Cloudflare Claude Connector

A connector is a connection to data, not a magic button. It tells Claude where to read. Whether the output is useful still depends on what you ask and how you check the result.

Cloudflare is the edge layer most internet-facing apps route through: DNS, CDN, WAF, Workers, R2 storage. The Claude connector exposes the data and configuration layer as a query interface, so the question “why did p95 latency spike from EU edge last night” becomes a one-prompt answer instead of three dashboard tabs and a tail of wrangler logs.

What is the Cloudflare Claude connector?

The Cloudflare Claude connector is a permission-controlled bridge to your Cloudflare account. It uses OAuth and respects Cloudflare’s role-based permissions. Read access covers zones, DNS records, Workers, analytics, security events, Pages deployments, and R2. Write actions (modify DNS, change firewall rules, deploy Workers) require explicit scope.

What can Cloudflare do once Claude is connected?

• Read zones and DNS records. Inventory domains, DNS configuration, proxy status.
• Read Workers and routes. List deployed Workers, their routes, recent invocations.
• Read analytics and Web Vitals. Traffic patterns, cache hit rate, response codes, latency percentiles.
• Read security events. WAF blocks, bot fights, rate-limit triggers.
• Modify DNS or rules with write scope. Add records, update WAF rules, redeploy Workers.
• Cross-connector with GitHub. Pull a failing Workers route, find the source commit, draft the fix PR comment.

How do I add the Cloudflare connector?

1. In Claude, open the toolbox in the bottom-left, click Customize, then Connectors.
2. Click the +, then Browse connectors.
3. Find Cloudflare in the directory. Click + on the card.
4. The Cloudflare OAuth flow opens. Sign in. Approve read scopes for zones, analytics, security. Add write scopes only if you want Claude to modify DNS or firewall rules.
5. Test: “Show me my five zones and their proxy status.” If they come back, Cloudflare is live.

Cloudflare’s permission model is role-based with strict separation between viewer, editor, and admin per product (DNS, Workers, Firewall, etc). The connector respects whatever role your user has. For teams with strict change-control, start with a read-only seat and grant write scopes per-product as needed.

Standout prompts for Cloudflare

These are the prompts that exploit Cloudflare’s specific capability rather than treating Claude like a generic chat tool. Copy, paste, modify the specifics.

• DNS Audit. Reads DNS records across all zones, surfaces stale or duplicate entries, drafts the cleanup batch for review.
• WAF Rule Tuning. Reads WAF block events over past 30 days, surfaces noisy rules (high block volume, low actual threat), drafts the tuning recommendations.
• Workers Performance Brief. Reads Workers invocations and durations over past week, surfaces ones with rising p95 latency, drafts the optimization candidate list.
• Security Event Triage. Reads security events from past 24 hours, clusters by source IP and attack pattern, drafts the incident response summary.
• R2 Storage Audit. Reads R2 buckets, surfaces stale objects, large object counts, drafts the cost-control cleanup plan.
• Cache Hit Rate Diagnosis. For a specific zone, reads cache hit rate trends, surfaces routes with low hit rates, drafts the cache-rule tuning suggestions.
• Page Rule Conflict Audit. Reads Page Rules across zones, surfaces conflicting or unreachable rules, drafts the priority-ordering fix.
• Pages Deployment Brief. Reads recent Cloudflare Pages deployments, surfaces failed builds, drafts the per-project status summary.
• DDoS Event Post-Mortem. For a past DDoS event, reads traffic and security data, drafts the post-mortem summary including attack characteristics and mitigation effectiveness.
• API Token Rotation Audit. Reads API tokens and their last-used timestamps, surfaces stale tokens, drafts the rotation priority list.

What are the limits?

• Write actions need explicit scope. Reading is the default. Modifying DNS, WAF, Workers, or Pages requires the write scope you confirm during OAuth.
• Cloudflare API rate limits. Heavy use can hit Cloudflare’s per-minute API ceiling. Pace longer audits across batches.
• Per-query record cap. A single query usually returns 500-1000 records. For deeper analysis, batch by zone.
• Analytics data retention. Free and Pro plans retain analytics for shorter windows than Business or Enterprise. Older data may not be available.

Is the Cloudflare connector safe?

• For paid Claude plans, Cloudflare data accessed via the connector is not used to train models and is not retained beyond the request.
• DNS and WAF changes affect production traffic globally. Use draft-then-approve patterns; never let Claude apply DNS changes autonomously without review.
• API tokens are powerful. Scope tokens to the narrowest permission set Claude needs; never use a master Global API Key.
• Revoke from Claude Settings → Connectors and from Cloudflare’s My Profile → API Tokens.

When does a connector pay off vs. just chatting with Claude?

Connectors earn their setup time when the data updates faster than you can retype it, lives behind login, or runs into the thousands of items. For one-off questions about static information, plain Claude through the chat interface is faster than installing anything. The break-even is usually around the third time you would otherwise be copy-pasting context for the same kind of question. For the full list of connectors and which pillar each belongs to, see the Claude Connectors hub. If a term in this post is unfamiliar, the AI Glossary has plain-English definitions.

Frequently asked questions

Cloudflare or AWS or Vercel for edge compute?

Cloudflare for global edge-first compute with R2 and KV. AWS Lambda@Edge for AWS-native architectures. Vercel for Next.js-tied deployments. The Claude connector covers Cloudflare and Vercel; AWS uses a separate AWS connector.

Can Claude redeploy a Worker?

With write scope, yes. Most teams keep production Worker deploys manual: Claude drafts the change rationale, an engineer triggers the deploy. Stops auto-pushing untested code to global edge.

Does the connector work with Cloudflare Free?

Yes for basic features. Advanced functionality (longer analytics retention, advanced security data, audit logs) varies by plan.

Can Claude help with DNS migration?

Yes. Reads current DNS records, drafts the target-state record set, surfaces records that would change. Useful for planning migrations from another DNS provider into Cloudflare.

Will Claude trigger Cloudflare notifications?

Standard Cloudflare notification behavior applies for any write action. Test in a sandbox zone first.

Can the connector read Cloudflare Tunnel or Access?

Yes for tunnel and Access policy metadata. Useful for surfacing access-policy drift across applications.

How does this pair with Vercel?

Teams running Vercel-hosted apps often front them with Cloudflare for DNS and WAF. Connect both; Claude reads Vercel for app-level deploys and Cloudflare for edge-level traffic and security.

Sources

• Anthropic: Introducing Connectors · official launch and partner list
• Cloudflare API documentation · what the Cloudflare connector exposes
• Cloudflare Workers documentation · Workers integration reference
• Anthropic Trust Center · privacy and compliance posture
• Anthropic privacy notice · connector data handling

You might also like

• Claude Connectors Guide (2026) · the master hub
• Claude Connectors for Engineering + DevOps · the pillar this connector belongs to
• Vercel Claude Connector · the deployment-hosting sibling
• Sentry Claude Connector · the error-tracking sibling
• Claude Code: Complete Guide · the engineering-focused Claude playbook
• How to Use Claude AI · the beginner walkthrough
• Best Claude Prompts: 50 Examples · the broader collection
• Best AI Prompts by Job and Use Case · 60+ prompt packs organized by role and artifact