Cloud provider

Cloudflare

Connect your Cloudflare account to let agents monitor your Workers, Pages, and edge infrastructure. Agents can analyze request patterns, check worker performance, and help troubleshoot issues at the edge.

Connect

Connect Cloudflare from the terminal. Pass --help for the flags Cloudflare accepts, plus --no-browser for headless environments.

Terminal

polylane cloud connect --provider cloudflare

Account-owned API token with operational access.

Cloudflare connects with an account-owned API token. Unlike most providers, Polylane requests operational (edit) access so agents can act on your infrastructure, not just read it. Your token is encrypted before it is stored, and the agent never sees it.

Setup

In the connection form, click Create token. It opens Cloudflare's account API token screen with every permission Polylane needs pre-selected.
Select the account you want to connect. You must be a Super Administrator on that account to create an account-owned token.
Review the pre-filled permissions, then click Continue to summary and Create Token.
Copy the token and paste it back into Polylane.
Polylane validates the token and starts syncing.

Choose Read-only if you want Polylane to investigate and explain issues without ever changing anything in your account. Choose Read and write to let agents fix issues directly (deploys, config, rollbacks). Every write is confirmed with you first.

You must be on the Workers Paid plan for full resource discovery.

Permissions

The pre-configured link creates an account-owned token: a durable service principal that keeps working even if the person who created it leaves the account. With read and write access it requests broad edit permissions:

Developer Platform: Workers, KV, R2, D1, Queues, Pipelines, Hyperdrive, Durable Objects, Containers, Secrets Store, Artifacts, and more
AI & Machine Learning: Workers AI, AI Gateway, AutoRAG, Vectorize, AI Search
DNS & Zones: DNS, zone settings, registrar, DNS firewall
Network Services: Load Balancing, Magic Transit/WAN, Spectrum, tunnels
App Security: WAF, rulesets, DDoS, bot management, page rules, certificates
Cache, Email, Media, Rules, Analytics & Logs

Deliberately scoped down for safety:

Zero Trust / Cloudflare One is granted read-only.
No billing changes, API-token management, or SSO/SCIM/OAuth identity writes.

Disconnecting

Disconnect the account in Polylane, then revoke the API token from your Cloudflare dashboard under My Profile → API Tokens (or Manage Account → API Tokens for account-owned tokens).

Tools

Operations agents can perform in threads and automations.

List Telemetry Keys

List available Cloudflare telemetry data keys

List Telemetry Values

List values for a Cloudflare telemetry key

Run Telemetry Query

Query Cloudflare Workers / container logs and traces

Traces

Read Cloudflare traces (list summaries, get full span tree)

Run Graphql Query

Execute a GraphQL query against the Cloudflare Analytics API

Graphql Schema Search

Search the Cloudflare GraphQL schema for matching types, fields, args, and enum values

Graphql Schema Overview

Fetch a paginated overview of all Cloudflare GraphQL types

Graphql Type Details

Fetch fields, args, and enum values for one Cloudflare GraphQL type

Graphql Complete Schema

Fetch the Cloudflare GraphQL schema with optional root-type details

Ai Gateway Logs

List Cloudflare AI Gateway logs, or fetch one log's full detail

Access Application Logs

List Cloudflare Access authentication events for an Access application

Workflow Instances

List or get Cloudflare Workflows instances

Api

Call any Cloudflare REST API endpoint that lacks a dedicated tool

Deployments

List Cloudflare Worker/Pages deployments or Worker versions

Supported resources

Resource types that show up in your infrastructure graph.

Cloudflare Worker

AI Gateway

Cloudflare Container

Durable Object

D1 Database

Hyperdrive

Cloudflare KV

Cloudflare Pipeline

Pipeline Stream

Pipeline Sink

R2 Bucket

Cloudflare Queue

Secret Store

Cloudflare Secret

Cloudflare Pages

Domain

Analytics Engine

Browser Rendering

Vectorize

Cloudflare Workflow

Cloudflare Zone

Worker Route

Worker Domain

Dispatch Namespace

Tenant Worker

Snippet

mTLS Certificate

Cloudflare Tunnel

Access Application

Spectrum App

Turnstile Widget

Waiting Room

Health Check

Load Balancer

Load Balancer Pool

Load Balancer Monitor

Logpush Job

SSL Certificate

Email Address

Stream Live Input

Cloudflare Images

Calls App

AutoRAG

R2 Data Catalog

Artifacts Namespace

Automation triggers

Events from Cloudflare that can start an automation.

Cloudflare Deploy

Fires when a Cloudflare deploy lands (Workers script update, Pages deployment, container rollout, or versioned Worker promotion).

Cloud Account Connected

Fires once when a user connects a new cloud account to the workspace.

Cloud Account Synced

Fires each time a cloud account finishes a full or incremental sync.

Infra Node Created

Fires once per new infrastructure resource discovered during a cloud sync.

Automation templates

Pre-built automations that use Cloudflare. Open one to see its trigger, instructions, and actions.

Daily Cloudflare infrastructure audit

Run a daily audit of your Cloudflare observability setup and flag gaps in monitoring

Cloud compliance audit

Weekly audit of IAM policies, resource tagging, and governance compliance across cloud providers

Weekly Cloudflare security digest

Compile a weekly Cloudflare report on security events, vulnerabilities, and access changes

Capacity planning report

Forecast resource usage trends and flag services approaching capacity limits

Auto-rollback unhealthy Cloudflare deploy

On every Cloudflare deploy, check post-deploy health and roll back to the previous version automatically when degraded.

Babysit Cloudflare deployment

On every Cloudflare deploy, check post-deploy health and open an incident with a rollback recommendation when degraded.

Back to integrations