Cloudflare

• cloudflare_list_zonesReadsList the zones on your account with their status.
• cloudflare_list_dns_recordsReadsList the DNS records in a zone.
• cloudflare_list_workersReadsList the Workers scripts on an account.
• cloudflare_create_dns_recordAsks firstCreate a DNS record, for example to point a domain at a deployment.
• cloudflare_update_dns_recordAsks firstUpdate an existing DNS record.
• cloudflare_delete_dns_recordDangerousDelete a DNS record. This can take a domain offline.

• zone.readNeeded to list zones.
• dns.readNeeded to read DNS records.
• workers-scripts.readNeeded to list Workers.
• dns.writeNeeded to create, update and delete DNS records.

Each tool names the Cloudflare scope it needs. A grant that lacks one shows as connected but missing access, with a button to reconnect.

Creating and updating a record ask first and can go on the allow list. Deleting one is marked dangerous and asks every time.

1. 1

   Ask for something that needs Cloudflare in a thread. There is no connect button for it in the settings panel yet.

2. 2

   The assistant pauses and shows a panel offering to authorize it. Nothing runs while it waits.

3. 3

   Approve on Cloudflare's consent screen, come back and press Resume. The turn continues where it stopped.