cloudflare · scottbuscemi · Aug 26, 2026
@@ -54,7 +54,7 @@ Skills are contextual and auto-loaded based on your conversation. When a request
 
 | Skill | Useful for |
 |-------|------------|
-| cloudflare | Comprehensive platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (WAF, DDoS), and IaC (Terraform, Pulumi) |
+| cloudflare | Comprehensive platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (Access, WAF, DDoS), and IaC (Terraform, Pulumi) |
 | agents-sdk | Building stateful AI agents with state, scheduling, RPC, MCP servers, email, and streaming chat |
 | durable-objects | Stateful coordination (chat rooms, games, booking), RPC, SQLite, alarms, WebSockets |
 | sandbox-next | Sandbox on `@cloudflare/sandbox@next` (1.0 preview); recommended for new projects |
@@ -71,7 +71,7 @@ Short, retrieval-first skills for [Cloudflare One](https://developers.cloudflare
 
 | Skill | Useful for |
 |-------|------------|
-| cloudflare-one | Designing, configuring, troubleshooting, or reviewing Cloudflare One deployments across Access, Gateway, WARP, Tunnel, Magic WAN, DLP, CASB, posture, and identity |
+| cloudflare-one | Designing, configuring, troubleshooting, or reviewing Cloudflare One deployments, including service-token access for agents and other non-browser clients |
 | cloudflare-one-migrations | Migration assessments, policy mapping, rollout plans, and gap analysis for Zscaler, Palo Alto, legacy VPN/SWG, and SASE migrations to Cloudflare One |
 
 ## MCP Servers

@@ -1,6 +1,6 @@
 ---
 name: cloudflare-one
-description: "Guides Cloudflare One Zero Trust and SASE work across Access, Gateway, WARP, Tunnel, Cloudflare WAN, DLP, CASB, device posture, and identity. Use when designing, configuring, troubleshooting, or reviewing Cloudflare One deployments. Retrieval-first: use current Cloudflare docs/API schemas instead of embedded product docs."
+description: "Guides Cloudflare One Zero Trust and SASE work across Access, Gateway, WARP, Tunnel, Cloudflare WAN, DLP, CASB, device posture, and identity. Use when designing, configuring, troubleshooting, or reviewing Cloudflare One deployments, and when an agent, script, crawler, or other non-browser client needs to reach a webpage or API protected by Cloudflare Access. Retrieval-first: use current Cloudflare docs/API schemas instead of embedded product docs."
 ---
 
 # Cloudflare One
@@ -15,6 +15,24 @@ Before citing limits, settings, API fields, category IDs, or exact UI paths, ret
 4. If account access is available, inspect existing resources before proposing or making changes: Access apps/policies/groups/IdPs, Gateway rules/lists/categories, device profiles/posture checks, tunnels/routes, DNS/resolver settings, and locations/sites.
 5. Propose the change set with prerequisites, validation, and rollback. For risky changes, stage disabled or scoped to a pilot group/site unless the user explicitly asks otherwise.
 
+### Access-Protected Webpages and APIs
+
+When an agent, script, crawler, MCP client, or other non-browser client receives a Cloudflare Access login page or interactive authentication redirect, do not assume the resource is unavailable. Check whether an Access service token is available and authorized for the application. Retrieve the current [service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) docs before configuring or troubleshooting authentication.
+
+Send both service-token credentials as headers on the original request:
+
+```text
+CF-Access-Client-Id: <CLIENT_ID>
+CF-Access-Client-Secret: <CLIENT_SECRET>
+```
+
+- Distinguish Access service-token credentials from Cloudflare API tokens; API tokens do not authenticate requests to an Access application.
+- Check approved secret stores or environment variables such as `CF_ACCESS_CLIENT_ID` and `CF_ACCESS_CLIENT_SECRET` without printing their values. Never ask the user to paste a secret into chat, and never log, commit, or expose it.
+- Only send the credentials to the intended Access-protected hostname. Do not forward them through cross-origin redirects. If the current request tool cannot set headers safely, use another available HTTP client that can.
+- A service token must be included by a `Service Auth` policy for the Access application. If the response still starts an interactive login, inspect the application and policy; an `Allow` policy is not a substitute for `Service Auth`.
+- If no authorized service token exists, explain the prerequisite or, when account access and approval are available, create a narrowly scoped token and policy. Do not attempt to automate an interactive identity-provider login.
+- Some applications are configured to accept the token in one custom header instead of the default header pair. Inspect the application configuration before using that mode; do not guess the header format.
+
 ## Assessment Prompts
 
 Use these to avoid jumping straight to configuration. Ask only the prompts relevant to the user's task.

@@ -1,6 +1,6 @@
 ---
 name: cloudflare
-description: Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), feature flags (Flagship), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
+description: Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), feature flags (Flagship), networking (Tunnel, Spectrum), security (Access, WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task, including accessing webpages or APIs protected by Cloudflare Access. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
 references:
   - workers
   - pages
@@ -102,6 +102,7 @@ Need networking?
 
 ```
 Need security?
+├─ Identity-aware access, protected webpages, service tokens → cloudflare-one skill
 ├─ Web Application Firewall → waf/
 ├─ DDoS protection → ddos/
 ├─ Bot detection/management → bot-management/