Cloudflare has recently introduced the Cloudflare One stack, an innovative open-source library designed to empower AI agents with the skills necessary to navigate the complexities of planning, deploying, managing, and migrating Zero Trust environments. This development eliminates the need for practitioners to thoroughly learn the entire product suite before they can benefit from its functionalities. The skills are packaged as two lightweight files: cloudflare-one, which provides product guidance, and cloudflare-one-migration, which facilitates vendor-to-vendor translation. Notably, the migration logic includes explicit standards to assist users transitioning from Zscaler and Palo Alto Networks.
Teams are already using agents to write code, triage alerts, and automate workflows. On their own, agents are not trained on the nuances of an organization’s specific network topology or vendor configurations.
The standout feature for security teams is undoubtedly the migration capability, which simplifies the process of transferring applications. Users can instruct an agent to move Zscaler Private Access applications to Cloudflare Access, armed with the knowledge of how to translate Zscaler application definitions into their Cloudflare counterparts. The agent can automate the transformation of user groups and policies, interact with the Cloudflare API to create necessary resources, and provide a detailed summary of what has been migrated, as well as what still requires manual attention. Drawing from Cloudflare’s experience, the same migration logic has been successfully employed in their Descaler and Deskope programs, enabling enterprise customers to transition from Zscaler and Netskope to Cloudflare in just hours.
Each skill file features structured knowledge, decision trees, and tool definitions, which agents can automatically load when the situation calls for it. Furthermore, the cloudflare-one skill encompasses the entire lifecycle, from replacing VPN services with Cloudflare Access to ensuring user and network security with Gateway. It also facilitates connectivity options like Tunnel, Mesh, and WAN, and enables troubleshooting via the Digital Experience Monitoring (DEX) toolkit. When tasked with replacing VPN infrastructure, the agent generates an inventory of existing applications, aligning each with appropriate Cloudflare elements, devising a deployment sequence that minimizes downtime, and composing a configuration summary for team review before executing any changes.
For enhanced functionality, when utilized alongside the Cloudflare code mode MCP server, these skills acquire a typed interface to the Cloudflare API. This allows agents to inspect live configurations, examine policies, and implement changes through structured workflows, rather than making ad-hoc API calls, maintaining a seamless operational flow. It’s crucial to emphasize that authentication credentials are kept secure as the MCP server manages them independently.
However, the pivotal question remains: are security teams ready to allow agents to interact with Zero Trust configurations? The Cloudflare One stack is built with a review-before-apply protocol. Agents present proposed changes along with summaries, but all modifications require practitioner approval before implementation. One security professional aptly noted on X:
Not replacing the security team, but compressing the route from intent to configured policy. The enterprise question is whether every generated change has approval, diff, owner, and rollback attached.
This brings to light the need for setting appropriate boundaries within security infrastructure; a misconfigured Gateway policy or an incorrect Access application mapping could lead to vulnerabilities or access issues.
For Cloudflare’s partner ecosystem, the One stack serves as invaluable packaged expertise. Partners who facilitate Cloudflare One deployments for clients can leverage these skills to accelerate deployment timelines, enhance troubleshooting accuracy, and significantly reduce the manual and error-prone vendor-to-vendor translation tasks.
Currently available on GitHub, the Cloudflare One stack is poised for further enhancements, with new skills for additional migration sources and advanced troubleshooting workflows already under development.
Inspired by: Source
