Blog
2 min read

Cloudflare Launches cf, an Agent-Friendly CLI for the Entire Cloudflare API

Cloudflare announced cf on 28 September 2026: one command-line tool covering the whole Cloudflare API, with JSON-first output and typed configuration so both people and AI agents can use it. How to install it (npm, Node 22.18+), how it relates to Wrangler, and how to use it safely with a coding agent.

On 28 September 2026, the first day of Birthday Week, Cloudflare launched cf: a single CLI for the entire Cloudflare API — DNS, zones, Workers, R2, firewall rules, domains and more — designed for humans and AI agents. It's an open beta, so commands may still change. (What Is a CLI?)

What makes it different

  • Everything in one tool. Previously you'd use Wrangler for Workers, the dashboard for most settings, and raw curl against the API for the rest. cf is generated from Cloudflare's API definitions, so it covers the whole surface — and stays in sync as the API grows.
  • JSON-first output. Agents and scripts can parse results reliably instead of scraping human-formatted tables.
  • Typed configuration.
  • Open-source pipeline. Cloudflare also open-sourced Forge, the pipeline that generates cf, its SDKs and its docs from API definitions.

Install

npm install --global cf
cf --version

It requires Node.js 22.18 or later (Bun isn't supported). The package installs two names for the same CLI, cf and cloudflare — use cloudflare if something else on your PATH is already called cf. (What Is nvm?)

cf vs Wrangler

Wrangler remains the tool for developing and deploying Workers projects — local dev server, bindings, wrangler deploy. cf is the broad, API-wide tool for managing everything else in your account, and for automation. Expect to use both.

Using it with a coding agent

This is the point of the "agentic" framing: Claude Code or another agent can now manage DNS records, check a domain, or adjust a cache rule by running cf commands and reading JSON back. Sensible guard rails:

  • Scoped API tokens. Create a Cloudflare API token limited to the zones and permissions the agent actually needs — not your global API key. (Principle of Least Privilege)
  • Approve writes. Let the agent run read commands freely; require approval for changes, especially DNS, firewall and anything that spends money (domain registration is non-refundable). (Claude Code Permission Modes)
  • Keep the token out of the repo. Use an environment variable. (Hide API Keys in an AI-Built App)

The bigger trend

Cloudflare's own data from Birthday Week says automated traffic now exceeds human traffic on its network. Tools are being redesigned for agents as first-class users — cf, the agent-ready Registrar API and Protected Quick Tunnels all came out of the same week. (Cloudflare Birthday Week 2026)

Source: Cloudflare Birthday Week 2026 wrap-up · cf documentation

EasySpawn gives Claude Code a persistent server where tools like cf stay installed and configured with scoped credentials, so infrastructure chores can be delegated and reviewed. See how it works or join the waitlist.

Related: What Is Cloudflare? · DNS Records Explained · Cloudflare Registrar API for Agents · Claude Code MCP Servers

Keep reading