The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.
Before citing limits, settings, API fields, category IDs, or exact UI paths, retrieve current information from the Cloudflare One docs (opens in a new tab), the Cloudflare docs MCP server, or the Cloudflare API schema.
Retrieve only the current docs needed for the products involved: Access, Gateway, WARP/device client, Tunnel/Mesh, Cloudflare WAN, DLP, CASB, device posture, or identity.
If account access is available, inspect existing resources before proposing or making changes: Access apps/policies/groups/IdPs, Gateway rules/lists/categories, device profiles/posture checks, tunnels/routes, DNS/resolver settings, and locations/sites.
Propose the change set with prerequisites, validation, and rollback. For risky changes, stage disabled or scoped to a pilot group/site unless the user explicitly asks otherwise.
When an agent, script, crawler, MCP client, or other non-browser client receives a Cloudflare Access login page or interactive authentication redirect, do not assume the resource is unavailable. Check whether an Access service token is available and authorized for the application. Retrieve the current service token (opens in a new tab) docs before configuring or troubleshooting authentication.
Send both service-token credentials as headers on the original request:
Access service tokens are a separate credential from Cloudflare API tokens. Use the service token’s Client ID and Client Secret, not an API token, to authenticate to an Access application.
Read the credentials from the project’s configured secret store or environment variables without printing their values. Never ask the user to paste a secret into chat, and never log, commit, or expose it.
Only send the credentials to the intended Access-protected hostname. Do not forward them through cross-origin redirects. If the current request tool cannot set headers safely, use another available HTTP client that can.
A service token must be included by a policy with the Service Auth action. If the response still starts an interactive login, inspect the application and its policies; an Allow policy is not a substitute for Service Auth.
If no authorized service token exists, explain the prerequisite or, when account access and approval are available, create a narrowly scoped token and policy. Do not attempt to automate an interactive identity-provider login.
Some self-hosted applications are configured to accept the token in a single custom header (for example, Authorization) instead of the default header pair. Inspect the application’s read_service_tokens_from_header setting before using that mode; do not guess the header format.
If the organization has strict service token authentication turned on, a failed service-token request returns 401 or 403 instead of redirecting to the login page, and Access returns no CF_Authorization cookie, so send the token headers on every request.
App shape: web app, API, SSH/RDP/VNC, database, SaaS app, public hostname, private IP, or private hostname. Retrieve Access application type (opens in a new tab) docs before choosing.
Access model: clientless browser access, private networking with device client, peer to peer connectivity, service connections with service tokens or mutual TLS, or SaaS SSO federation.
Policy needs: user groups, device posture, session duration, mTLS, service tokens, and app launcher visibility. Retrieve Access policy (opens in a new tab) docs before configuring selectors or evaluation order.
SaaS details: SAML vs OIDC support, ACS/redirect URLs, Entity IDs/client IDs, required attributes, and tenant-control requirements.
Traffic controls: DNS categories, HTTP URL/path inspection, L4 ports/protocols, egress IP requirements, custom lists, and allow/block exceptions. Retrieve Gateway traffic policy (opens in a new tab) docs for current selectors and order of enforcement.
TLS inspection: root CA deployment path, certificate-pinned applications, compliance exceptions, and FIPS requirements. Retrieve TLS decryption (opens in a new tab) docs before enabling.
DLP: sensitive data types, channels to inspect, TLS inspection readiness, DLP profiles, payload logging requirements, and false-positive tolerance. Retrieve DLP (opens in a new tab) docs before creating enforcement.
For writing or reviewing Workers invoked by the HTTP Forward action, use the gateway-workers skill.
CASB: SaaS vendors, admin access level, scan policy, org size, remediation owner, and whether inline protection is also required. Retrieve CASB findings (opens in a new tab) docs before recommending remediation.
Risk scoring: relevant behavior signals, false-positive sources such as VPNs or service accounts, and whether risk is for investigation or enforcement. Retrieve user risk score (opens in a new tab) docs before using risk in policies.
Access controls application authorization; Gateway controls traffic inspection/filtering. Use both when the requirement spans identity-aware app access and network/web security.
For new Access deployments, create policies through the reusable policy API (/access/policies) and attach them to applications. Do not send inline policies in an application create/update request unless the current API documentation explicitly requires an app-scoped policy.
Treat an app-scoped policy reported as reusable: false as legacy. Migrate existing policies with the documented make_reusable endpoint or replace them with reusable policies; do not create new legacy policies. Distinguish legacy policies from the deprecated legacy private-network application type.
Public hostname Access apps can be clientless. Private destination apps require the Cloudflare One Client or another network on-ramp plus routes and DNS resolution. Retrieve self-hosted private app (opens in a new tab) docs before configuring private destinations.
Cloudflare Tunnel is an off-ramp from a private network to Cloudflare. Cloudflare WAN and Mesh are other off-ramps which can also be on-ramps.
Group-based policies depend on IdP group claims or SCIM. If group sync is missing, do not invent group selectors.
HTTP inspection and DLP for encrypted web traffic require TLS inspection and planned Do Not Inspect exceptions.
Gateway DNS, Network, HTTP, and Egress policies have different evaluation semantics. Retrieve order of enforcement (opens in a new tab) docs before explaining precedence.
Start broad block/allow/DLP/TLS policies disabled limited to a pilot with specific target users or groups unless the user approves a wider rollout.
Access Groups are Cloudflare objects; IdP/SCIM groups are identity claims. Gateway group selectors use synced IdP groups, not Access Groups.
Group names and SAML/OIDC attributes are case-sensitive. Verify exact claim names and values before creating group-based rules.
SCIM changes and group membership can be stale until sync and re-authentication complete. Troubleshoot with the user’s last authenticated identity, not just the IdP state.
Access policies are default-deny. A private app with routes but no Allow policy still blocks access.
Access policy selectors can use IP lists, not Gateway domain or URL lists.
SaaS federation handles authentication into the SaaS app. SaaS authorization and tenant restrictions usually require SaaS-side roles and/or Gateway tenant controls.
Browser Rendering for SSH/VNC/RDP is an Access capability. Browser Isolation renders general web content remotely. Do not conflate them.
The Cloudflare One device client (opens in a new tab) is the on-ramp for user devices. Two components control it: enrollment rules (who can connect) and device profiles (how the client behaves after enrollment).
The enrollment rule is an Access application of type warp, not a device setting. It accepts reusable Access policies. Look in Access for enrollment debugging, not Devices.
For headless or autonomous devices (services, kiosks, Linux hosts), use service token enrollment. Non-human devices authenticate as non_identity@[team-domain].cloudflareaccess.com and have no group membership - device profiles targeting IdP groups will not match them. Target headless devices explicitly with the non-identity email, specific conventions about the devices (OS information, etc.),or let them fall to the default profile.
Device profiles control connection mode, split tunnel (opens in a new tab) configuration, user permissions (disable, switch lock), auto-reconnect, and captive portal behavior. Profiles are matched by user group or device attributes in precedence order - first match wins, default profile catches the rest.
Split tunnel mode is the single most impactful client setting. Choose the mode based on the deployment goal:
Goal
Mode
Rationale
VPN replacement only (private apps)
Include
Route only specified private CIDRs and hostnames through the client. Everything else goes direct. Minimal blast radius.
SWG only (internet security)
Exclude
All traffic through the client. Exclude only what breaks (local printers, certificate-pinned apps).
VPN replacement + SWG
Exclude
All traffic through the client. Most common enterprise configuration.
Coexistence with another VPN
Include
Avoids conflict with the other VPN’s tunnel interface and DNS control.
DNS filtering only
DNS-only mode
Only DNS queries go to Gateway. No traffic proxying.
Include vs exclude is per-profile, not per-entry. You cannot mix modes in the same profile. Switching modes mid-deployment requires re-evaluating every entry.
Split tunnel entries must align with tunnel routes bidirectionally. A CIDR in the include list without a matching tunnel route causes a black hole. A tunnel route without a matching device profile entry means traffic never enters the tunnel.
MDM parameters (mdm.xml / managed preferences) override dashboard-configured profile settings for any setting specified in the file. If dashboard changes appear to have no effect on managed devices, check MDM config. Retrieve MDM deployment (opens in a new tab) docs for platform-specific file locations and parameters.
If another VPN client or agent controls DNS on the device, the device client’s DNS interception will conflict. In coexistence scenarios, use “traffic only” mode to avoid routing table and DNS conflicts.
Captive portal detection temporarily disconnects the client when it detects a portal (hotel WiFi, airport). This is a common source of end-user friction and should be managed carefully.
Split tunnel mode changes the meaning of every route decision: Exclude mode sends traffic to Cloudflare when removed from excludes; Include mode sends traffic only when added to includes.
Virtual networks should be used primarily when IP subnets overlap and hostname-based routing is not used. It can be used to control other user connectivity behavior, but it is recommended to manage through security policies.
A healthy tunnel only proves cloudflared can reach Cloudflare. The tunnel must have appropriate published application routes, network routes, or hostname routes for connectivity to function.
Cloudflare Tunnel and Cloudflare Mesh can both be used to facilitate connectivity to internal networks. Cloudflare WAN can as well, but it is gated behind Enterprise subscriptions. Retrieve choose an on-ramp (opens in a new tab) when deliberating between Tunnel types.
Run multiple cloudflared connectors for production HA, preferably on separate hosts. Token-based, remotely managed tunnels are the default for new deployments.
dns.domains matches a domain and subdomains; dns.fqdn is exact-match only.
DNS pre-resolution selectors and post-resolution selectors do not behave like a single strict precedence list. Retrieve current evaluation docs before changing rule order.
HTTP Do Not Inspect rules run before HTTP Allow/Block/Isolate behavior. A later block rule will not override an earlier inspection bypass.
Certificate-pinned apps need Do Not Inspect exceptions before broad TLS inspection. Deploy the Cloudflare root CA to managed devices before enabling inspection.
DLP profiles are detection definitions only. They enforce nothing until referenced by a DLP policy or a CASB integration. Passive Detection (opens in a new tab) surfaces matches in sampled Gateway traffic before any policy exists; use it to choose what to log or block. Rules with body inspection may be evaluated multiple times in a single pass.
Start DLP with payload logging where appropriate, tune false positives, then block.
API CASB is out-of-band and periodic. It does not provide real-time inline enforcement although some integrations support “remediation”; use Gateway granular application controls for inline CASB capability for supported applications. Retrieve Granular application controls (opens in a new tab) when creating security policies for specific actions in specific SaaS applications.
CASB findings are tied to specific assets and instances. Drill into affected assets before recommending remediation.
Use current Dashboard remediation guidance for CASB fixes. Most remediations happen in the SaaS admin console, not Cloudflare.
CASB scans are periodic: the initial scan can take several hours, and later scans run roughly every 24-48 hours. Retrieve CASB troubleshooting (opens in a new tab) before promising timing. Reauthorizing can restart scan state; check credential health before reconnecting.
User risk scores are behavior-based and asynchronous. CASB findings do not automatically imply high user risk.
Zero Trust Infrastructure Access (opens in a new tab) (ZTIA) is the purpose-built offering for SSH access through the device client. It provides capabilities not available through self-hosted apps: keystroke logging, control over how users authenticate to the target machine, short-lived certificates (opens in a new tab) that replace static SSH keys with ephemeral certs tied to Access identity, and lightweight privileged access management. Use Infrastructure Access apps for SSH when the device client is deployed.
Browser Rendering (opens in a new tab) provides clientless SSH, RDP, and VNC through the browser without requiring the device client. Clientless RDP includes session recording and file transfer controls. Use clientless access when a device client cannot be installed (contractors, partner access, unmanaged devices) - typically not as the default for managed users with the client installed.
For SSH command logging, use Access for Infrastructure (opens in a new tab). The Gateway Audit SSH action reached end of life on July 15, 2026, and remaining Audit SSH rules no longer work; do not recommend it.
Short-lived certificates require CA configuration on the target host and sshd configured to trust the Cloudflare CA public key. Retrieve short-lived certificate setup (opens in a new tab) docs before configuring.
For kubectl and database access behind private networks, use the device client with private destination routing. There is no Infrastructure Access or browser-rendered equivalent for arbitrary TCP protocols today.
Gateway activity logs (opens in a new tab) record DNS, HTTP, and Network policy decisions. Filter by rule name, user identity, destination, action, and time range. These are the primary troubleshooting tool for “why was this blocked/allowed.”
Access audit logs (opens in a new tab) record authentication decisions per app - who authenticated, which policy matched, and session details. Use for verifying policy behavior and investigating access failures.
DEX (Digital Experience Monitoring) (opens in a new tab) provides fleet-level and per-device connectivity diagnostics. Use DEX tests (opens in a new tab) (HTTP, traceroute) to proactively monitor reachability to critical origins and internal apps. Fleet status shows device client health, connection mode, and connectivity state across the enrolled population.
Logpush (opens in a new tab) exports Gateway, Access, Network, and DEX logs to external SIEM or storage. Configure before go-live if the customer requires centralized log retention or compliance reporting.
When troubleshooting, work from logs toward config: identify the log entry showing the failure (Gateway block, Access deny, tunnel error, DNS resolution miss), then trace back to the responsible rule, route, or policy.
Access: test authorized, unauthorized, posture-failing, service-token, and multi-IdP flows when applicable; inspect logs and policy precedence. For new policies, verify they are managed through the reusable policy collection and not returned as reusable: false app-scoped policies.
Private network access: verify route lookup, tunnel health, origin reachability, split tunnel behavior, DNS resolution, and end-to-end access from a device client test device.
Gateway: verify rule type, action, traffic expression, precedence/evaluation phase, referenced lists, and Gateway settings before enabling broadly.
TLS/DLP: test Do Not Inspect exceptions and root CA trust before enabling inspection; test DLP with known samples and monitor false positives before blocking.
CASB/risk: confirm integration health, credential expiry, asset discovery, scan timing, finding instances, and risk-score signal latency before declaring remediation complete.
Cloudflare WAN: verify tunnel health, route priority/ownership, traffic flow, firewall expression syntax, and connector/appliance telemetry where applicable.
Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors. Also use when an agent, script, crawler, or other non-browser client needs to reach a webpage or API protected by Cloudflare Access.
The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.
Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.
Discovery
22 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.
Issue colours
Resolved from a curated brand profile — hue 54°, chroma 0.172. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.
Heading repairs
1 repair applied to this skill so the document has one h1 and no skipped levels:
Removed “Cloudflare One”, a leading h1 that duplicated the skill title.
Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.
Marketplace
A plugin manifest is published at .claude-plugin/marketplace.json by Cloudflare, declaring 1 plugin. It is read for editorial metadata only — never as the skill index, which is always the repository tree.
Signal
Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.
Agent surfaces
The whole issue is available as one markdown document at /cloudflare/skills.md, and each skill at its own .md URL.
Publication
Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.
Appendix 7.1
1 file · 3 KB
Everything this skill ships beside its prose. All of it is set here, as a subchapter of skill 7.
ReferencesMarkdown · 1 file
Documentation the agent loads on demand, rather than up front.