ast cloudflare

Managing Cloudflare security settings via CLI or MCP is error-prone and slow when done manually. This skill provides a specialized interface for investigating and modifying Cloudflare WAF, bot management, and DNS settings using a structured safety model.

What it does

• Traffic analysis by ASN, path, or specific WAF rule using GraphQL analytics.
• Rule management for WAF, including creating, updating, moving, and deleting rules with rollback support.
• Bot control for tuning Bot Fight Mode, security levels, and verified-bot skip rules.
• DNS administration for managing zone records directly through the agent.
• Security auditing via access to audit logs and ruleset versioning to track environment changes.

How it works

1. Discovery phase where the agent lists zones and identifies current rule configurations.
2. Analysis of traffic patterns and security events to identify gaps or false positives.
3. Proposal of changes with a detailed explanation of the target, effect, and undo instructions.
4. Execution through a dry-run process that requires explicit user confirmation before any live platform change.

Frameworks & tools

Uses the ast-cloudflare toolset featuring cf-search and cf-edit CLIs. Integration is supported via sectools-mcp for Claude Code and other MCP-compliant agents.

Why this beats prompting it yourself

Generic agents often guess API parameters or fail to follow strict security protocols. This skill enforces a "read-first" workflow and a mandatory safety gate for all write operations, ensuring changes are verified and reversible.

Use cases

• Identify why a specific WAF rule is not firing for malicious traffic.
• Block or challenge problematic ASNs identified in recent traffic spikes.
• Roll back a ruleset version after observing unintended blocks.
• Tune rate limits for specific API endpoints based on real-time analytics.

Known limitations

Does not support Cloudflare Workers, Zero Trust, Page Rules, or Load Balancing. Requires Python 3.12 or newer for the local toolset.