Ghostdrive

News · Academy · November 12, 2026

Academy: using an AI agent to harden Cloudflare, safely

Cloudflare offers MCP servers, an assistant and security checks. How to let an agent help set them up without handing it the keys to your account.

DRIVE 369 DAO · 3 min read

Academy, organisations, lesson 7. Many teams put their site behind Cloudflare and now ask an AI agent to configure it. That can save hours, and a badly scoped token can cost the account. Here is what exists and how to use it carefully. Everything below comes from Cloudflare's own documentation.

What Cloudflare provides for AI-assisted work

  • [MCP servers](https://developers.cloudflare.com/agents/model-context-protocol/mcp-servers-for-cloudflare/). The API server covers the whole Cloudflare API through three tools (search, execute and docs). There are separate servers for documentation, a sandbox for containers, browser rendering, digital experience monitoring and a CASB server that finds SaaS misconfigurations. The page says the product-specific servers are optional.
  • [Security Center and Security Insights](https://developers.cloudflare.com/security-center/). It maps your internet-facing assets, scans DNS, TLS, WAF and Access configuration and lists findings by severity, linking each to the setting. It does not fix them for you.
  • [Cloudy](https://developers.cloudflare.com/fundamentals/reference/cloudy-ai-agent/) (beta). An assistant that explains configurations, spots redundant, conflicting or disabled rules and recommends actions for WAF, Zero Trust and analytics. It follows your role-based permissions and does not train on your data. The page speaks of recommendations, not of changes it makes itself.
  • [Managed WAF rules](https://developers.cloudflare.com/waf/managed-rules/reference/cloudflare-managed-ruleset/) that Cloudflare updates frequently, with per-rule actions.
  • [Access](https://developers.cloudflare.com/cloudflare-one/policies/access/) for login-gated applications, deny by default, with Allow, Block, Bypass and Service Auth actions and a choice of multi-factor method. Cloudflare recommends Service Auth rather than Bypass because Bypass is not logged.
  • [Terraform provider](https://developers.cloudflare.com/terraform/) for configuration as code, change tracking and rollback.

A safe way to work with an agent

  1. Start read-only. Create an API token that can only read the settings you need, with an expiry. Cloudflare's own guidance is to create tokens with only the permissions required, and the secret is shown once, so store it in a manager, not in plain text or chat.
  2. Let the agent explain and propose. Ask it to audit your DNS, WAF and Access settings and to produce a list of changes with reasons. Cloudy and Security Insights are made for this.
  3. Put changes in code and review them. Have the agent write the change as Terraform or a list of API calls. A person reads the plan before anything is applied. This is the "human approval for high-impact actions" rule from the agent guardrails.
  4. Use a separate, narrow token for writing, limited to one zone and one product, created only for the task and revoked afterwards.
  5. Keep the account owner key and billing out of reach. An agent never needs them.
  6. Check the audit log afterwards. Compare what changed with what you approved.
  7. Test on a staging zone first. A wrong WAF rule can block your own customers.

A first hardening list to ask for

  • Turn on managed WAF rules and review their actions.
  • Put admin panels and internal tools behind Access with multi-factor sign-in.
  • Remove open management interfaces from public addresses.
  • Check that TLS is strict and that DNS has no stale records.
  • Enable alerts for new firewall events and for configuration changes.

What an agent cannot do for you

It cannot know your business: which paths are public, which partners need access. It can also be wrong, or be fed hostile text by a page it reads. That is why it proposes and a person decides.

How Ghostdrive approaches it

We keep our own keys sealed rather than in files. For your keys, Pass stores API secrets as sealed items, with the clipboard cleared after 30 seconds. We do not give agents account-wide tokens.

Academy: start here · Ten guardrails for agents · Know what you expose