Cloudflare is a global network designed to make everything you connect to the Internet secure, private, fast, and reliable.
Cloudflare is a global network designed to make everything you connect to the Internet secure, private, fast, and reliable. On Nagent, Cloudflare is exposed as a fully-configurable security & identity tools integration that any agent can call — 20 actions, and API key authentication. No code is required to wire Cloudflare into your workflow — connect it once via the External Integrations panel and reuse it across every agent you build.
Agent builders use Cloudflare to automate the kinds of tasks security & identity tools teams previously handled manually. Concrete examples — each one is a single agent step in Nagent — include:
Every action and trigger is paired with a structured input/output schema (visible in the sections below), so when you wire Cloudflare into Helix — our agentic agent builder — the editor knows exactly what each step expects and produces. Configure once, deploy anywhere across your Nagent agents.
Every operation an agent can call against Cloudflare, with input parameters and output schema. Drop these into any step of an agent built in Helix.
CLOUDFLARE_CREATE_DNS_RECORDTool to create a new DNS record within a specific zone. Requires write privileges and makes live changes to the zone. Use after obtaining the zone ID via CLOUDFLARE_LIST_ZONES to programmatically add DNS entries.
Input parameters
Time to live in seconds; minimum 1. Use 1 for automatic TTL
Additional data object for record types like SRV, LOC, or CAA
DNS record name (e.g., example.com or www.example.com)
List of tags to associate with the record
DNS record type
Human-readable comment for the DNS record
DNS record content (e.g., IP for A records)
Whether the record is receiving Cloudflare performance and security benefits
Priority for MX, SRV, and URI records; required for those types
Zone identifier (UUID) where the DNS record will be created
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_CREATE_LISTCreate a new empty custom list for use in WAF rules and filters. Lists can contain IP addresses, hostnames, ASNs, or redirects. Once created, use separate actions to add items to the list. Note: List availability depends on plan (Free: 1 list, Pro/Business: 10 lists, Enterprise: 1000 lists). Example: CREATE_LIST(account_id="abc123", kind="ip", name="blocklist", description="Block malicious IPs")
Input parameters
Type of the list (required). One of 'ip', 'redirect', 'hostname', or 'asn'. Cannot be null - omit the field if not providing a value.
Informative name for the list (required, max 50 characters). Use this name in filter and rule expressions. Cannot be null - omit the field if not providing a value.
Cloudflare account identifier (required, max 32 characters). Cannot be null - omit the field if not providing a value.
Optional description of the list (max 500 characters).
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_CREATE_ZONECreates a new DNS zone (domain) in Cloudflare. A zone represents a domain and its DNS records. Use this when adding a new domain to manage with Cloudflare. Requires account ID (obtainable via LIST_ACCOUNTS). The zone will be in 'pending' status until nameservers are updated at the domain registrar.
Input parameters
The domain name for the new zone
Zone setup mode: 'full' (DNS hosted by Cloudflare), 'partial' (CNAME setup), or 'secondary' (secondary DNS)
Container for account ID. If not provided, the zone will be created under the default account associated with the API credentials. Must be structured as `{'id': '<account_id>'}` where `id` is obtained via CLOUDFLARE_LIST_ACCOUNTS.
Auto-import existing DNS records from the domain. Ignored for partial zones.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_DELETE_DNS_RECORDTool to delete a DNS record within a specific zone. Deletion is immediate and irreversible. Use only after confirming both zone and record IDs. Requires write privileges on the zone. Example: "Delete DNS record 372e6795... from zone 023e105f4ecef..."
Input parameters
Identifier of the DNS record to delete (e.g., '372e67954025e0ba6aaa6d586b9e0b59').
Identifier of the DNS zone (e.g., '023e105f4ecef8ad9ca31a8372d0c353').
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_DELETE_LISTTool to delete a WAF list. Use when you need to remove a list after verifying no filters reference it. Example: DELETE_LIST(account_id="<account_id>", list_id="<list_id>")
Input parameters
Unique identifier of the WAF list to delete
Cloudflare account identifier
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_DELETE_ZONETool to delete a zone. Use after confirming the zone identifier to permanently remove a DNS zone and all its DNS records from your Cloudflare account. Example: DELETE_ZONE(zone_identifier="023e105f4ecef8ad9ca31a8372d0c353")
Input parameters
Identifier of the zone to delete (32-character hex string).
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_GET_BOT_MANAGEMENT_SETTINGSTool to retrieve a zone's Bot Management configuration (Bot Fight Mode / Super Bot Fight Mode / Enterprise Bot Management). Use after identifying the correct zone_id (e.g., via CLOUDFLARE_LIST_ZONES). This tool is the canonical way to audit bot-related configuration; firewall rules are adjacent controls but not equivalent to Bot Management settings.
Input parameters
Zone identifier (UUID) to retrieve Bot Management settings for. Obtain this from List Zones action.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_GET_LISTSTool to fetch all WAF lists (no items) for an account. Results are paginated; iterate using page and per_page parameters until result_info.total_pages is reached to retrieve all lists. Use after confirming account ID.
Input parameters
Cloudflare account identifier (32 hexadecimal characters) Must match the account owning the target zone to avoid cross-account data mixing.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_ACCOUNT_MEMBERSLists all members of a Cloudflare account with their roles, permissions, and status. Returns detailed information about each account member including their user details (name, email, 2FA status), assigned roles with granular permissions, membership status (accepted/pending/rejected), and access policies. Supports filtering by status, sorting by various fields, and pagination for accounts with many members. Use this action when you need to: - View all users with access to a Cloudflare account - Audit account member permissions and roles - Check membership status of invited users - List members with specific roles or statuses Requires the account ID which can be obtained using the List Accounts action. Note: caller's account role may restrict visibility of some members if permissions are insufficient.
Input parameters
Page number for pagination (must be >= 1). Defaults to 1 if not specified.
Field to sort results by. Options: 'user.first_name' (user's first name), 'user.last_name' (user's last name), 'user.email' (user's email address), or 'status' (membership status). Combine with 'direction' parameter.
Filter members by their membership status: 'accepted' (active members), 'pending' (invited but not yet accepted), or 'rejected' (declined invitations). Omit to return all members regardless of status.
Number of results to return per page (must be between 5 and 50). If not specified, API default (typically 20) is used.
Sort direction for results: 'asc' for ascending or 'desc' for descending order. Works with the 'order' parameter.
The unique identifier (32-character hex string) of the Cloudflare account whose members you want to list
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_ACCOUNTSList all Cloudflare accounts you have ownership or verified access to. Retrieves a paginated list of accounts with their details including account ID, name, type, settings, and creation date. An empty or partial result may indicate insufficient API token scope or permissions, not the absence of accounts. When multiple accounts are returned, confirm the intended account_id before performing any write operations to avoid acting on unintended environments. Use this when you need to: - Discover available accounts before performing account-specific operations - Find an account ID for other API calls that require an account identifier - Audit account configurations and settings - Filter accounts by name or paginate through large account lists
Input parameters
Filter accounts by name Name matching may return multiple results for similar names; always verify the correct account_id from the response.
Page number to retrieve, starting from 1
Number of results per page, between 5 and 50
Direction to order results: 'asc' or 'desc'
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_DNS_RECORDSTool to list and search DNS records in a Cloudflare zone. Use when you need to find existing DNS record IDs for update or delete operations, especially after a "record already exists" error during creation. Returns matching records with their IDs, names, types, content, and other properties.
Input parameters
Filter by exact DNS record name (FQDN). Use this to find records matching a specific hostname.
Page number for pagination. Start at 1.
Filter by DNS record type. Specify the exact record type to narrow results.
Filter matching logic: 'all' requires all filters to match (AND logic), 'any' requires at least one filter to match (OR logic). Defaults to 'all'.
Filter by exact DNS record content/value. Use this to find records pointing to a specific IP or target.
Filter by proxy status. Set to true for proxied records, false for DNS-only records.
Zone identifier (UUID) to list DNS records from
Number of records per page (1-5000000). Defaults to 100. Use lower values for faster responses.
Filter by DNS record names containing this substring. Useful for partial matching.
Filter by comments containing this substring.
Filter by DNS record content containing this substring.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_FIREWALL_RULESTool to list firewall rules for a specific DNS zone. Use after confirming the zone ID to retrieve and audit current firewall rules. Does not expose Workers routes or other routing constructs.
Input parameters
Page number for paginated results, starting from 1 Check result_info.total_pages in the response to determine when all pages have been retrieved.
Match criteria when multiple filters provided: 'all' or 'any'
Field to order results by (e.g., 'priority', 'created_on')
UUID of the zone to list firewall rules for
Number of items per page (1-1000)
Sort direction: 'asc' or 'desc'
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_MONITORSTool to list all load-balancer monitors in a Cloudflare account. Use after creating or updating monitors to retrieve a paginated list. Response includes `result_info.total_pages` to determine when all pages have been fetched.
Input parameters
Page number for paginated results (1-indexed)
Field to sort by (e.g., 'created_on', 'description')
Number of monitors per page (max 100)
Sort direction: 'asc' or 'desc'
Cloudflare account identifier
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_POOLSTool to list all load balancer pools in a Cloudflare account. Use after confirming account ID to discover pool IDs. Paginate using `page` and `per_page`; check `result_info.total_pages` in the response to determine if additional pages exist.
Input parameters
Page number for pagination (1-based). Use with per_page to control result pagination.
Filter pools by monitor ID. Only returns pools using this specific health check monitor.
Number of pools to return per page (1-50). Defaults to returning all pools if not specified.
Cloudflare account identifier (UUID)
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_TUNNELSList Cloudflare Tunnel (cloudflared) tunnels in an account to discover tunnel IDs, names, and statuses. Use when you need to find a tunnel_id before performing tunnel operations like routing, DNS configuration, or debugging.
Input parameters
Filter tunnels by name. Use to find specific tunnels by their name.
Page number for pagination, starting from 1.
Number of tunnels per page. Use for pagination control.
Cloudflare account identifier
Filter by deletion status. Set to true to include deleted tunnels, false to exclude them.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_LIST_ZONESLists, searches, sorts, and filters zones in the authenticated account. Use `page`/`per_page` to paginate; check `result_info.total_pages` in the response to iterate all pages. Does not return DNS records — extract `zone_id` from results before passing to zone-scoped tools (DNS, firewall, etc.). Only zones delegated to Cloudflare nameservers appear; empty results indicate scope or delegation constraints, not errors.
Input parameters
A domain name. Optional filter operators can be provided to extend and refine the search.
Page number of paginated results.
Whether to match all search requirements or at least one (any).
Field to order zones by.
A zone status
Filter zones by account ID and/or account name.
Number of zones per page.
Direction to order zones.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_UPDATE_DNS_RECORDTool to update an existing DNS record within a specific zone. Use after confirming both zone and record identifiers; only provided fields are modified. Updates to records used by active tunnels take effect immediately and can disrupt live traffic.
Input parameters
Time to live in seconds; use 1 for 'automatic' TTL
Additional record-specific data for LOC, SRV, and CAA records
DNS record name (e.g., 'example.com')
DNS record type
DNS record content (e.g., IP address for A records)
Whether the record is receiving Cloudflare's benefits
Priority for MX, SRV, and URI records; required for these record types
DNS record identifier (UUID) to update
Zone identifier (UUID) of the DNS record to update
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_UPDATE_LISTTool to update the description of a WAF list (cannot update items). Use after confirming list metadata.
Input parameters
Unique identifier of the WAF list
Cloudflare account identifier
New description for the WAF list
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_UPDATE_TUNNEL_CONFIGURATIONTool to update a remotely-managed Cloudflare Tunnel's configuration (ingress rules and routing). Use when you need to programmatically configure hostname-to-origin mappings for a tunnel. WARNING: This operation REPLACES the entire configuration - incorrect configuration can break routing and make services unreachable. Best practice: fetch current configuration first (if patching) to preserve existing rules. At least one ingress rule is required, and the last rule should typically be a catch-all (hostname='*' or omitted) with service='http_status:404'.
Input parameters
Complete tunnel configuration object including ingress rules. This REPLACES the entire configuration - fetch current config first if you need to patch rather than replace.
UUID of the tunnel to configure.
Cloudflare account identifier where the tunnel resides.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
CLOUDFLARE_UPDATE_ZONETool to update properties of an existing zone; changes apply immediately to the live zone. Confirm zone ID and intended change with the user before calling. Only one field can be modified per call.
Input parameters
Zone type: 'full', 'partial', or 'secondary'. Only one of paused, type, or vanity_name_servers can be updated per call.
Whether to pause the zone (true to pause, false to unpause). Only one of paused, type, or vanity_name_servers can be updated per call.
Zone identifier (UUID)
Custom name servers for vanity mode. Only one of paused, type, or vanity_name_servers can be updated per call.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
No publicly available marketplace agent is found using this tool yet. There are 55 agents privately built on Nagent that already use Cloudflare.
Build on Nagent
Connect Cloudflare to any Nagent agent in minutes — no API key management, no boilerplate. Just configure and deploy.
The five questions agent builders ask before adopting a new integration.
Open the External Integrations panel inside Nagent (app.nagent.ai/externalIntegration), find Cloudflare, and click "Connect Now." You'll authenticate with an API key — Nagent handles credential storage and refresh automatically. Once connected, Cloudflare is available to any agent in your workspace.
No. Nagent provides no-code integration for every tool. Once Cloudflare is connected, you configure its 20 actions directly in the agent builder UI — no API calls, no boilerplate, no schema management.
Helix — Nagent's agentic agent builder — lets you drop Cloudflare steps into any workflow visually. Pick an action (e.g., one of those listed above), fill in the inputs (Helix knows the required vs. optional schema for each parameter), and connect it to upstream/downstream steps. Triggers run as the entry point of an agent, so when a Cloudflare event fires, the agent kicks off automatically.
Every Cloudflare action and trigger ships with a fully-typed schema — input parameters with name, type, required flag, and description, plus the output payload shape. The schemas are documented in the sections above. Helix uses these schemas to validate your configuration at build time and to type-check the data flowing between steps.
Yes. While Cloudflare ships with 20 pre-built security & identity tools actions, you can layer custom logic around them inside Helix — pre/post-processing steps, conditional branches, retries, or stitching Cloudflare together with other connected tools. For deeper customization, talk to our team about Nagent's Agentic AI Lab — forward-deployed engineers who build Cloudflare-based workflows tailored to your business.