cloudflare-one Skill for Claude: Design and Review Cloudflare One Zero Trust

cloudflare-one helps your assistant design, configure, troubleshoot and review Cloudflare One (Zero Trust and SASE) deployments.

Installs: 99.1K; on skills.sh
Stars: 3.2K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

cloudflare-one gives the assistant a five-step workflow: classify the ask, gather context, retrieve only the current docs it needs, inspect existing resources if account access exists, then propose a change set with prerequisites, validation and rollback. It adds assessment questions for Access, Tunnel, Gateway, TLS and DLP, CASB and device posture, and Cloudflare WAN.

It tells the assistant to look up limits, API fields and category IDs rather than guess, and to stage risky policies disabled or limited to a pilot group. Migration planning from other vendors goes to the cloudflare-one-migrations skill. It bundles no scripts.

Good for

Security and network admins designing Zero Trust access
IT teams rolling out Gateway, WARP or Tunnel to a pilot group
Reviewers auditing Access policies and DLP settings

Install cloudflare-one

Claude Code

Copy this prompt.

Install the cloudflare-one skill in Claude Code. Run this command:

/plugin marketplace add cloudflare/skills
/plugin install cloudflare@cloudflare

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Pick one route, not both. The README says the plugin installs the Cloudflare guidance and the main Cloudflare MCP server, and it brings every skill in the repo. The skills CLI route installs only this skill.

From the project README. Source.

What's in the skill

When it loads

Design, configure, troubleshoot, or review Cloudflare One Zero Trust and SASE deployments. Use cloudflare-one-migrations for migration planning from other vendors.

Sections in SKILL.md

Workflow
Assessment Prompts
Architecture and Current State
Access and SaaS Federation
Tunnel and Private Networking
Gateway, TLS, and DLP
CASB, Device Posture, and Risk
Cloudflare WAN / Site Connectivity
Guardrails
Identity and Access
Device Client Deployment
Private Networking
Gateway, TLS, and DLP
CASB, Risk, and Operations
Infrastructure Access
Logs, Analytics, and DEX

Key facts

Author: cloudflare (GitHub)
Repository: cloudflare/skills, folder skills/cloudflare-one
Installs on skills.sh: 99,124 (as of 2026-11-02)
Repo stars: 3,244 (whole repository, as of 2026-11-02)
License: Apache-2.0
Last repo commit: 2026-10-31
Files in the skill folder: 2 files: SKILL.md and a feedback guide
skills.sh audits: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass

What it includes

Classify, gather context, retrieve docs, inspect, propose
Five steps ending in a change set with prerequisites, validation and rollback; risky changes are staged or piloted.
Network · Workflow
Questions by area
Architecture, Access and SaaS federation, Tunnel and private networking, Gateway, TLS and DLP, CASB and device posture, and Cloudflare WAN.
Assessment prompts
Rules for identity, devices, networking, Gateway and CASB
Examples: use the reusable Access policy API, do not invent group selectors, and start broad policies disabled for a pilot.
Guardrails
What a design, config change or fix should contain
Designs list assumptions and rollout phases; config work lists prerequisites, test cases and rollback.
Output defaults
Tests to run before declaring success
Covers Access flows, private routes, Gateway rules, TLS and DLP, CASB, and WAN tunnel health.
Validation prompts
Do not guess IDs or request bodies
Use fully qualified MCP tool names, retrieve schemas, and do not enable broad production policies without approval.
Write · API safety

From the official docs

Permissions

Medium risk

If you give it Cloudflare account access, it can change access policies and traffic rules that affect real users, and if you report bad guidance it may offer to post a public GitHub issue after you approve the text. Keep changes staged or limited to a pilot group, and approve each one.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

With account access it can change live policies
The skill can inspect and change Access apps, Gateway rules and tunnels when it has account access. Ask it to stage changes disabled or limited to a pilot, and approve each one.
Wrong rules can lock people out or break traffic
Access policies are default-deny and TLS inspection affects encrypted traffic. Test with a pilot group first.
The plugin route also adds Cloudflare's MCP server
The README says the Claude Code plugin installs the Cloudflare guidance and the main remote Cloudflare MCP server, which gives access to the Cloudflare API and docs. The skills CLI route installs only this skill.
Skill feedback can post a public GitHub issue
A bundled skill-feedback.md tells the assistant what to do if you report wrong or outdated guidance: ask your permission, draft an issue for cloudflare/skills, show you the exact title and body and post only after you answer yes. It uses `gh issue create`, and the issue is public, so check the text for secrets before you approve.

Technical details

Talks to	Cloudflare API and docs
Scopes	Cloudflare account access, if you give the assistant an API token or MCP connection

Questions

What does the cloudflare-one skill do?

It guides your assistant through designing, configuring, troubleshooting and reviewing Cloudflare One deployments. It covers Access, Gateway, WARP, Tunnel, DLP, CASB and Cloudflare WAN.

How do I install cloudflare-one?

Use the install box at the top of the page. The plugin route installs every Cloudflare skill plus the Cloudflare MCP server, and the skills CLI route installs only this one.

Does cloudflare-one need an API key?

The SKILL.md asks for no key itself. Step 4 of its workflow says that if account access is available, the assistant inspects existing resources before proposing or making changes, so a Cloudflare API token or the Cloudflare MCP server gives it that access.

Can it migrate me from Zscaler or a VPN?

Not on its own. The SKILL.md sends migration planning to the cloudflare-one-migrations skill, which is a separate skill in the same repo.

Is cloudflare-one safe?

The skill bundles no scripts. The risk is what the assistant does through any Cloudflare connection you give it, so keep changes staged, use a pilot group and read each change before you approve it. A bundled skill-feedback.md can also lead it to offer a public GitHub issue, which it posts only after you approve the exact text.

How is it different from the wrangler or cloudflare skills?

cloudflare-one is only about Zero Trust and SASE. The wrangler skill deploys Workers and storage, and the cloudflare skill helps choose between Cloudflare products. They are separate skills in the same repo.

Information

updated Nov 2, 2026

Repository: cloudflare/skills
Folder: skills/cloudflare-one

cloudflare/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

cloudflare/skills README · github.com
skills.sh listing · skills.sh
cloudflare-one SKILL.md · github.com
cloudflare-one skill-feedback.md · github.com