Cloudflare edge operations

v0.2.9

Governed Cloudflare zone, DNS record, cache-purge, security-posture, TLS, analytics, tunnel, load-balancer, Workers, Pages, and audit-log operations. Auth via CF_API_TOKEN on the runner host.

28 allowed by default 21 need approval by default 1 denied by default

Pack ID

cloudflare

Vendor

emisar

linux

Actions

Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.


              curl

jq


              bash

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host

sudo emisar pack install cloudflare --hash sha256:771bb71f18a06e3ab1588d28294f193308b1e8a9c08ca55d011d87a6dedaa9a1

Setup

Calls the Cloudflare REST and GraphQL APIs over HTTPS. CF_API_TOKEN is sent in an Authorization Bearer header over curl stdin and is never placed in argv or action output. Allowlist the variable in the runner's execution.inherit_env configuration.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

CF_API_TOKEN required

Cloudflare API token. Scope it to the zones, accounts, and permissions the actions you enable need, and gate mutation actions with policy.

Notes

Create the token at dash.cloudflare.com/profile/api-tokens → Create Token. Start from a read-only template and add only the permissions listed below; account-scoped tokens live under Manage Account → API Tokens.
Zone and account IDs are per-call action arguments — cf.list_zones and cf.list_accounts return them for use in the other actions.
Token scopes by family: Zone Read + DNS Read for the zone/DNS reads; DNS Edit for the DNS record mutations; Cache Purge for the purge actions; Zone Settings Edit for development mode, security level, SSL mode, minimum TLS, Always Use HTTPS, and pause; Firewall Services Edit for IP access rules; Analytics Read for zone and DNS analytics; Cloudflare Tunnel Read for tunnels; Load Balancing Read/Edit for pools; Workers Scripts Read for Worker reads and Workers Routes Edit for route changes; Pages Read for Pages reads and Pages Edit for rollback, retry, and build-cache purge; Audit Logs Read for audit logs.
Purge by hostname, prefix, or cache-tag requires a Cloudflare Enterprise zone; the other actions work on every plan.
Uploading Worker code or secrets, Workers KV/R2/D1 data planes, Cloudflare Access, WARP, Email Routing, origin CA certificates, and API token management are separate trust surfaces this pack does not touch.

Verify it works

Runs cf.list_zones, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host

sudo emisar pack verify cloudflare

Install and configure a pack walks through the whole sequence on a host.

Actions 50 total

View on GitHub

cf.audit_logs script low

List audit logs

List one bounded page of an account's Cloudflare audit log — who changed what through the dashboard and API, and when.
View source on GitHub
cf.create_dns_record script high

Create DNS record

Create one DNS record in a zone; a wrong name or content changes where live traffic and mail resolve as soon as caches expire.
View source on GitHub
cf.create_ip_access_rule script high

Create IP access rule

Create a zone IP access rule that blocks, challenges, or allowlists an IP, CIDR range, ASN, or country; a wrong value can cut off legitimate visitors, and whitelist bypasses the zone's security checks for the match.
View source on GitHub
cf.create_worker_route script high

Create Worker route

Create a zone Worker route that runs a script on matching URLs; a wrong pattern reroutes live traffic into Worker code. An empty script creates an exclusion route — matching requests bypass Workers and go to the origin.
View source on GitHub
cf.delete_dns_record script high

Delete DNS record

Delete one DNS record from a zone; whatever resolved through it stops resolving as caches expire, and the record cannot be restored except by recreating it.
View source on GitHub
cf.delete_ip_access_rule script high

Delete IP access rule

Delete one zone IP access rule; removing a block re-admits the traffic it stopped, and removing a whitelist re-subjects that traffic to security checks.
View source on GitHub
cf.delete_worker_route script high

Delete Worker route

Delete one zone Worker route; matching requests stop executing the Worker and fall through to other routes or the origin.
View source on GitHub
cf.dev_mode_off script medium

Disable development mode

End development mode early; the edge cache resumes serving immediately and origin load drops back to normal.
View source on GitHub
cf.dev_mode_on script high

Enable development mode

Enable development mode for 3 hours — the zone's cache is bypassed and the origin receives every request, which can overload a busy origin.
View source on GitHub
cf.dns_analytics_report script low

Show DNS analytics

Show a zone's DNS query analytics for the last N hours — query counts grouped by name, record type, and response code.
View source on GitHub
cf.dns_records script low

List DNS records

List one bounded page of a zone's DNS records, optionally filtered by record type, name, or content.
View source on GitHub
cf.firewall_rules script low

List WAF custom rules

List zone WAF custom rules — the entrypoint ruleset for the http_request_firewall_custom phase. Replaces the legacy /firewall/rules API, which Cloudflare sunset on 2025-06-15.
View source on GitHub
cf.lb_pool_health script low

Show pool health

Show the latest per-location health-check results for one load balancer pool's origins — where an origin is failing and why.
View source on GitHub
cf.list_accounts script low

List accounts

List one bounded page of Cloudflare accounts the API token can read — the account IDs the tunnel, load-balancer pool, and audit-log actions need.
View source on GitHub
cf.list_certificate_packs script low

List certificate packs

List a zone's edge certificate packs with hostnames, validity, and expiry — the certificates Cloudflare serves for the zone. Contains no private keys.
View source on GitHub
cf.list_ip_access_rules script low

List IP access rules

List one bounded page of a zone's IP access rules — the block, challenge, and allowlist entries for IPs, CIDR ranges, ASNs, and countries.
View source on GitHub
cf.list_lb_pools script low

List load balancer pools

List an account's load balancer origin pools with each pool's origins, weights, enabled state, and health.
View source on GitHub
cf.list_load_balancers script low

List load balancers

List a zone's load balancers with their pool assignments, steering policy, and proxy status.
View source on GitHub
cf.list_pages_projects script low

List Pages projects

List one bounded page of an account's Cloudflare Pages projects with domains, production branch, and each project's latest deployment.
View source on GitHub
cf.list_rulesets script low

List zone rulesets

List every ruleset attached to a zone — WAF managed and custom rules, rate limiting, redirects, transforms — with each ruleset's phase and version.
View source on GitHub
cf.list_tunnels script low

List Cloudflare Tunnels

List one bounded page of an account's active cloudflared tunnels with each tunnel's health status and connection summary.
View source on GitHub
cf.list_worker_routes script low

List Worker routes

List a zone's Worker routes — which URL patterns run which Worker script.
View source on GitHub
cf.list_workers script low

List Worker scripts

List an account's deployed Worker scripts with creation and last-modified dates. Contains names and metadata only, never script code.
View source on GitHub
cf.list_zones script low

List zones

List one bounded page of zones the API token can read, with each zone's ID, plan, status, and nameservers.
View source on GitHub
cf.page_rules script low

List page rules

List a zone's legacy page rules with their URL patterns, actions, and status.
View source on GitHub
cf.pages_deployment_logs script medium

Show Pages build log

Show one Pages deployment's build log for failed-build triage. The log is arbitrary build output the project's own commands printed, so it can carry anything a build script echoes — treat it as sensitive diagnostics.
View source on GitHub
cf.pages_deployments script low

List Pages deployments

List one bounded page of a Pages project's deployments — build status, environment, trigger, and commit — newest first, optionally filtered to production or preview.
View source on GitHub
cf.pause_zone script high

Pause zone

Pause Cloudflare on a zone — traffic goes DNS-only, straight to the origin, losing the CDN cache, WAF, and DDoS protection while exposing the origin's real IPs.
View source on GitHub
cf.purge_all_cache script critical

Purge entire zone cache

Purge ALL cached content for one zone; every URL misses to the origin at once, and on a busy zone that cold-cache spike can overload the origin.
View source on GitHub
cf.purge_hostname script high

Purge cached hostname

Purge every cached object for one hostname in a zone (Enterprise only); all of that host's traffic misses to the origin until the cache re-warms.
View source on GitHub
cf.purge_pages_build_cache script medium

Purge Pages build cache

Purge one Pages project's build cache; live traffic is untouched, and the next build resolves dependencies from scratch and runs slower.
View source on GitHub
cf.purge_prefix script high

Purge cached URL prefix

Purge every cached URL under one hostname/path prefix (Enterprise only); everything under the prefix misses to the origin until the cache re-warms.
View source on GitHub
cf.purge_tag script high

Purge cached tag

Purge every cached object carrying one Cache-Tag in a zone (Enterprise only); all tagged objects miss to the origin until the cache re-warms.
View source on GitHub
cf.purge_url script high

Purge cached URL

Purge one URL from a zone's edge cache; the next request for each purged variant reaches the origin and can increase origin load.
View source on GitHub
cf.retry_pages_deployment script high

Retry Pages deployment

Re-run one Pages deployment's build; if it succeeds and is the newest production deployment, the rebuilt content goes live — retrying an old deployment can put stale content into production.
View source on GitHub
cf.rollback_pages_deployment script high

Roll back Pages deployment

Roll a Pages project's production traffic back to an earlier deployment; the live site switches to that build's content immediately.
View source on GitHub
cf.set_always_use_https script high

Set Always Use HTTPS

Turn a zone's Always Use HTTPS redirect on or off; off lets visitors stay on plain HTTP, and on breaks any resource that must be served over HTTP.
View source on GitHub
cf.set_lb_pool_enabled script high

Enable or disable LB pool

Enable or disable one load balancer origin pool; disabling shifts its traffic to the remaining pools, and disabling the last healthy pool sends traffic to the fallback.
View source on GitHub
cf.set_min_tls_version script high

Set minimum TLS version

Set the minimum TLS version a zone accepts from visitors; raising it cuts off legacy clients, and lowering it re-admits protocol versions with known weaknesses.
View source on GitHub
cf.set_security_level script high

Set security level

Set a zone's security level, including I'm Under Attack mode; under_attack challenges every visitor, and lowering the level exposes the origin to more hostile traffic.
View source on GitHub
cf.set_ssl_mode script high

Set SSL mode

Set a zone's edge-to-origin SSL mode; a downgrade (full to flexible or off) sends visitor traffic to the origin unencrypted, and strict breaks the site if the origin certificate is invalid.
View source on GitHub
cf.ssl_verification script low

Show SSL verification status

Show edge certificate verification status for a zone's hostnames — what a browser will be served and whether validation is stuck.
View source on GitHub
cf.tunnel_connections script low

Show tunnel connections

Show one tunnel's active cloudflared connectors — client version, architecture, origin IP, and the edge locations each connection is landed on.
View source on GitHub
cf.unpause_zone script medium

Unpause zone

Resume Cloudflare on a paused zone; proxied traffic returns to the edge and the CDN cache, WAF, and DDoS protection re-engage.
View source on GitHub
cf.update_dns_record script high

Update DNS record

Change fields on one existing DNS record; a wrong content or proxy flip reroutes live traffic as soon as caches expire. Empty or zero arguments leave that field unchanged, and at least one field must change.
View source on GitHub
cf.update_worker_route script high

Update Worker route

Replace one Worker route's pattern and script; a wrong pattern or script reroutes live traffic, and an empty script turns the route into a Workers bypass for matching requests.
View source on GitHub
cf.worker_deployments script low

Show Worker deployments

Show one Worker script's deployment history — who deployed which version when, and the live gradual-rollout percentage split.
View source on GitHub
cf.zone_analytics script low

Show zone HTTP analytics

Show a zone's HTTP traffic for the last N hours via the GraphQL analytics API — request, bandwidth, cached, threat, and unique-visitor totals plus the hourly series. Replaces the legacy /analytics/dashboard API, which Cloudflare sunset.
View source on GitHub
cf.zone_details script low

Show zone details

Show one zone's status, plan, nameservers, and activation state.
View source on GitHub
cf.zone_settings script low

List zone settings

List every zone-level setting — cache level, security level, SSL mode, minimum TLS version, development mode, Always Use HTTPS, and the rest.
View source on GitHub

← Back to registry

Pack reference Publish your own