agentleFS
Sign inStart free
SentryKnown publishergetsentry/junior/packages/junior-cloudflare/skills/cloudflare/SKILL.md

cloudflare

Skill394 starsChanged 7 months agoApache-2.0View on GitHub

Cloudflare production operations via the Cloudflare API MCP server. Use when users ask to investigate Workers errors or performance, check build or deployment status, query logs, inspect DNS records, check load balancer pool health, review Zero Trust tunnels, or manage Cloudflare resources. Do not use for Sentry issues, GitHub/Linear ticketing, or non-Cloudflare infrastructure.

We split this skill into the rules it gives an agent

10 rules. 0 are common, 7 are distinctive, and 3 are very specific to this project.

  • 0

    Common

    Most of the 56 edited versions we read keep these.

  • 7

    Distinctive

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Use this skill for Cloudflare production operations through Cloudflare's hosted API MCP.

    line 8
  2. Distinctive:

    Default to read-only investigation.

    line 10
  3. Very specific:

    Use docs when Cloudflare product behavior is unclear.

    line 20
  4. Distinctive:

    Keep investigation bounded: last 30 minutes for "right now", last 24 hours for retrospective checks, and recent N builds/deployments unless …

    line 37
  5. Distinctive:

    Before any state-changing API call, load references/safety-and-permissions.md, show current state and the intended change, then wait for …

    line 38
  6. Distinctive:

    Read-first: Default to investigation. Do not execute writes in response to ambiguous requests like "fix this" or "roll it back" — …

    line 43
  7. Very specific:

    Respect channel defaults: When a request mentions "the Worker", "our Worker", deploys, builds, logs, or Worker errors without naming a …

    line 45
  8. Very specific:

    Confirm before writes: No Worker deploy, rollback, DNS create/update/delete, load balancer change, WAF rule change, Access policy change, …

    line 46
  9. Distinctive:

    Redact sensitive data: Do not paste raw log bodies, Worker source, env var values, token values, or authorization headers.

    line 48
  10. Distinctive:

    Stop on auth failures: If the MCP server returns an auth error, stop and tell the user.

    line 49

“Common” is measured: kept by at least 6 in 10 of the 56 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Cloudflare Operations

Use this skill for Cloudflare production operations through Cloudflare's hosted API MCP.

Default to read-only investigation. Cloudflare OAuth or API token scopes are the permission boundary; this plugin cannot allowlist individual Cloudflare API operations inside MCP.

MCP basics

Cloudflare MCP exposes three tools:

  • docs: search Cloudflare developer documentation for product behavior and terminology.
  • search: inspect the current Cloudflare API spec.
  • execute: call Cloudflare APIs with minimal JavaScript.

Use docs when Cloudflare product behavior is unclear. Use search before every execute; the spec is the source of truth for current methods, paths, parameters, and response shapes. Keep execute calls small, scoped, and read-only unless the user has explicitly approved a state-changing change.

Reference loading

Load references conditionally based on the request:

NeedRead
Worker errors, failed builds, logs, Logpush, DNS checks, LB health, tunnelsreferences/workflows.md
Any state-changing request: deploy, rollback, DNS, WAF, LB, Access, Logpush, storage, account membershipreferences/safety-and-permissions.md
Auth failures, permission errors, multiple accounts/zones, rate limits, stale operationsreferences/troubleshooting-workarounds.md

Workflow

  1. Classify the request as read-only investigation or state-changing work.
  2. Resolve target scope: explicit user account/zone/resource wins; otherwise use cloudflare.account.id, cloudflare.zone.id, and cloudflare.worker.name config where relevant; otherwise discover with MCP and ask one focused question if ambiguous.
  3. For any Cloudflare API call, search the MCP API spec first. Do not call Cloudflare API paths from memory or from bundled docs.
  4. Keep investigation bounded: last 30 minutes for "right now", last 24 hours for retrospective checks, and recent N builds/deployments unless the user asks for more.
  5. Before any state-changing API call, load references/safety-and-permissions.md, show current state and the intended change, then wait for explicit approval.
  6. Lead with concrete findings, then evidence. Include dashboard links when IDs are available.

Guardrails

  • Read-first. Default to investigation. Do not execute writes in response to ambiguous requests like "fix this" or "roll it back" — investigate and propose a plan first.
  • Search owns API selection. The bundled references give workflows, not API authority.
  • Respect channel defaults. When a request mentions "the Worker", "our Worker", deploys, builds, logs, or Worker errors without naming a Worker, use cloudflare.worker.name as the default Worker target if it is configured.
  • Confirm before writes. No Worker deploy, rollback, DNS create/update/delete, load balancer change, WAF rule change, Access policy change, or R2/KV/D1 destructive action without explicit user approval after showing current state and change summary.
  • Never delete data by default. For R2, KV, and D1, support list/inspect/read. Avoid delete/truncate/drop unless the user explicitly asks and confirms.
  • Redact sensitive data. Do not paste raw log bodies, Worker source, env var values, token values, or authorization headers.
  • Stop on auth failures. If the MCP server returns an auth error, stop and tell the user. Do not guess at missing permissions.
  • No scope creep. Operate only on the account/zone/resource the user specified. Do not enumerate or modify resources in other accounts or zones.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free