Cloudflare Security Skill
Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.
Tools
| Tool | Description |
|---|---|
list_firewall_rules | List WAF and firewall rules |
get_firewall_events | Get firewall event logs |
list_audit_logs | List account audit log entries |
get_audit_log | Get details for an audit log entry |
list_security_events | List security events and threats |
get_threat_score | Get threat score for an IP address |
Example Queries
List all firewall rules for example.com Show firewall events from the last 24 hours Show Cloudflare audit logs for today What is the threat score for IP 1.2.3.4?
Prerequisites
CLOUDFLARE_API_TOKENwith Firewall:Read, Audit Logs:Read scopesCLOUDFLARE_ACCOUNT_IDfrom dashboard
Servers
This skill uses:
cloudflare-observabilityatobservability.mcp.cloudflare.comcloudflare-audit-logsataudit-logs.mcp.cloudflare.comcloudflare-radaratradar.mcp.cloudflare.com(for threat intel)
Failure Behavior
- On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
- For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.


