Cloudflare for AI agents
Agents read Cloudflare at once. Changes and sends are held for a person's approval by default.
About Cloudflare
Cloudflare is a global network designed to make everything you connect to the Internet secure, private, fast, and reliable.
What an agent can do in Cloudflare
Every Cloudflare action is classed by the platform as a read, a change or a send. Reads run at once. Changes and sends are held for a person by default.
Runs at once (reads)
Looks things up in Cloudflare without asking first. 31 actions.
- Check Registrar DomainsCheck authoritative registration availability and pricing for up to 20 domains.
- Get Account TokenRetrieve metadata and policies for one account-owned API token.
- Get Bot Management SettingsTool to retrieve a zone's Bot Management configuration (Bot Fight Mode / Super Bot Fight Mode / Enterprise Bot Management). Use after identifying the correct zone_id (e.g., via CLOUDFLARE_LIST_ZONES).
- Get KV NamespaceRetrieve metadata for one Cloudflare Workers KV namespace.
- Get KV ValueRetrieve the stored bytes for a key in a Workers KV namespace.
- List WAF ListsTool to fetch all WAF lists (no items) for an account. Results are paginated; iterate using page and per_page parameters until result_info.total_pages is reached to retrieve all lists. Use after confi
- Get Pages DeploymentRetrieve one Cloudflare Pages deployment and its current build status.
- Get Pages ProjectRetrieve one Cloudflare Pages project and its configuration.
- Get Worker Preview DeploymentRetrieve a specific or latest deployment for a Worker Preview.
- Get Worker Script VersionRetrieve detailed information for one classic Worker script version.
- Get Worker VersionRetrieve one beta Worker version; optional code modules may add megabytes.
- Inventory Developer ResourcesReturn one page each of KV namespaces, Workflows, and D1 databases.
Show all 31
- List Account MembersLists all members of a Cloudflare account with their roles, permissions, and status. Returns detailed information about each account member including their user details (name, email, 2FA status), assi
- List AccountsList all Cloudflare accounts you have ownership or verified access to. Retrieves a paginated list of accounts with their details including account ID, name, type, settings, and creation date. An empty
- List D1 DatabasesList one page of D1 databases in an account. Increment `page` until `result_info` shows all matching databases have been retrieved.
- List DNS recordsTool to list and search DNS records in a Cloudflare zone. Use when you need to find existing DNS record IDs for update or delete operations, especially after a "record already exists" error during cre
- List Email Routing AddressesList Email Routing destination addresses configured for an account.
- List Firewall RulesTool to list firewall rules for a specific DNS zone. Use after confirming the zone ID to retrieve and audit current firewall rules. Does not expose Workers routes or other routing constructs.
- List KV KeysList key names and metadata in a Cloudflare Workers KV namespace.
- List MCP PortalsList Cloudflare Access AI Controls MCP portals with pagination and search.
- List MonitorsTool to list all load-balancer monitors in a Cloudflare account. Use after creating or updating monitors to retrieve a paginated list. Response includes `result_info.total_pages` to determine when all
- List Pages DeploymentsList production or preview deployments for a Cloudflare Pages project. Use `environment` to filter by deployment type and `page` with `per_page` to traverse results; inspect `result_info.total_pages`
- List Pages Project DomainsList custom domains attached to a Cloudflare Pages project, including their validation and verification state.
- List PoolsTool to list all load balancer pools in a Cloudflare account. Use after confirming account ID to discover pool IDs. Paginate using `page` and `per_page`; check `result_info.total_pages` in the respons
- List TunnelsList Cloudflare Tunnel (cloudflared) tunnels in an account to discover tunnel IDs, names, and statuses. Use when you need to find a tunnel_id before performing tunnel operations like routing, DNS conf
- List Worker Build TriggersList Workers Builds trigger configurations associated with one Worker tag.
- List Worker ScriptsList uploaded classic Worker scripts, optionally filtering by tag rules.
- List ZonesLists, searches, sorts, and filters zones in the authenticated account. Use `page`/`per_page` to paginate; check `result_info.total_pages` in the response to iterate all pages. Does not return DNS rec
- Query GraphQL AnalyticsRun a read-only query against Cloudflare's GraphQL Analytics API.
- Get Worker Script ContentRetrieve the deployed content of one Cloudflare Worker script.
- List KV NamespacesList Workers KV namespaces in a Cloudflare account. Sort by namespace `id` or `title` with `order` and `direction`, and paginate with `page` and `per_page`. The response preserves additional namespace
Held for approval by default (changes and sends)
Held for a person's approval by default. The approval is recorded and the action is sent once, never twice, with 10 seconds to undo. 19 actions.
- Create DNS recordTool to create a new DNS record within a specific zone. Requires write privileges and makes live changes to the zone. Use after obtaining the zone ID via CLOUDFLARE_LIST_ZONES to programmatically add
- Create WAF ListCreate a new empty custom list for use in WAF rules and filters. Lists can contain IP addresses, hostnames, ASNs, or redirects. Once created, use separate actions to add items to the list. Note: List
- Create Pages DeploymentCreate a Cloudflare Pages deployment from a Git branch or Direct Upload manifest.
- Create User API TokenCreate a user API token carrying supplied grants. Secure the one-time `result.value`; without `not_before` it is active immediately.
- Create Worker DeploymentDeploy existing Worker versions immediately to live traffic by percentage. `force` can bypass rollback blocks after secret changes.
- Create ZoneCreates a new DNS zone (domain) in Cloudflare. A zone represents a domain and its DNS records. Use this when adding a new domain to manage with Cloudflare. Requires account ID (obtainable via LIST_ACC
- Delete DNS RecordTool to delete a DNS record within a specific zone. Deletion is immediate and irreversible. Use only after confirming both zone and record IDs. Requires write privileges on the zone. Example: "Delete
- Delete WAF ListTool to delete a WAF list. Use when you need to remove a list after verifying no filters reference it. Example: DELETE_LIST(account_id="<account_id>", list_id="<list_id>")
- Delete ZoneTool to delete a zone. Use after confirming the zone identifier to permanently remove a DNS zone and all its DNS records from your Cloudflare account. Example: DELETE_ZONE(zone_identifier="023e105f4ec
- Manage Worker SchedulesGet a Worker's Cron Triggers, or replace all triggers when schedules is supplied.
- Query Worker TelemetryRun a saved or ad-hoc Workers Observability telemetry query.
- Run Workers AI ModelRun a Workers AI model and return non-streaming JSON; streaming is unsupported.
Show all 19
- Start Worker Asset Upload SessionRegister a Worker static-asset manifest and return a one-hour JWT and hash buckets for later asset-upload calls; this action does not upload asset bytes.
- Update DNS recordTool to update an existing DNS record within a specific zone. Use after confirming both zone and record identifiers; only provided fields are modified. Updates to records used by active tunnels take e
- Update WAF ListTool to update the description of a WAF list (cannot update items). Use after confirming list metadata.
- Update Pages ProjectRename a Pages project or update its production branch, build configuration, deployment environments, or source repository settings.
- Update Tunnel ConfigurationTool to update a remotely-managed Cloudflare Tunnel's configuration (ingress rules and routing). Use when you need to programmatically configure hostname-to-origin mappings for a tunnel. WARNING: This
- Update ZoneTool to update properties of an existing zone; changes apply immediately to the live zone. Confirm zone ID and intended change with the user before calling. Only one field can be modified per call.
- Write KV ValueCreate or replace a UTF-8 value in a Cloudflare Workers KV namespace.
Changes wait in Needs you
Changes and sends in Cloudflare are held for a person's approval by default. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.
Related connectors
Cloudflare questions
Can an agent change data in Cloudflare on its own?
Not by default. Changes and sends in Cloudflare are held for a person's approval. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.
What can an agent read in Cloudflare?
This connector lists 31 read actions. Reads run at once, without waiting for approval.
How does Cloudflare connect?
It connects with API key. Connectors are built and maintained by third-party developers; availability is confirmed during scoping.