The bridge from K2 agents through Wrangler to your master AI - safe, approval-gated Cloudflare ops.
Inferido de los transportes que declara este listado (streamable-http). Que un cliente no aparezca aquí no significa que se haya descartado: simplemente Forge no puede confirmarlo.
La verificación confirma la identidad del publicador (la propiedad del repo), no la seguridad del código. El análisis de seguridad cubre los CVE conocidos y los scripts de instalación sospechosos.
Leído del código que npm publica realmente, en el momento del análisis. El paquete nunca se ejecutó. Las herramientas registradas dinámicamente en tiempo de ejecución, o escondidas en código empaquetado o minificado, pueden pasarse por alto — así que esto es un mínimo de la superficie de herramientas, no un censo completo.
submit_resultSubmit the complete evidence-backed job result. Always call this tool exactly once.Submit the complete evidence-backed job result. Always call this tool exactly once.
No se publicó ningún esquema de entrada para esta herramienta.
cloudflare-ops-mcpSin descripción publicadaEsta herramienta no publicó ninguna descripción. Forge no se la inventa.
federation_addRegister an upstream MCP server so its tools appear in THIS catalog under a namespace (namespace__tool) and calls proxy to it. Args: namespace (a-z0-9_-), url (https MCP endpoint), auth (optional Bearer token/connector key).Register an upstream MCP server so its tools appear in THIS catalog under a namespace (namespace__tool) and calls proxy to it. Args: namespace (a-z0-9_-), url (https MCP endpoint), auth (optional Bearer token/connector key).
No se publicó ningún esquema de entrada para esta herramienta.
federation_listList registered upstream MCP servers (namespace, url, whether authed).List registered upstream MCP servers (namespace, url, whether authed).
No se publicó ningún esquema de entrada para esta herramienta.
federation_removeprivilegiadaUnregister an upstream MCP server by namespace.Unregister an upstream MCP server by namespace.
No se publicó ningún esquema de entrada para esta herramienta.
policy_setSet governance policy for any tool (native or federated namespace__tool): allow | approve | block. Default is allow. 'approve' refuses the call unless it carries "_approved": true.Set governance policy for any tool (native or federated namespace__tool): allow | approve | block. Default is allow. 'approve' refuses the call unless it carries "_approved": true.
No se publicó ningún esquema de entrada para esta herramienta.
policy_listList all non-default tool policies.List all non-default tool policies.
No se publicó ningún esquema de entrada para esta herramienta.
scan_zoneRead-only snapshot of a domain's Cloudflare zone: all DNS records plus parsed SPF, DMARC, BIMI, and Email Routing status. Never writes.Read-only snapshot of a domain's Cloudflare zone: all DNS records plus parsed SPF, DMARC, BIMI, and Email Routing status. Never writes.
No se publicó ningún esquema de entrada para esta herramienta.
plan_email_authAnalyze a domain's email authentication (SPF/DKIM/DMARC/BIMI/routing) and report what is missing or misconfigured, with the exact records to add. Never writes.Analyze a domain's email authentication (SPF/DKIM/DMARC/BIMI/routing) and report what is missing or misconfigured, with the exact records to add. Never writes.
No se publicó ningún esquema de entrada para esta herramienta.
verify_domainRe-scan a domain and return a pass/fail checklist: SPF, DMARC present + enforced, MX, Email Routing, BIMI, DKIM count. Never writes.Re-scan a domain and return a pass/fail checklist: SPF, DMARC present + enforced, MX, Email Routing, BIMI, DKIM count. Never writes.
No se publicó ningún esquema de entrada para esta herramienta.
apply_dns_recordUpsert a single DNS record (create if absent, update if content differs, no-op if identical). DRY-RUN by default — returns the planned diff and writes nothing unless apply=true. Never deletes.Upsert a single DNS record (create if absent, update if content differs, no-op if identical). DRY-RUN by default — returns the planned diff and writes nothing unless apply=true. Never deletes.
No se publicó ningún esquema de entrada para esta herramienta.
delete_dns_recordprivilegiadaDelete exactly one DNS record after a fresh lookup. Requires domain, exact record_id, matching expected_name, and confirm=true. Refuses by default and never deletes by name alone.Delete exactly one DNS record after a fresh lookup. Requires domain, exact record_id, matching expected_name, and confirm=true. Refuses by default and never deletes by name alone.
No se publicó ningún esquema de entrada para esta herramienta.
set_dmarc_policyChange the _dmarc policy (none|quarantine|reject), preserving other tags. DRY-RUN by default — returns the before/after diff and writes nothing unless apply=true.Change the _dmarc policy (none|quarantine|reject), preserving other tags. DRY-RUN by default — returns the before/after diff and writes nothing unless apply=true.
No se publicó ningún esquema de entrada para esta herramienta.
setup_bimiCreate/update the default._bimi TXT record pointing at a logo SVG. REFUSES to write when DMARC is p=none (unless force=true) because BIMI won't be honored without enforced DMARC. DRY-RUN by default.Create/update the default._bimi TXT record pointing at a logo SVG. REFUSES to write when DMARC is p=none (unless force=true) because BIMI won't be honored without enforced DMARC. DRY-RUN by default.
No se publicó ningún esquema de entrada para esta herramienta.
setup_email_routingEnable Cloudflare Email Routing and create forward rules (+ optional catch-all). Cloudflare auto-adds the MX/SPF records. DRY-RUN by default. Destination addresses must be verified by their owner via Cloudflare's email.Enable Cloudflare Email Routing and create forward rules (+ optional catch-all). Cloudflare auto-adds the MX/SPF records. DRY-RUN by default. Destination addresses must be verified by their owner via Cloudflare's email.
No se publicó ningún esquema de entrada para esta herramienta.
pages_cutoverPlan or apply a Cloudflare Pages DNS cutover. Deletes only conflicting apex/www A/AAAA/CNAME records and www NS delegations, then creates proxied CNAMEs to the Pages target. DRY-RUN by default; writes only when apply=true.Plan or apply a Cloudflare Pages DNS cutover. Deletes only conflicting apex/www A/AAAA/CNAME records and www NS delegations, then creates proxied CNAMEs to the Pages target. DRY-RUN by default; writes only when apply=true.
No se publicó ningún esquema de entrada para esta herramienta.
purge_cachePurge Cloudflare's cache for a zone — the whole zone (default) or specific URLs. DRY-RUN by default: returns the scope and purges NOTHING unless apply=true. Needs a token with Zone > Cache Purge.Purge Cloudflare's cache for a zone — the whole zone (default) or specific URLs. DRY-RUN by default: returns the scope and purges NOTHING unless apply=true. Needs a token with Zone > Cache Purge.
No se publicó ningún esquema de entrada para esta herramienta.
create_turnstile_widgetPlan or create a Cloudflare Turnstile widget for a domain. DRY-RUN by default; creates the widget only when apply=true. Returns the public sitekey and one-time secret when applied.Plan or create a Cloudflare Turnstile widget for a domain. DRY-RUN by default; creates the widget only when apply=true. Returns the public sitekey and one-time secret when applied.
No se publicó ningún esquema de entrada para esta herramienta.
mint_scoped_tokenMint a narrow, auto-expiring Cloudflare API token for ONE zone (presets: zone-read, dns-zone, cache-purge; default 1h TTL). The vending machine for least-privilege agent work: hand a cheap agent a key that can't hurt anything and dies on its own. DRY-RUN by default — returns the exact policy JSON;…Mint a narrow, auto-expiring Cloudflare API token for ONE zone (presets: zone-read, dns-zone, cache-purge; default 1h TTL). The vending machine for least-privilege agent work: hand a cheap agent a key that can't hurt anything and dies on its own. DRY-RUN by default — returns the exact policy JSON;…
No se publicó ningún esquema de entrada para esta herramienta.
list_tokensList API tokens on the connected user: id, name, status, expiry, and whether cfops minted them. NEVER returns token values (Cloudflare only shows those once, at mint). Read-only.List API tokens on the connected user: id, name, status, expiry, and whether cfops minted them. NEVER returns token values (Cloudflare only shows those once, at mint). Read-only.
No se publicó ningún esquema de entrada para esta herramienta.
revoke_tokenRevoke an API token by id (e.g. a minted task-token you're done with early). DRY-RUN by default; deletes nothing unless apply=true.Revoke an API token by id (e.g. a minted task-token you're done with early). DRY-RUN by default; deletes nothing unless apply=true.
No se publicó ningún esquema de entrada para esta herramienta.
who_serves_domainAnswer 'what is ACTUALLY serving this domain?': zone → Worker routes, Worker custom domains, and Pages projects that claim it, with a warning when multiple products fight over it. Read-only.Answer 'what is ACTUALLY serving this domain?': zone → Worker routes, Worker custom domains, and Pages projects that claim it, with a warning when multiple products fight over it. Read-only.
No se publicó ningún esquema de entrada para esta herramienta.
account_doctorDiagnose the token/account situation: accounts visible to this token, whether the expected account is among them (wrong-token detection), and SAME-NAME Pages projects across accounts — the decoy that silently eats deploys. Read-only.Diagnose the token/account situation: accounts visible to this token, whether the expected account is among them (wrong-token detection), and SAME-NAME Pages projects across accounts — the decoy that silently eats deploys. Read-only.
No se publicó ningún esquema de entrada para esta herramienta.
pages_branch_checkCompare a Pages project's production branch against the branch you're about to deploy — catches the silent 'git says master, project says main, every deploy lands on a preview' failure. Read-only.Compare a Pages project's production branch against the branch you're about to deploy — catches the silent 'git says master, project says main, every deploy lands on a preview' failure. Read-only.
No se publicó ningún esquema de entrada para esta herramienta.
agent_research_startDelegate a bounded research, verification, zero-AI site-health, UI, Cloudflare diagnosis, inventory, data review, missed-items, or revision-proposal job to the private AMH WT coordinator. Returns immediately with job and memory hashes; the configured free lane or explicitly enabled paid K2 lane run…Delegate a bounded research, verification, zero-AI site-health, UI, Cloudflare diagnosis, inventory, data review, missed-items, or revision-proposal job to the private AMH WT coordinator. Returns immediately with job and memory hashes; the configured free lane or explicitly enabled paid K2 lane run…
No se publicó ningún esquema de entrada para esta herramienta.
agent_research_statusRead one delegated job, including its redacted timeline, sources, primary result, independent verifier result, gaps, and candidate revisions.Read one delegated job, including its redacted timeline, sources, primary result, independent verifier result, gaps, and candidate revisions.
No se publicó ningún esquema de entrada para esta herramienta.
agent_research_listList recent delegated jobs for this authenticated user. Read-only and tenant-isolated.List recent delegated jobs for this authenticated user. Read-only and tenant-isolated.
No se publicó ningún esquema de entrada para esta herramienta.
agent_briefingReturn the Continuity Keeper's current compact project briefing and memory hash: active platform, target, blocker, keep/archive/drop guidance, and next safe step.Return the Continuity Keeper's current compact project briefing and memory hash: active platform, target, blocker, keep/archive/drop guidance, and next safe step.
No se publicó ningún esquema de entrada para esta herramienta.
agent_controlSafely pause or resume new agent work, cancel a queued/running job at its next phase boundary, force read-only mode, or run retention cleanup. Models cannot disable read-only mode.Safely pause or resume new agent work, cancel a queued/running job at its next phase boundary, force read-only mode, or run retention cleanup. Models cannot disable read-only mode.
No se publicó ningún esquema de entrada para esta herramienta.
28 de 29 herramientas publicaron una descripción.
Los nombres y descripciones de las herramientas los escribe el publicador y se muestran literalmente como texto inerte. Son las cadenas que un cliente MCP pasa al modelo, así que Forge las analiza en busca de patrones de inyección de prompts — cualquier hallazgo aparece junto al análisis de seguridad de arriba. «Privilegiada» es una coincidencia de palabra clave en el nombre de la herramienta, no una auditoría de lo que hace: un nombre inofensivo puede hacer cualquier cosa.
The bridge from K2 agents through Wrangler to your master AI - safe, approval-gated Cloudflare ops.
Los nombres enlazados abren el índice de Forge con todas las entradas que se observó que exponen esa herramienta. Ver todas las herramientas indexadas.
Esta entrada no publica ningún paquete de npm, así que Forge no tiene un árbol de dependencias para ella. Es una carencia de cobertura, no una afirmación de que no tenga dependencias.