AI agent skill · by @automateyournetwork

Cloudflare Security

Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.

Archived 2026-10-23 · Source updated 2026-10-11 · License: Apache-2.0. Check the original repository for the latest version.

SKILL.md instructions

# Cloudflare Security Skill

Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.

## Tools

| Tool | Description |
|------|-------------|
| `list_firewall_rules` | List WAF and firewall rules |
| `get_firewall_events` | Get firewall event logs |
| `list_audit_logs` | List account audit log entries |
| `get_audit_log` | Get details for an audit log entry |
| `list_security_events` | List security events and threats |
| `get_threat_score` | Get threat score for an IP address |

## Example Queries

```
List all firewall rules for example.com

Show firewall events from the last 24 hours

Show Cloudflare audit logs for today

What is the threat score for IP 1.2.3.4?
```

## Prerequisites

- `CLOUDFLARE_API_TOKEN` with Firewall:Read, Audit Logs:Read scopes
- `CLOUDFLARE_ACCOUNT_ID` from dashboard

## Servers

This skill uses:
- `cloudflare-observability` at `observability.mcp.cloudflare.com`
- `cloudflare-audit-logs` at `audit-logs.mcp.cloudflare.com`
- `cloudflare-radar` at `radar.mcp.cloudflare.com` (for threat intel)

## Failure Behavior

- On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
- For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.