Developer tools
Give your agents access to Cloudflare.
Agents manage DNS records and zone settings, look into failing Workers, and work with KV, R2, D1, WAF rules, and Zero Trust. Supported alerts can start workflows for health check changes, DDoS attacks, Pages deployments, and SSL certificate changes. Availability depends on your account and permissions.
5,000 free credits to start.
Agent reach
Cloudflare API v4
The full surface, searched at run time.
Connect with
- API key
- Your own OAuth app
Use an API token, or your own OAuth app with the scopes Helios requests. Give it Notifications Edit so Helios can register the alerts for triggers.
Event triggers
Yes · 5 events
Plus manual, schedule, and signed webhook.
What the agent can do
What agents do with Cloudflare
Helios searches the Cloudflare API v4 at run time. The agent finds the endpoint the task needs and calls it.
- Look up REST endpoints in a pinned Cloudflare API specification and call them with your connection credentials.
- Create, update, and delete DNS records, and change zone settings such as the security level.
- Purge cached files after a deploy.
- Inspect Workers, their versions and deployments, query their logs, and set secrets.
- Read and write Workers KV, manage R2 buckets, and query D1 databases.
- Start a run on supported Cloudflare alerts, with optional zone filters for alerts about a zone.
Examples
Tasks you can hand to a Cloudflare agent
Fail over when a health check goes down
When a health check reports an unhealthy origin, the agent points the DNS record at the backup origin and tells the team.
When the api.example.com health check goes unhealthy, point its DNS record at the backup origin.
- cloudflare·read the health check alert
- cloudflare·find the A record for the failing origin
- cloudflare·point the record at the backup origin
- slack·post the change to #incidents
api.example.com moved to the backup origin
- The primary origin failed its health check in 3 regions
- The A record now points at the backup origin
- Posted in #incidents with the health check details
Respond to a DDoS attack
When Cloudflare reports an HTTP DDoS attack, the agent turns on Under Attack mode for the zone and writes up what it saw.
On an HTTP DDoS alert, turn on Under Attack mode for the zone and summarize the attack.
- cloudflare·read the DDoS alert
- cloudflare·set the zone's security level to Under Attack
- slack·post a summary to #security
Under Attack mode on for example.com
- Attack on shop.example.com peaked at 48,000 requests a second
- Cloudflare mitigated it with the HTTP DDoS managed ruleset
- Posted in #security with the attack details
Debug a failing Worker
A scheduled agent reads a Worker's recent errors and opens an issue with the stack trace and the last deploy.
Every hour, find new errors in the checkout Worker's logs and open an issue.
- cloudflare·query the Worker's logs for the last hour
- cloudflare·list the Worker's recent deployments
- github·find the commit behind the last deploy
- github·open an issue with the stack trace
Issue opened for checkout-worker
- TypeError in the cart handler since the 14:02 deploy
- 1,240 failed requests in the last hour
- Linked to the commit that changed the cart schema
Audit DNS records every week
A scheduled agent lists DNS records across your zones and flags records that point at retired origins or are missing a proxy.
Every Monday, list DNS records that point at retired origins and post them to Slack.
- cloudflare·list the account's zones
- cloudflare·list DNS records in each zone
- code·compare them with the origin list
- slack·post the list to #platform
DNS audit for 6 zones
- 3 records point at decommissioned servers
- 2 records are DNS-only and expose the origin IP
Event triggers
Start a run on Cloudflare events
Attach any of these events to a workflow and filter on the fields that matter. Manual, schedule, and signed webhook triggers work too.
| Event | What it means |
|---|---|
health_check_status_notification.sent | A health check's origin becomes healthy or unhealthy, so an agent can fail over or bring it back. |
dos_attack_l7.sent | Cloudflare mitigates an HTTP DDoS attack on a zone, so an agent can tighten security and write it up. |
pages_event_alert.sent | A Pages deployment starts, fails, or succeeds, so an agent can look into a failed build. |
universal_ssl_event_type.sent | A Universal SSL certificate is validated, issued, renewed, or about to expire. |
tunnel_health_event.sent | A Cloudflare Tunnel's health changes, so an agent can check the connector behind it. |
Works with
Cloudflare works with the rest of your stack
One agent, one run, several services. It reads from one tool and writes to the next in the same sandbox.
FAQ
Questions, answered
Put an agent on Cloudflare.
Connect it once and describe the task in chat. Then reuse the prompt as a workflow on a schedule or a webhook.