Get an overview of an Autonomous System Number (ASN) and its subnet allocations. Useful for understanding the network behind a suspicious IP and assessing whether an entire ASN is involved in attacks.

Get DNS query analytics report for a Cloudflare zone. Returns query counts, response codes, and query type distributions. Useful for detecting DNS anomalies and attack patterns.

Get historical threat data for a domain. Returns past and current security threat categories and content classifications. Useful for checking if a domain has a pattern of malicious behavior over time.

Get security intelligence for a domain. Returns risk scores, content categories, and DNS information. Useful for investigating suspicious domains found in referrer headers or access logs.

Get threat intelligence for multiple domains at once. Returns risk scores and content categories for each domain. Useful for batch assessment of suspicious domains found in logs.

Get details of a specific custom firewall rule by ID. Returns the full rule configuration including filter expression, action, and priority. Useful for investigating why a specific rule triggered a block.

Get aggregated Security Center insight counts by dimension (severity, class, or type). Useful for quick security posture overview and prioritization.

Get threat intelligence for an IP address. Returns geolocation, ASN, infrastructure type, and security threat categories. Useful for investigating suspicious IPs found in security events or access logs.

Look up an HTTP request log entry by its Cloudflare Ray ID. Returns request details including client IP, path, user agent, status code, and security actions. Useful for investigating why a specific request was blocked or challenged.

Get details of a specific rate limiting rule by ID. Returns the full configuration including threshold, period, action, and match criteria.

Get a specific ruleset with all its rules. Returns the complete rule definitions including expressions, actions, and configurations. Useful for inspecting what traffic patterns are matched by a ruleset.

Get WHOIS registration data for a domain. Returns registrant information, nameservers, and registration/expiration dates. Useful for investigating domain ownership and detecting newly registered suspicious domains.

Get details of a specific Cloudflare zone. Returns zone details such as ID, name, status, and plan.

List Cloudflare accounts accessible with the current API token. Returns account details such as ID, name, and settings.

List audit log entries for a Cloudflare account. Returns operation history including timestamps, actors, actions, and affected resources. Useful for investigating who changed what and when.

List DNS records for a Cloudflare zone. Returns record details such as ID, type, name, content, TTL, and proxy status.

List custom firewall rules for a Cloudflare zone. Returns rule expressions, actions, and priorities. Useful for investigating which rules may be blocking or challenging traffic.

List IP access rules for a Cloudflare zone. Returns rules that block, challenge, or allow specific IPs, CIDRs, ASNs, or countries.

List Workers KV namespaces in a Cloudflare account. Returns namespace details such as ID and title.

List all available HTTP request log fields for a Cloudflare zone. Returns field names and descriptions. Use this to discover which fields can be specified when calling get_log_by_rayid or list_received_logs.

List domains that have resolved to a specific IP address (passive DNS). Useful for identifying shared hosting or malicious infrastructure by revealing which domains point to a given IP.

List rate limiting rules for a Cloudflare zone. Returns thresholds, matching criteria, actions, and bypass rules. Useful for checking brute-force protection and identifying rate-limited traffic.

Retrieve HTTP request logs for a Cloudflare zone within a time range. Returns NDJSON log entries. Time range is limited to 1 hour and data must be at least 5 minutes old. Useful for investigating traffic patterns and anomalies.

List all rulesets for a Cloudflare zone. Returns ruleset metadata (ID, name, kind, phase, version) without individual rules. Use get_ruleset to inspect rules within a specific ruleset.

List Security Center insights for a Cloudflare zone. Returns security issues with severity, type, and classification. Useful for identifying misconfigurations and vulnerabilities.

Get the WAF managed rulesets entrypoint for a Cloudflare zone. Returns which managed rulesets (e.g. Cloudflare Managed Ruleset, OWASP) are enabled and their configuration.

List zones in your Cloudflare account. Returns zone details such as ID, name, status, and plan.

Query security events for a Cloudflare zone using the GraphQL Analytics API. Returns event details including client info, action taken, rule details, bot score, and response status for security event triage.