Cloudflare One Stack: Giving AI Agents the Knowledge to Deploy Zero Trust

What the Cloudflare One stack actually is

Migrating to a Zero Trust network architecture is tedious work. Before anyone changes a policy, a team has to reconstruct how their network is actually built: which applications exist, how they authenticate, how traffic flows, and what assumptions the current setup makes. Most of that knowledge lives in people's heads and in scattered vendor consoles.

The Cloudflare One stack is Cloudflare's attempt to package that knowledge into something an AI agent can use. It's a collection of skills published on GitHub that you hand to your agent so it can configure, deploy, and manage a Zero Trust environment on Cloudflare One.

The framing matters. These aren't a hosted product or a new dashboard. They're skills — the same idea Anthropic describes for equipping agents — that you can run standalone, layer your own context into, or build tooling on top of. Cloudflare says the content was synthesized from employees with tens of thousands of hours of customer migration experience, including handpicked logic for moving off legacy vendors like Zscaler and Palo Alto Networks.

The agent gap it's trying to close

The pitch is straightforward and, for once, fairly honest about its limits. Plenty of teams already use agents to write code, triage alerts, and run workflows. But a general-purpose agent knows nothing about your specific network topology or your current vendor's configuration quirks. Ask it to migrate your security stack and it will guess.

The stack is meant to be the missing context. It provides what Cloudflare calls prescriptive and authoritative guidance — the questions that come up in every migration, the places where projects stall, and the structured reasoning needed to map an existing setup into Cloudflare One. In effect, it's the institutional knowledge a Cloudflare solutions engineer would bring to a migration call, encoded so an agent can apply it.

Where this gets concrete is the connection to live infrastructure. Used alongside the Cloudflare code mode MCP server, the stack gives an agent a typed interface to the Cloudflare API. The agent can query your live account, inspect configurations, and make changes through that interface rather than blindly calling endpoints. That's the difference between an agent that drafts a plan and one that can actually execute against your account.

Worth being clear-eyed here: an agent making changes to your security infrastructure is a high-stakes operation. The skills supply context and structured reasoning, but they don't remove the need for review. Anyone wiring this into a workflow should treat agent-proposed changes the way they'd treat a pull request — read before merging.

Where it fits for automation builders

If you're building automations, the useful mental model is this: the Cloudflare One stack is knowledge plus a typed API surface, not a runtime. You bring the agent. That means it slots into whatever agent platform you already run rather than forcing a new one.

The skills are model-agnostic by design — they work with any agent, so you could drive them with Claude, OpenAI models, or another framework. For people who orchestrate work in tools like n8n, Make, or Zapier, the realistic pattern is using those platforms to trigger and route around an agent that holds these skills, rather than expecting the skills to run inside a no-code flow directly. The heavy lifting — reasoning over topology, planning a migration, calling the Cloudflare API via MCP — happens in the agent layer.

Versus the alternative, the comparison is mostly against doing it by hand or scheduling vendor-led migration calls. Cloudflare has long marketed itself as the easiest-to-deploy SASE vendor, and this extends that claim to agents. Whether the skills genuinely cut migration time depends on how messy your existing Zscaler or Palo Alto setup is — the page doesn't publish before-and-after numbers, so treat time savings as a promise to verify on your own environment, not a benchmark.

Two practical caveats. First, this is tied specifically to Cloudflare One; the skills are valuable precisely because they're vendor-specific, which also means they're not portable to other SASE providers. Second, because the content is curated guidance rather than a deterministic tool, output quality will track the quality of the agent and the context you feed it. The skills reduce the chance of an agent hallucinating Cloudflare-specific details, but they don't eliminate the need for someone who understands network security to sign off.

For teams already committed to Cloudflare One, or seriously evaluating a migration, the stack is a low-cost thing to try — it's published openly and works with the agent you likely already have. The bigger trend it signals is vendors shipping their own expertise as agent skills, so the agent stops guessing about their product. Expect more of that.

If you'd rather have experienced hands set this up safely, browse the provider directory to find someone who can help you put it to work.