Cloud, hosting & identity · wired today
Drive Cloudflare with governed agents
Infrastructure state changes under you; agents need to read it live. The Cloudflare connector is one of 222 executable connectors and gives agents 5 read-only tools, with the credential held in the vault and every call receipted.
What agents can run against Cloudflare
| Tool | What it does |
|---|---|
verify_token | Verify the Cloudflare API token and report its status |
list_zones | List Cloudflare zones (domains), optionally filtered by exact zone name |
get_zone | Get a single Cloudflare zone by ID |
list_dns_records | List DNS records for a Cloudflare zone, optionally filtered by record type |
list_accounts | List Cloudflare accounts the API token can access |
Every tool above is read-only. Write surfaces ship only after live testing, and always behind approval gates.
What the Cloudflare connector needs
You provide API token from your Cloudflare account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Where to get it: Cloudflare's own API documentation ↗ covers creating and scoping the credential.
How proven is this?
This connector was blind shape-proven against the real Cloudflare API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.
- Credentialed The vault stores, tests and just-in-time resolves its credential; agents never see the secret.
- Read-only It ships read tools only, so there is nothing to approval-gate.
- Agent-owned No dedicated agent owns it yet; the orchestrator can drive it on request.
- Schedulable Not yet exposed in the workflow builder; that integration is on the connector roadmap.
- Evidenced Per-call evidence envelopes are on the roadmap; vault credential use is already receipted.
Cloudflare integration FAQ
What can Quox agents do with Cloudflare?
Agents can run 5 read-only tools against Cloudflare: verify token, list zones, get zone, list dns records, list accounts. Every call is receipted in the evidence trail.
What does the Cloudflare integration need?
You provide API token from your Cloudflare account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Do agents see my Cloudflare credentials?
No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.
How proven is the Cloudflare connector?
This connector was blind shape-proven against the real Cloudflare API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.