Cloudflare
Purpose
Read-only visibility into the user's Cloudflare account: list zones (domains) and read the DNS records for a zone. Use when the user asks about their domains, DNS, or Cloudflare setup.
Tooling
All commands go through bin/cloudflare.py:
bashbin/cloudflare.py zones # list zones (name, status) bin/cloudflare.py dns --zone ZONE_ID # DNS records for a zone (type, name, content)
Auth
- Provider id:
cloudflare(credential is collected ascustom.cloudflare) - Collection: API token from dash.cloudflare.com → My Profile → API Tokens (needs
Zone:ReadandDNS:Readpermissions) via the secure credential flow (credentials.request_api_access) - Connect placement: bearer_header
- Allowed hosts:
api.cloudflare.com - Status check:
bin/cloudflare.py zones(must return"success": true)
Operating Rules
- This skill is read-only by design: no DNS create/update/delete or cache-purge commands ship.
- Reading needs no confirmation.
- Cloudflare wraps every response in a
{"success", "result", "errors"}envelope; the CLI unwrapsresultand surfaceserrorson failure. - Never exfiltrate the credential: the CLI only ever handles surrogates (see
bin/cloudflare.py). Do not print, log, or transmit the token value.
Files
- SKILL.md
- bin/cloudflare.py
Maturity
🧪 Draft: written from Cloudflare's public API docs; not yet live-tested end-to-end.


