Validate the configured Cloudflare API token and show its status/permissions.

List Cloudflare accounts accessible by the token.

List zones (domains), optionally filtered by name or status.

Get details of a single zone by ID.

Add a new domain (zone) to an account. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a zone by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Purge a zone's cache — everything, or by files/tags/hosts/prefixes. Requires confirm:true (human-approval gate); without it returns a preview only.

Get HTTP traffic analytics for a zone over a time range (via GraphQL).

Get a single zone setting (e.g. ssl, always_use_https, min_tls_version).

Update a single zone setting (e.g. set ssl=full, always_use_https=on). Requires confirm:true (human-approval gate); without it returns a preview only.

List DNS records of a zone, optionally filtered by type/name.

Create a DNS record (A, AAAA, CNAME, TXT, MX, etc). Requires confirm:true (human-approval gate); without it returns a preview only.

Update an existing DNS record (partial update). Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a DNS record by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Get the DNSSEC status and DS record details for a zone.

Enable or disable DNSSEC for a zone. Requires confirm:true (human-approval gate); without it returns a preview only.

Export all DNS records of a zone as a BIND zone file.

List Worker scripts in an account.

Get a Worker script's settings/metadata.

Create or update (deploy) a Worker script from ES module source. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a Worker script by name. Requires confirm:true (human-approval gate); without it returns a preview only.

List Worker routes (URL patterns mapped to Workers) on a zone.

Create a Worker route mapping a URL pattern to a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a Worker route by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

Create or update a secret binding on a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a secret binding from a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

Set the cron triggers (schedules) for a Worker script. Requires confirm:true (human-approval gate); without it returns a preview only.

List Workers KV namespaces in an account.

Create a new Workers KV namespace. Requires confirm:true (human-approval gate); without it returns a preview only.

List keys in a KV namespace, optionally filtered by prefix.

Read the value of a key in a KV namespace.

Write a value to a key in a KV namespace, with optional TTL. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a key from a KV namespace. Requires confirm:true (human-approval gate); without it returns a preview only.

List R2 buckets in an account.

Create a new R2 bucket. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete an (empty) R2 bucket. Requires confirm:true (human-approval gate); without it returns a preview only.

List D1 databases in an account.

Create a new D1 database. Requires confirm:true (human-approval gate); without it returns a preview only.

Execute a SQL statement against a D1 database (with optional bound params). Requires confirm:true (human-approval gate); without it returns a preview only.

List Cloudflare Pages projects in an account.

Get details of a Cloudflare Pages project.

List WAF rulesets configured on a zone.

Get a single ruleset (with its rules) by ID.

List IP/ASN/country access rules (block/challenge/allow) on a zone.

Create an IP/ASN/country access rule (block, challenge, or whitelist). Requires confirm:true (human-approval gate); without it returns a preview only.

Delete an access rule by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

List page rules on a zone.

Create a page rule (URL pattern + actions like cache_level, forwarding_url). Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a page rule by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

List SSL/TLS certificate packs on a zone.

Get SSL/TLS certificate verification status for a zone.

Order an advanced certificate pack for one or more hostnames. Requires confirm:true (human-approval gate); without it returns a preview only.

List custom hostnames (SSL for SaaS) on a zone.

Add a custom hostname (SSL for SaaS) to a zone. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a custom hostname by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

List Email Routing rules on a zone.

Create an Email Routing rule (forward an address to a destination). Requires confirm:true (human-approval gate); without it returns a preview only.

List verified Email Routing destination addresses in an account.

List Cloudflare Queues in an account.

Create a new Cloudflare Queue. Requires confirm:true (human-approval gate); without it returns a preview only.

Delete a Queue by ID. Requires confirm:true (human-approval gate); without it returns a preview only.

List Cloudflare Tunnels (cloudflared) in an account.

Get details of a Cloudflare Tunnel by ID.

List Turnstile widgets in an account.

Create a Turnstile widget (CAPTCHA alternative) for given domains. Requires confirm:true (human-approval gate); without it returns a preview only.

Search the catalog of Workers AI models available to the account.

Run inference on a Workers AI model (text generation, embeddings, classification). Requires confirm:true (human-approval gate); without it returns a preview only.

List Logpush jobs for a zone or account.

Create a Logpush job streaming a dataset to a destination. Requires confirm:true (human-approval gate); without it returns a preview only.