cloudflare-safe

Use when inspecting or changing anything in a Cloudflare account as an agent - DNS records, WAF custom rules, bot settings, redirect, transform, cache or page rules, zone settings, tunnels, Workers, Pages, R2 or analytics. Reads go through a local read-only API token that the agent never sees. Changes are proposed for the human to make in the dashboard, or applied through an approval step when the user has deliberately stored a write token.