MCP Server for AI Agents

The BlazingCDN MCP Server is the official Model Context Protocol server for the platform. It lets an AI agent (Claude, Cursor, Windsurf or any other MCP client) operate your CDN directly from plain instructions: list and configure resources, purge and warm up cache, read traffic metrics, manage custom domains, Cloud Storage and the Video CDN.

The server talks straight to the BlazingCDN API at wapi.blazingcdn.com with your own API token. Nothing sits in between, and the server collects no telemetry or analytics.

The server is open source and published on npm as @blazingcdn/mcp. No installation is needed, npx runs it on demand.

What you need

A BlazingCDN account.
An API access token: panel → Account → API tokens, or POST /api/v1/access_tokens.
Node.js, unless you install the packaged bundle for Claude Desktop, which needs no Node.

Quick start

Claude Code

claude mcp add blazingcdn --env BLAZINGCDN_API_TOKEN=your-token -- npx -y @blazingcdn/mcp

Claude Desktop, Cursor, Windsurf

Add the server to your MCP configuration file (claude_desktop_config.json, .cursor/mcp.json and so on):

{
  "mcpServers": {
    "blazingcdn": {
      "command": "npx",
      "args": ["-y", "@blazingcdn/mcp"],
      "env": {
        "BLAZINGCDN_API_TOKEN": "your-token"
      }
    }
  }
}

Claude Desktop also accepts a one-click bundle: download the latest .mcpb file from the GitHub releases page and double-click it. Claude Desktop asks for the API token and installs the server itself.

Configuration

Environment variable	Required	Description

Environment variable	Required	Description
`BLAZINGCDN_API_TOKEN`	yes	API access token, sent as a Bearer token
`BLAZINGCDN_API_URL`	no	API base URL, defaults to `https://wapi.blazingcdn.com`
`BLAZINGCDN_ALLOW_WRITE`	no	`1` enables create and update tools
`BLAZINGCDN_ALLOW_DELETE`	no	`1` enables the two delete tools

Permission model

The server is safe by default: it starts read-only, plus cache purge and warm-up. Anything that changes configuration is opt-in.

Mode	Tools available	What an agent can do

Mode	Tools available	What an agent can do
default	29	Read everything, purge and warm up the cache
`BLAZINGCDN_ALLOW_WRITE=1`	50	and create or update CDN resources, domains, buckets and Video CDN settings
plus `BLAZINGCDN_ALLOW_DELETE=1`	52	and delete a custom domain or a Video CDN resource

What the 52 tools cover

Anycast CDN

list_cdn_resources, get_cdn_resource, purge_cache, warmup_cache, get_cdn_metrics, get_prometheus_metrics, create_cdn_resource, update_cdn_resource, bulk_update_cdn_resources, update_cdn_locations.

Metrics cover bandwidth, cache hit ratio, requests, HTTP codes and traffic, by day, hour or minute, with filters by region and domain.

Domains and DNS

list_custom_domains, search_custom_domains, list_system_dns_zones, add_custom_domain, update_custom_domain, delete_custom_domain.

Cloud Storage

list_buckets, get_bucket, get_bucket_metrics, get_storage_info, create_bucket, update_bucket, list_external_storages, get_external_storage, create_external_storage, update_external_storage, test_external_storage_connection.

A bucket used as a CDN resource origin must be of type cdn. create_bucket creates that type by default, because private buckets cannot be attached to a pull zone. Pass protocol: "s3" for an S3-compatible bucket; the protocol cannot be changed after creation.

Video CDN

list_vcdn_resources, get_vcdn_resource, get_vcdn_statistics, list_vcdn_domains, get_vcdn_domain, list_vcdn_files, get_vcdn_files_total, list_ftp_logins, list_auto_imports, get_vcdn_proxy, get_vcdn_ftp_settings, get_vcdn_settings, create_vcdn_resource, update_vcdn_resource, create_vcdn_domain, update_vcdn_domain, upload_vcdn_file, manage_auto_import, update_vcdn_proxy, update_vcdn_ftp_settings, manage_ftp_login, update_vcdn_settings, delete_vcdn_resource.

Documentation and pricing

search_docs searches BlazingCDN documentation and product pages. estimate_traffic_cost calculates the monthly cost for a given traffic volume offline, without calling the API.

Not implemented, by design

Some operations are absent from the code entirely and cannot be triggered in any mode, whatever flags are set:

deleting CDN resources (pull zones)
deleting Cloud Storage buckets or external storages
deleting accounts or users
deleting Video CDN domains, files, auto imports or FTP logins

DNS zone management and account or user administration are outside the scope of the server.

HTTP transport

Besides stdio, which is the default, the server speaks Streamable HTTP for remote deployments:

BLAZINGCDN_ALLOW_WRITE=1 npx -y @blazingcdn/mcp --transport http --port 8462

In HTTP mode the server is stateless, and every request must carry the caller's API token in the Authorization: Bearer header. The BLAZINGCDN_API_TOKEN environment variable acts as a fallback. Put the server behind TLS with a reverse proxy before exposing it.

Where to find it

npm: @blazingcdn/mcp
GitHub: github.com/BlazingCDN/BlazingCDN-MCP
Official MCP Registry, Smithery, Glama, Cursor and LobeHub

Security notes

The API token is read from the environment, sent only to the API base URL and never logged.
No telemetry, no analytics, no third-party calls.
Tool output is truncated at 60 KB to keep agent contexts healthy.
API requests time out after 30 seconds; file uploads after 5 minutes.

The full threat model and recommendations live in SECURITY.md in the repository.