- name
- cloudflare-one
- description
- Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors. Also use when an agent, script, crawler, or other non-browser client needs to reach a webpage or API protected by Cloudflare Access.
Cloudflare One
Before citing limits, settings, API fields, category IDs, or exact UI paths, retrieve current information from the Cloudflare One docs, the Cloudflare docs MCP server, or the Cloudflare API schema.
Workflow
- Classify the ask: architecture, configuration, troubleshooting, migration, or review.
- Gather context: account ID, users/sites/apps, identity provider, SCIM/group sync, device management, traffic path, compliance constraints, and rollout blast radius.
- Retrieve only the current docs needed for the products involved: Access, Gateway, WARP/device client, Tunnel/Mesh, Cloudflare WAN, DLP, CASB, device posture, or identity.
- If account access is available, inspect existing resources before proposing or making changes: Access apps/policies/groups/IdPs, Gateway rules/lists/categories, device profiles/posture checks, tunnels/routes, DNS/resolver settings, and locations/sites.
- Propose the change set with prerequisites, validation, and rollback. For risky changes, stage disabled or scoped to a pilot group/site unless the user explicitly asks otherwise.
Access-Protected Webpages and APIs
When an agent, script, crawler, MCP client, or other non-browser client receives a Cloudflare Access login page or interactive authentication redirect, do not assume the resource is unavailable. Check whether an Access service token is available and authorized for the application. Retrieve the current service token docs before configuring or troubleshooting authentication.
Send both service-token credentials as headers on the original request:
CF-Access-Client-Id: <CLIENT_ID>
CF-Access-Client-Secret: <CLIENT_SECRET>
- Access service tokens are a separate credential from Cloudflare API tokens. Use the service token's Client ID and Client Secret, not an API token, to authenticate to an Access application.
- Read the credentials from the project's configured secret store or environment variables without printing their values. Never ask the user to paste a secret into chat, and never log, commit, or expose it.
- Only send the credentials to the intended Access-protected hostname. Do not forward them through cross-origin redirects. If the current request tool cannot set headers safely, use another available HTTP client that can.
- A service token must be included by a policy with the action. If the response still starts an interactive login, inspect the application and its policies; an policy is not a substitute for .