When “PLS FIX NOW” Isn’t Enough: New AI Tools for Cloudflare One Troubleshooting

Performance tickets are the bane of any IT department’s existence. A user reports that an application is slow, but the root cause could live anywhere: the endpoint’s Wi-Fi, the corporate backbone, a SaaS provider’s cloud, or an intermediary ISP. With distributed workforces and cloud-centric architectures, isolating the fault is often harder than fixing it.

Cloudflare is tackling this head-on with two new AI-powered features within its Cloudflare One SASE platform. Both the WARP diagnostic analyzer and a new MCP (Model Context Protocol) server for DEX are now generally available at no extra cost to all Cloudflare One customers. These tools aim to cut through the complexity of log analysis and give network teams a fast path to root cause.

Automated WARP Log Analysis

When a WARP client misbehaves, its diagnostic logs contain a wealth of data spanning days of client-side events. The problem is that parsing those logs manually to find the smoking gun requires deep expertise. Previously, Cloudflare advised customers to ship these logs to their support team for manual root cause analysis.

That workflow is changing with the WARP diagnostic analyzer. Available in the Zero Trust dashboard, this new AI processes the diagnostic file produced by a remote capture and highlights the events most likely to impact connectivity and performance. To use it, navigate to DEX > Remote Captures in the Zero Trust dashboard, run a diagnostic, and select View WARP Diag on the result.

BLOG-2890 Image 1

The analysis presents an executive summary of events that merit a deeper look, followed by a detailed list of detected occurrences. Each event entry links to a page that explains what the event means, recommends troubleshooting resources, and shows a timestamped list of recent occurrences on the device.

BLOG-2890 Image 3
BLOG-2890 Image 4

Administrators can export the full AI summary via the JSON file tab or download the raw WARP Diag file for further offline investigation.

BLOG-2890 Image 5

Querying DEX with Natural Language

The second release is a technology that repurposes DEX data for self-service analytics. Cloudflare DEX monitors device, network, and application performance via the WARP client. Historically, deriving custom insights from this telemetry meant building pipelines to stream API data or logs into a SIEM—a costly and time-consuming engineering effort that not every team can afford.

The new DEX MCP server standardizes AI-to-application connections. It allows network and security practitioners to query the same DEX API data conversationally. Instead of designing a dashboard, an admin can ask, “Show me the performance data for [email protected]’s device in a few graphs,” and the MCP server will pull the relevant data and generate a customized visualization.

A Walkthrough: Solving a Slow DNS Issue

The practicality is best illustrated by an example. Consider a ticket from [email protected] about poor device performance. An admin could ask the DEX MCP server to investigate. The server begins by checking the device’s overall health metrics.

Overall Device Health:
✅ Connection Status: Consistently connected for the past 24 hours with 100% availability
✅ WARP Mode: Running in optimal "warp+doh" (WARP + DNS over HTTPS) mode
✅ Client Version: Up-to-date with version 2025.1.7.2

If the baseline looks healthy, the MCP server moves on to analyze results from configured performance tests. In this scenario, it compares resource fetch times across various HTTP targets.

📊 Performance Metrics Analysis

HTTP Response Times:
Google.com test: Average 247ms (Range: 81-649ms)
  • Shows significant improvement throughout the day: Started at ~317ms, dropped to ~211ms by evening
Wiki.internal.acme.com: Average 1,374ms (Range: 877-2,431ms)
  • This is notably high and could be the source of performance complaints
  • DNS resolution particularly slow: Average 616ms with spikes up to 1,600ms

In a typical troubleshooting flow, the server identifies that the HTTP GET test for wiki.internal.acme.com shows a high average resource fetch time compared to external sites like google.com. The breakdown would point to slow DNS resolution as the culprit, corroborated by elevated HTTP 400 errors on the internal wiki.

🚨 Performance Issues Identified
Extremely Slow DNS Resolution:
  • Average DNS response time of 616ms is significantly high
  • Normal DNS should be <50ms for good performance
High Resource Fetch Times on wiki.internal.acme.com:
   • 1.3+ second response times indicate potential application-level issues
   • Could be related to DNS performance or server-side delays
HTTP Status Code Issues:
        • wiki.internal.acme.com is showing consistent HTTP 400 errors
        • This suggests potential configuration or routing issues

In this synthetic case, the final conclusion is that high average DNS response times are degrading the wiki’s performance and generating errors. The systemic nature of the DNS problem also suggests other internal applications could be affected, prompting the server to recommend broader fixes.

🔧 DNS Optimization Strategies

Check WARP DNS configuration and settings
  • Since the device is using WARP+DoH mode, you can optimize the DNS settings
Implement or improve local DNS caching
  • Implement or improve local DNS caching to reduce repeated lookups
Network stack tuning
  • Optimize TCP / UDP settings for DNS

Getting Started with the DEX MCP Server

Customers on Free, PayGo, or Enterprise plans have two ways to connect to the DEX MCP server.

Option 1: Cloudflare’s AI Playground

The quickest test requires no local setup. Users can connect to the server at https://dex.mcp.cloudflare.com/sse directly from playground.ai.cloudflare.com:

  1. Copy the server URL.
  2. Open the playground in a browser.
  3. Locate the MCP Servers section in the left sidebar.
  4. Paste the URL and click Connect.
  5. Authenticate to Cloudflare, then begin querying.

This interface requires explicit, specific prompts. Users may need to issue separate commands for context, such as “Set my production account as the active account,” followed by “Fetch the DEX test results for the user [email protected] over the past 24 hours.”

Option 2: Configuration with an AI Assistant

A richer conversational experience is available by configuring the DEX MCP server into an AI assistant with MCP support, such as Claude, Gemini, or ChatGPT. Some assistants may require a paid subscription for MCP features. The official documentation covers setup for each major vendor.

For example, in Claude Desktop, users can open Claude Code > Developer > Edit Config and add the MCP server configuration to claude_desktop_config.json in a code editor.

{
  "globalShortcut": "",
  "mcpServers": {
    "cloudflare-dex-analysis": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://dex.mcp.cloudflare.com/sse"
      ]
    }
  }
}

Both the WARP diagnostic analyzer and the DEX MCP server address the same fundamental problem: making enterprise network performance data actionable without requiring a bespoke data engineering project. They put the log analysis and API queries behind conversational or automated AI, shrinking the time from ticket to resolution. The tools are available now for existing customers through the Zero Trust dashboard and the MCP server endpoint, respectively.