agent-cloudflare

Cloudflare ops triage CLI for AI agents

Language
Go
Version
0.12.3
License
PolyForm Perimeter 1.0.0
Category
CLI Tool
View on GitHub

A read-first, secret-safe Cloudflare operations CLI. Accounts, zones and DNS, SSL/TLS, rulesets and WAF, cache, Workers, KV, R2, Waiting Rooms, audit logs and analytics — with named investigations that answer a question rather than dumping an endpoint, and snapshots you can diff against a baseline. It fills the gap between raw API calls and Wrangler's Worker-focused developer loop.

Features

01

Read-first and secret-safe by default — tokens are stored outside model-visible output, and mutations need explicit opt-in

02

Named investigations — zone-health, traffic-spike, cache-miss, waf-block, ssl-breakage, dns-change and worker-error, each returning evidence and findings rather than raw endpoint output

03

Snapshots and baselines — capture a zone's configuration, then diff it against a baseline to see what actually changed

04

Broad read surface — accounts, zones, zone settings, DNS, SSL, rulesets, cache, analytics, audit logs, Workers, KV namespaces, R2 buckets and Waiting Rooms

05

Every mutation is gated — cache purge and friends require --dry-run or --confirm, and --reason records why

06

Multi-id gets — get <id>... returns one NDJSON line per id, or an @unresolved control line for a miss, so one bad id does not lose the batch

07

Profiles discover their own defaults — profiles discover fills in account and zone ids for you, so they stop being something to look up

08

Structured errors on stderr, classified so an agent can tell a bad parameter from a permissions problem

09

Tested against a local fixture Cloudflare server, so the surface is exercised without an account

Install

Homebrew

>_ 
$ brew install shhac/tap/agent-cloudflare

AI Agent Skill

>_ 
$ npx skills add shhac/agent-skills --skill agent-cloudflare --global

GitHub Release (macOS)

>_ 
$ curl -L https://github.com/shhac/agent-cloudflare/releases/latest/download/agent-cloudflare-darwin-arm64.tar.gz | tar xz

Go Install

>_ 
$ go install github.com/shhac/agent-cloudflare/cmd/agent-cloudflare@latest

Build from Source

>_ 
$ git clone https://github.com/shhac/agent-cloudflare.git && cd agent-cloudflare && make build

Getting Started

agent-cloudflare is built around named profiles. A profile holds the token reference plus non-secret defaults such as account and zone ids — and it can work those defaults out for itself.

01 · Add a profile without the token in view

>_ 
$ agent-cloudflare profiles add prod --form --account-id <account_id>

--form takes the API token outside the LLM's context. profiles is the canonical group; auth remains a hidden compatibility alias.

02 · Let it find the rest

>_ 
$ agent-cloudflare profiles discover prod --zone example.com

Fills in the account and zone ids the profile needs, so they stop being something you look up by hand.

03 · Check the credential

>_ 
$ agent-cloudflare profiles check prod

04 · Ask a question, not an endpoint

>_ 
$ agent-cloudflare investigate zone-health example.com

Investigations return evidence and findings. Mutations always need --dry-run or --confirm.

Usage

>_ Is this zone healthy? 
$ agent-cloudflare investigate zone-health example.com
>_ Why is traffic spiking? 
$ agent-cloudflare investigate traffic-spike example.com --since 1h
>_ Why is the WAF blocking this? 
$ agent-cloudflare investigate waf-block example.com --since 1h
>_ Why are we missing cache? 
$ agent-cloudflare investigate cache-miss example.com --since 1h
>_ Inspect DNS records 
$ agent-cloudflare dns list example.com
>_ Capture a zone's configuration 
$ agent-cloudflare snapshot zone example.com
>_ What changed since the baseline 
$ agent-cloudflare snapshot diff example.com
>_ Purge cache, deliberately 
$ agent-cloudflare cache purge example.com --url https://example.com/a --confirm --reason "incident mitigation"