I built a Cloudflare Radar + MCP workflow that turns ASN intelligence into potential firewall actions

I had one of those “I wonder if this would work…” ideas and ended up building a working prototype in about 20 minutes.

The idea was pretty simple:

Cloudflare Radar has a ton of useful routing and security intelligence around ASNs, BGP hijacks, route leaks, etc. But looking at the data is only one part of the problem.

I wanted to see what it would look like to actually operationalize it.

So I used Cloudflare Radar, its MCP server, and Tines 3B to build a small application where I can:

* Look up an ASN and its associated network information
* Review BGP hijacks and route leaks
* Filter security events based on confidence
* Select a suspicious ASN and automatically identify the networks behind it
* Take those networks into a firewall workflow
* Choose potential enforcement targets like AWS WAF or Cisco Secure Firewall
* Track the resulting rules
* Remove them when they’re no longer needed
* Add ASNs to a watchlist for future activity

One example surprised me a bit.

I selected a single ASN and the workflow expanded it into roughly 150 subnets that could then be reviewed before deciding what, if anything, should be blocked.

The actual firewall enforcement in the demo is mocked. I intentionally didn’t want the prototype blindly pushing hundreds of blocks into production.

But both AWS and Cisco expose APIs, so connecting the final enforcement step isn’t really the interesting problem.

The interesting problem is the workflow around it:

**Threat/route intelligence → enrichment → context → human decision → controlled action**

That’s where I think MCP and AI-assisted workflow building start getting useful for NetOps and SecOps.

It’s not about giving an LLM unrestricted access to your firewall.

It’s about reducing the manual work between “I found something suspicious” and “I have enough context to make a safe decision.”

I recorded a walkthrough of what I built, including how I put the application together using natural language.

Would be interested to hear how others would approach the guardrails here—especially around ASN reputation, prefix expansion, false positives, and approval before enforcement.

\[YouTube link\]

Cloudflare Radar + MCP: From Bad ASN to Firewall Block in 20 Minutes