Stop Clicking the Cloudflare Dashboard

Cloudflare shipped cf, an agentic CLI for its whole API. Type intent, get reviewable API calls — and your agents can drive it too.

Dafallah Ibrahim

— 2 min read
Share

Cloudflare just shipped cf — a command-line tool you operate in plain English. Tell it to block an ASN, clean up stale DNS, or wire a Worker route, and it turns the sentence into real API calls, showing you each one before it runs. If your relationship with the Cloudflare dashboard is "frantic clicking during an incident", this is for you.

The quieter part of the announcement: it's built for agents as much as humans. The same interface your fingers get is the one your coding assistant gets. That's the piece worth thinking about.

Why this matters

Infrastructure state has a documentation problem. Wrangler covers the Workers dev loop well, but everything else in a Cloudflare account — DNS, WAF rules, caches, queues, access policies — lives behind the dashboard or a pile of curl scripts nobody maintains.

cf makes the entire account one addressable surface. The unit of work becomes intent, and the audit trail becomes a transcript of exactly which API calls ran. That beats screenshots of a dashboard from eleven months ago.

It's also a signal. When a major provider makes its API agent-operable by default, the rest will copy it. The layer between LLMs and your infrastructure is being shipped by vendors now, not bolted on by you at 2 a.m.

How it works

Install it, authenticate once in the browser, and you're in a REPL for your account. Type a request; the model plans the sequence of API calls, prints them, waits for confirmation, then executes against the same public API you'd call yourself.

There's no hidden control plane — if you can see the call, you could have curled it. Conversation state persists, so "now do the same for staging" is a valid follow-up. And because it's API calls underneath, it works non-interactively, which is the door agents walk through.

Where this helps

  • Incident response: "block ASN 9009 on the production zone for /login" beats four levels of dashboard navigation while you're bleeding.
  • Audits and cleanup: listing every DNS record pointing at a decommissioned box turns an afternoon of export-and-grep into one exchange.
  • Delegating scoped work: an agent can provision a KV namespace and route for a spike without you handing over dashboard credentials.
  • Inherited accounts: interrogate the state instead of reverse-engineering it.

Watch out

Plain English is a lossy interface. The confirmation step is the safety net, so actually read the calls — "turn off caching" can mean several very different things.

Treat the login as account-wide until proven otherwise: an agent with cf is an agent with your entire Cloudflare footprint. Sandbox anything autonomous before it gets near prod. And keep repeatable operations in code — Terraform doesn't drift because it had a bad day. Prompt-driven infra is for exploration and emergencies, not your deploy pipeline.

Try it yourself

npm install -g @cloudflare/cf
cf   # authenticate in the browser when prompted

# then, in the REPL:
list my zones and flag any with managed WAF rules off
add a proxied DNS record api-staging.example.com pointing to 203.0.113.10

TL;DR

  • What changed: Cloudflare shipped cf, an agentic CLI that drives its full API from plain-English intent, with confirmations before each action.
  • Why it matters: your whole account becomes operable by both you and your agents, with a transcript as the audit trail.
  • Try today: install it, ask it to audit your zones, and read every API call before you approve it.

Read more