_id}/firewall/waf/overrides reaches the API and returns error 1040 stating legacy WAF is deprecated and Managed Rulesets should be used.
  • /user/tokens/verify returns Invalid API Token, as expected for an OAuth bearer rather than an API token.
  • No account IDs, zone IDs, tokens, or authorization URLs are included here.
Dominant language
TypeScript
Stars
972
Forks
143
Avg merge
2d 5h
Merged PRs (30d)
54

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/mcp

All issues in cloudflare/mcp

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.