Integrations · Infrastructure

Cloudflare

Agents that look after your domains — zones, DNS, traffic, and the cache — with the few irreversible changes treated like the irreversible changes they are.

9 actions · out of the box: DNS Engineer, Edge Operator, Traffic Analyst

What your agents get done with it

"Is the domain wired up right?"

The zone is resolved by name first — the guard that keeps an agent from ever touching the wrong domain — then the DNS records and zone health get read: status, nameservers, whether development mode was left on. The answer is a yes, or a list of exactly what is off.

Runs on: cloudflare.zones · cloudflare.dns_records · cloudflare.zone

The traffic question, grouped the way you asked it

"How did the site do this week?" Edge traffic grouped by the dimension the question implies — hourly trend, cache hit ratio, error status, country — and the firewall log when the real question is who is getting blocked. Numbers, not a feeling.

Runs on: cloudflare.traffic · cloudflare.firewall_events

The post-deploy purge, done narrowly

After a deploy the cache purge starts at the narrowest blast radius Cloudflare offers — one exact URL — and widens to a whole hostname only when many paths changed at once. Both purges are labelled irreversible, and the zone is confirmed by name before either runs.

Runs on: cloudflare.purge_urls · cloudflare.purge_host · cloudflare.zones

The verification record, added and accounted for

A vendor asks for a TXT record to prove domain ownership. Existing records are read first, then exactly one TXT record is added — the action cannot edit or delete, so the worst case is a wrong value waiting for a human, never a broken zone.

Runs on: cloudflare.dns_records · cloudflare.dns_add_txt

Every action, honestly listed

The complete seeded set — what each one does and costs, stated before an agent may call it. Nothing hidden, nothing padded.

cloudflare.accountsCloudflare accounts
Lists the Cloudflare accounts your token reaches (ids and names), so an agent working from a brand name cannot read another brand's zones by accident. Free.
read-onlyno vendor charge
cloudflare.zonesFind Cloudflare zones
Turns a domain name into the zone id every other Cloudflare action needs, with status, account, plan, and paused state. Always runs first. Free.
read-onlyno vendor charge
cloudflare.zoneZone health detail
The health of one zone: status, paused, plan, development-mode timer, assigned versus original nameservers, last modified. Free.
read-onlyno vendor charge
cloudflare.dns_recordsList DNS records
The DNS records in one zone — names, types, contents, proxied flags, TTLs — filterable by type or substring. This is the configured state, read before any DNS write. Free.
read-onlyno vendor charge
cloudflare.trafficZone traffic analytics
Requests, visits, and bytes for one zone over a time window, grouped by one dimension you pick: hourly trend, cache status, response status, country, or hostname. Free.
read-onlyno vendor charge
cloudflare.firewall_eventsWAF / firewall events
Raw WAF and firewall event samples for one zone, newest first: action, source, client IP, ASN, country, path, time. Free plans retain a short window only.
read-onlyno vendor charge
cloudflare.purge_urlsPurge one URL from cache
Irreversible, one URL: drops a single exact URL from a zone's Cloudflare cache. The narrowest blast radius available — always preferred over a hostname purge.
writeno vendor charge
cloudflare.purge_hostPurge one hostname from cache
Irreversible, whole hostname: drops every cached asset for one hostname, so its origin absorbs full traffic until the cache refills. Free plan allows 5 per minute.
writeno vendor charge
cloudflare.dns_add_txtAdd a TXT record
Irreversible: creates one live TXT record — domain verification, SPF, DKIM, DMARC. TXT only, and it cannot edit or delete, so a wrong value waits for a human to remove it.
writeno vendor charge

Comes wired into these roles

Every Cloudflare action is a capability any agent in your workforce can hold. Out of the box it comes wired into the roles below — a starting point, not a boundary.

DNS Engineer

Is a domain wired up correctly, and does Cloudflare's config match what the internet resolves?

cloudflare.zones · cloudflare.accounts · cloudflare.zone · cloudflare.dns_records

Traffic Analyst

How a brand is doing at the edge — volume, cache hits, 5xx, and who is getting blocked.

cloudflare.zones · cloudflare.zone · cloudflare.traffic · cloudflare.firewall_events

Edge Operator

The few irreversible Cloudflare changes: purge after a deploy, add a verification TXT.

cloudflare.zones · cloudflare.dns_records · cloudflare.purge_urls · cloudflare.purge_host · cloudflare.dns_add_txt

The full twelve-agent roster, with every action list, is in AI agent examples.

How connecting works

Connect Cloudflare once, in the Ahel desktop app, with your own key — stored by your runtime, not by us, removable at any time. From then on any agent whose job needs it can use it: hand over a job, get back a run with a receipt.

Cloudflare's API works with a scoped API token you create in their dashboard — grant read access for the lookups, and cache-purge and DNS-edit permissions only if you want the write actions. Their platform, their plan terms; Ahel adds no markup.

Costs and limits, honestly

All nine actions are free of per-call charges — they ride the Cloudflare API on whatever plan the zone is on.
Three actions write, and only three: two cache purges and one TXT add. Each is flagged irreversible in its own description, and there is deliberately no broader DNS edit or delete in the catalog.
Free-plan realities are stated where they bite: purge_host is limited to 5 per minute, and firewall events are retained for a short window only.

Questions people actually ask

Can an agent break my DNS with this?

The only DNS write in the catalog is cloudflare.dns_add_txt, and it can only create one TXT record — it cannot edit or delete anything. The worst case is a wrong TXT value that a human removes, not a changed A record or a dropped zone.

Which Cloudflare actions are irreversible?

Three, and they say so in their own descriptions: purge_urls (drops one URL from cache), purge_host (drops a whole hostname's cache), and dns_add_txt (creates a live TXT record). Everything else is a read.

What API token permissions does this need?

A scoped token you create in Cloudflare's dashboard. Read permissions cover the six lookup actions; add cache-purge and DNS-edit permissions only if you want the three writes. The token stays in your own runtime and you can revoke it at Cloudflare any time.

Does this work on a free Cloudflare plan?

Yes — the actions use Cloudflare's standard API. The seed states the free-plan limits where they matter: hostname purges are capped at 5 per minute, and firewall event history is retained for a short window.