Cloud, hosting & identity · wired today

Cloudflare Zero Trust, wired into your agent workforce

Infrastructure state changes under you; agents need to read it live. The Cloudflare Zero Trust connector is one of 205 executable connectors and gives agents 11 read-only tools, with the credential held in the vault and every call receipted.

Connecting Cloudflare Zero Trust takes one credential

You provide API token, account ID from your Cloudflare Zero Trust account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.

Where to get it: Cloudflare Zero Trust's own API documentation ↗ covers creating and scoping the credential.

What agents can run against Cloudflare Zero Trust

list_access_apps

List Cloudflare Access applications for the account (name, domain, type, session duration)

get_access_app

Get one Cloudflare Access application by its application ID

list_access_policies

List the account's reusable Cloudflare Access policies (decision, precedence)

list_access_groups

List Cloudflare Access groups (reusable include/exclude/require rule sets)

list_access_identity_providers

List the identity providers configured for Cloudflare Access on this account

list_access_service_tokens

List Cloudflare Access service tokens (client IDs and expiry only, never the client secret)

list_gateway_rules

List Cloudflare Gateway policies (DNS, HTTP and network rules) with action and enabled state

list_gateway_lists

List Cloudflare Gateway lists (domain, IP, serial number and other lists used by Gateway policies)

list_gateway_locations

List Cloudflare Gateway locations (DNS resolver endpoints configured for the account)

list_tunnels

List Cloudflare tunnels (cloudflared) for the account, optionally excluding deleted ones

get_tunnel

Get one Cloudflare tunnel by its tunnel ID, with status and connection timestamps

Every tool above is read-only. Write surfaces ship only after live testing, and always behind approval gates.

How proven is this?

This connector was blind shape-proven against the real Cloudflare Zero Trust API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.

Cloudflare Zero Trust integration FAQ

What can Quox agents do with Cloudflare Zero Trust?

Agents can run 11 read-only tools against Cloudflare Zero Trust: list access apps, get access app, list access policies, list access groups, list access identity providers and more. Every call is receipted in the evidence trail.

What does the Cloudflare Zero Trust integration need?

You provide API token, account ID from your Cloudflare Zero Trust account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.

Do agents see my Cloudflare Zero Trust credentials?

No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.

How proven is the Cloudflare Zero Trust connector?