OAuth Full Access grant returns error 10000 for Rulesets GET endpoints

[ReubenBTalbott]

Filed by GPT-5.6 Sol on behalf of Reuben.

MCP Client

Other: GitHub Copilot desktop app 1.0.79-9

Authentication Type

OAuth

OAuth Scopes

Full Access selected during authorization; Zone WAF Read was visibly enabled.

MCP Server Configuration

{
  "mcpServers": {
    "cloudflare-api": {
      "type": "http",
      "url": "https://mcp.cloudflare.com/mcp"
    }
  }
}

Failing Endpoint / Tool

execute calling Rulesets endpoints, including:

• GET /zones/{zone_id}/rulesets
• GET /zones/{zone_id}/rulesets/phases/http_request_firewall_custom/entrypoint
• GET /zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint
• GET /accounts/{account_id}/rulesets

Bug Description

A freshly authorized Full Access OAuth grant can successfully read identity, zone details, analytics, and zone settings, but all tested modern Rulesets GET endpoints fail with Cloudflare API error 10000: Authentication error. Zone details report both #waf:read and #waf:edit, and the user is a Super Administrator.

This resembles #178, but affects read requests after the reported fix.

Steps to Reproduce

1. Configure https://mcp.cloudflare.com/mcp in GitHub Copilot desktop.
2. Authorize using OAuth and select Full Access, including Zone WAF Read.
3. Call GET /zones/{zone_id} through execute; it succeeds and reports WAF read/edit permissions.
4. Call GET /zones/{zone_id}/settings/security_level; it succeeds.
5. Call GET /zones/{zone_id}/rulesets; it fails with error 10000.
6. Call custom/managed Rulesets phase entrypoints or account Rulesets; they fail identically.
7. Revoke the upstream authorization under Cloudflare Connected Applications, remove the MCP connection, reconnect, and authorize Full Access again. The failures persist.

Expected Behavior

Rulesets GET requests should succeed with a fresh OAuth grant containing Zone WAF Read (and Full Access).

Actual Behavior

Every tested Rulesets GET returns:

MCP server 'cloudflare': Error: Cloudflare API error: 10000: Authentication error

Additional Context

• The same OAuth connection successfully calls /user, /zones/{zone_id}, GraphQL Analytics, and zone settings endpoints.
• Legacy WAF endpoint /zones/{zone_id}/firewall/waf/overrides reaches the API and returns error 1040 stating legacy WAF is deprecated and Managed Rulesets should be used.
• /user/tokens/verify returns Invalid API Token, as expected for an OAuth bearer rather than an API token.
• No account IDs, zone IDs, tokens, or authorization URLs are included here.