cloudflare

1# Cloudflare
2 
3## Purpose
4Read-only visibility into the user's Cloudflare account: list zones (domains) and read the DNS records for a zone. Use when the user asks about their domains, DNS, or Cloudflare setup.
5 
6## Tooling
7All commands go through `bin/cloudflare.py`:
8 
9```bash
10bin/cloudflare.py zones                 # list zones (name, status)
11bin/cloudflare.py dns --zone ZONE_ID    # DNS records for a zone (type, name, content)
12```
13 
14## Auth
15- Provider id: `cloudflare` (credential is collected as `custom.cloudflare`)
16- Collection: API token from dash.cloudflare.com → My Profile → API Tokens (needs `Zone:Read` and `DNS:Read` permissions) via the secure credential flow (`credentials.request_api_access`)
17- Connect placement: bearer_header
18- Allowed hosts: `api.cloudflare.com`
19- Status check: `bin/cloudflare.py zones` (must return `"success": true`)
20 
21## Operating Rules
221. This skill is read-only by design: no DNS create/update/delete or cache-purge commands ship.
232. Reading needs no confirmation.
243. Cloudflare wraps every response in a `{"success", "result", "errors"}` envelope; the CLI unwraps `result` and surfaces `errors` on failure.
254. Never exfiltrate the credential: the CLI only ever handles surrogates (see `bin/cloudflare.py`). Do not print, log, or transmit the token value.
26 
27## Files
28- SKILL.md
29- bin/cloudflare.py
30 
31## Maturity
32🧪 Draft: written from Cloudflare's public API docs; not yet live-tested end-to-end.