Find the right operation
Browse Workers, DNS, storage, and more. The catalog shows what is supported, what is read-only, and what is blocked.
Cloudflare, from your terminal
Know what changes. Before it changes.
cfctl is an open-source CLI for people and agents working with Cloudflare. Inspect your account, preview a change, then apply it with a record of what happened.
Runs locally on macOS and Linux. Built in Rust.
What it does
A clearer way to work with your account.
See the change first
Writes produce a plan with the account, target, permissions, cost, and recovery information before execution.
Give agents a clear contract
Use stable JSON, explicit approval, and redacted evidence to connect the same CLI to your local agent or scripts.
How it works
From intent to a checked result.
A write command prepares a plan. Execution happens separately, after the required approval. Each stage keeps a record you can inspect.
- 01OrientCheck the installed build, account, and workspace.
- 02DiscoverFind an operation and inspect its requirements.
- 03ReadRead the current Cloudflare state and save redacted evidence.
- 04PlanPreview the exact change, permissions, cost, and recovery path.
- 05ApproveApprove the exact operation when the policy requires it.
- 06ExecuteRun the approved plan once.
- 07VerifyCheck the outcome against live state using the declared verifier.
- 08Finish or recoverKeep the evidence. Reconcile an uncertain result before retrying.
Go deeper
The details are in the open.
Start with a read