Cloudflare Infrastructure Operations
Manage Cloudflare services: Workers, KV, R2, D1, Hyperdrive, Observability, Builds, and Audit Logs.
MCP is optional. This skill works with MCP (auto), Wrangler CLI, or Dashboard. See BACKENDS.md for execution options.
Permission Tiers
| Tier |
Purpose |
Scope |
Risk Control |
| Diagnose |
Read-only/query/troubleshoot |
Observability, Builds, Audit |
Default entry, no writes |
| Change |
Create/modify/delete resources |
KV, R2, D1, Hyperdrive |
Requires confirmation + verification |
| Super Admin |
Highest privileges |
All + Container Sandbox |
Only in isolated/test environments |
Security Rules
Read Operations
- Define scope first — account / worker / resource ID
- No account set? — List accounts first, then set active
- Evidence required — Conclusions must have logs/screenshots/audit records
Write Operations (Three-step Flow)
1. Plan: Read current state first (list/get)
2. Confirm: Output precise change (name/ID/impact), await user confirmation
3. Execute: create/delete/update
4. Verify: audit logs + observability confirm no new errors
Prohibited Actions
- ❌ Execute create/delete/update without confirmation
- ❌ Delete production resources (unless user explicitly says "delete production xxx")
- ❌ Use Super Admin privileges in non-isolated environments
- ❌ Use container sandbox as persistent environment
Operation Categories
Diagnose Tier (Read-only)
| Category |
What You Can Do |
| Observability |
Query worker logs/metrics, discover fields, explore values |
| Builds |
List build history, get build details, view build logs |
| Browser |
Fetch page HTML, convert to markdown, take screenshots |
| Audit |
Pull change history by time range |
| Workers |
List workers, get details, view source code |
Change Tier (Write Operations)
| Resource |
Operations |
| KV |
List, get, create ⚠️, update ⚠️, delete ⚠️ |
| R2 |
List, get, create ⚠️, delete ⚠️ |
| D1 |
List, get, query, create ⚠️, delete ⚠️ |
| Hyperdrive |
List, get, create ⚠️, edit ⚠️, delete ⚠️ |
⚠️ = Requires confirmation
Super Admin Tier (Container Sandbox)
Temporary container for isolated tasks (~10 min lifecycle):
- Initialize, execute commands, read/write/delete files
- Use for: running tests, reproducing issues, parsing data
- NOT for: persistent state, production workloads
Common Workflows
Troubleshooting Flow
1. Clarify symptoms → worker name / time range / error type
2. Query observability to pull logs/metrics
3. If build-related → get build logs
4. If page-related → take screenshot to reproduce
5. Trace changes → pull audit logs
6. Summarize: root cause + evidence + fix recommendations
Resource Management Flow
1. List accounts → set active account
2. List resources (KV / R2 / D1)
3. Plan changes → present to user
4. Execute after confirmation
5. Verify: audit logs + observability shows no errors
Output Format
- Language: English
- Structure: Conclusion → Key data/evidence → Tool call summary → Next steps
- Write operations: Must clearly list operations and impact scope
Example:
✅ Investigation complete: worker `api-gateway` experienced 5xx spike between 18:00-18:30
Root cause: New code deployed threw TypeError when processing /v2/users
Evidence:
- Logs: 18:02 first occurrence of "Cannot read property 'id' of undefined"
- Audit: 18:00 user dev@example.com deployed new version
- Metrics: error_rate jumped from 0.1% to 12%
Recommendation: Roll back to previous version, or fix /v2/users handler
File-based Pipeline
When integrating into multi-step workflows:
runs/<workflow>/active/<run_id>/
├── proposal.md # Symptoms/objectives
├── context.json # Account/worker/resource/time_range
├── tasks.md # Checklist + approval gate
├── evidence/observability.md
├── evidence/audit.md
├── evidence/screenshots/
├── evidence/change-plan.md # Write operations written here first
├── evidence/report.md # Conclusion + evidence + next steps
└── logs/events.jsonl # Optional tool call summary
Error Handling
| Situation |
Action |
| Account not set |
Run accounts_list → set_active_account first |
| Resource doesn't exist |
Verify ID/name, list available resources |
| Insufficient permissions |
Explain required permissions, check API token scope |
| Observability query too broad |
Split into smaller time ranges |
Related Files
- BACKENDS.md — Execution options (MCP/CLI/Dashboard)
- SETUP.md — MCP configuration (optional)
- scenarios.md — 20 real-world scenario examples
1---2name: cloudflare3description: Infrastructure operations for Cloudflare: Workers, KV, R2, D1, Hyperdrive, observability, builds, audit logs. Triggers: worker/KV/R2/D1/logs/build/deploy/audit. Three permission tiers: Diagnose (read-only), Change (write requires confirmation), Super Admin (isolated environment). Write operations follow read-first, confirm, execute, verify pattern. MCP is optional — works with Wrangler CLI/Dashboard too.4---56# Cloudflare Infrastructure Operations78Manage Cloudflare services: Workers, KV, R2, D1, Hyperdrive, Observability, Builds, and Audit Logs.910> **MCP is optional.** This skill works with MCP (auto), Wrangler CLI, or Dashboard. See [BACKENDS.md](BACKENDS.md) for execution options.1112## Permission Tiers1314| Tier | Purpose | Scope | Risk Control |15|------|---------|-------|--------------|16| **Diagnose** | Read-only/query/troubleshoot | Observability, Builds, Audit | Default entry, no writes |17| **Change** | Create/modify/delete resources | KV, R2, D1, Hyperdrive | Requires confirmation + verification |18| **Super Admin** | Highest privileges | All + Container Sandbox | Only in isolated/test environments |1920## Security Rules2122### Read Operations231. **Define scope first** — account / worker / resource ID242. **No account set?** — List accounts first, then set active253. **Evidence required** — Conclusions must have logs/screenshots/audit records2627### Write Operations (Three-step Flow)28```291. Plan: Read current state first (list/get)302. Confirm: Output precise change (name/ID/impact), await user confirmation313. Execute: create/delete/update324. Verify: audit logs + observability confirm no new errors33```3435### Prohibited Actions36- ❌ Execute create/delete/update without confirmation37- ❌ Delete production resources (unless user explicitly says "delete production xxx")38- ❌ Use Super Admin privileges in non-isolated environments39- ❌ Use container sandbox as persistent environment4041## Operation Categories4243### Diagnose Tier (Read-only)4445| Category | What You Can Do |46|----------|-----------------|47| **Observability** | Query worker logs/metrics, discover fields, explore values |48| **Builds** | List build history, get build details, view build logs |49| **Browser** | Fetch page HTML, convert to markdown, take screenshots |50| **Audit** | Pull change history by time range |51| **Workers** | List workers, get details, view source code |5253### Change Tier (Write Operations)5455| Resource | Operations |56|----------|------------|57| **KV** | List, get, create ⚠️, update ⚠️, delete ⚠️ |58| **R2** | List, get, create ⚠️, delete ⚠️ |59| **D1** | List, get, query, create ⚠️, delete ⚠️ |60| **Hyperdrive** | List, get, create ⚠️, edit ⚠️, delete ⚠️ |6162⚠️ = Requires confirmation6364### Super Admin Tier (Container Sandbox)6566Temporary container for isolated tasks (~10 min lifecycle):67- Initialize, execute commands, read/write/delete files68- Use for: running tests, reproducing issues, parsing data69- NOT for: persistent state, production workloads7071## Common Workflows7273### Troubleshooting Flow74```751. Clarify symptoms → worker name / time range / error type762. Query observability to pull logs/metrics773. If build-related → get build logs784. If page-related → take screenshot to reproduce795. Trace changes → pull audit logs806. Summarize: root cause + evidence + fix recommendations81```8283### Resource Management Flow84```851. List accounts → set active account862. List resources (KV / R2 / D1)873. Plan changes → present to user884. Execute after confirmation895. Verify: audit logs + observability shows no errors90```9192## Output Format9394- **Language**: English95- **Structure**: Conclusion → Key data/evidence → Tool call summary → Next steps96- **Write operations**: Must clearly list operations and impact scope9798Example:99```100✅ Investigation complete: worker `api-gateway` experienced 5xx spike between 18:00-18:30101102Root cause: New code deployed threw TypeError when processing /v2/users103Evidence:104- Logs: 18:02 first occurrence of "Cannot read property 'id' of undefined"105- Audit: 18:00 user dev@example.com deployed new version106- Metrics: error_rate jumped from 0.1% to 12%107108Recommendation: Roll back to previous version, or fix /v2/users handler109```110111## File-based Pipeline112113When integrating into multi-step workflows:114115```116runs/<workflow>/active/<run_id>/117├── proposal.md # Symptoms/objectives118├── context.json # Account/worker/resource/time_range119├── tasks.md # Checklist + approval gate120├── evidence/observability.md121├── evidence/audit.md122├── evidence/screenshots/123├── evidence/change-plan.md # Write operations written here first124├── evidence/report.md # Conclusion + evidence + next steps125└── logs/events.jsonl # Optional tool call summary126```127128## Error Handling129130| Situation | Action |131|-----------|--------|132| Account not set | Run accounts_list → set_active_account first |133| Resource doesn't exist | Verify ID/name, list available resources |134| Insufficient permissions | Explain required permissions, check API token scope |135| Observability query too broad | Split into smaller time ranges |136137## Related Files138139- [BACKENDS.md](BACKENDS.md) — Execution options (MCP/CLI/Dashboard)140- [SETUP.md](SETUP.md) — MCP configuration (optional)141- [scenarios.md](scenarios.md) — 20 real-world scenario examples
enuno