sourcey
Add your company

agents:log.jsonSKILL.mdmcp.jsonopenapi.yml

← Cloudflare

Agent report card

Can an agent use Cloudflare Developer Platform through API resource management?

Grade C+: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.

Observedrev sha256:5885b19f6ac6…barrier checks 0/5 verified

Agent ReadinessC+Limited

Five-stage assessment

Where agent autonomy holds and where it breaks

Five states · each from its own evidence · lifecycle order, not a journey
  1. EvaluateReady
  2. Sign upLimited
  3. PayLimited
  4. ProvisionLimited
  5. OperateLimited
  1. 01

    Evaluate

    Ready

    The exact service and stable evaluation or access entrypoints are publicly discoverable.

    The Cloudflare API reference documentation explicitly exposes stable entrypoints and methods, such as Upload Worker Module, and lists public API navigation and endpoints.

    Applicable terms are stable, readable, retrievable, and materially complete.

    Eligibility conditions and required inputs are explicit and decidable.

    Price or no-charge status, variables, currency, and material conditions are explicit.

    Verified structured artifacts accelerate discovery of the evaluation surface.

    Evidence and actions6 signals

    Can an agent decide every material eligibility condition before commitment?

    supported: fresh

    Eligibility conditions and required inputs are explicit and decidable.

    The Self-Serve Subscription Agreement explicitly states that entering into the agreement requires authority to bind the entity represented, and that the agreement becomes effective when accepted, accessed, or used.

    eligibility_decidability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent estimate cost or confirm no-charge status before commitment?

    supported: fresh

    Price or no-charge status, variables, currency, and material conditions are explicit.

    Cloudflare provides explicit, transparent pricing options in USD for plans including Free ($0/month), Pro ($20/mo billed annually or $25/mo billed monthly), and Business ($200/mo billed annually or $250/mo billed monthly).

    pricing_decidability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent find the exact service and its stable entrypoints?

    supported: fresh

    The exact service and stable evaluation or access entrypoints are publicly discoverable.

    The Cloudflare API reference documentation explicitly exposes stable entrypoints and methods, such as Upload Worker Module, and lists public API navigation and endpoints.

    service_discovery: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Are verified structured discovery artifacts available?

    supported: fresh

    Verified structured artifacts accelerate discovery of the evaluation surface.

    Cloudflare explicitly provides machine-readable structured discovery artifacts, including exporting OpenAPI schemas for API operations and pointing to structured documentation files (llms.txt).

    structured_evaluation_discovery: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent retrieve and understand the applicable commitment terms?

    supported: fresh

    Applicable terms are stable, readable, retrievable, and materially complete.

    The complete Self-Serve Subscription Agreement terms governing Cloudflare's Services and APIs are accessible, readable, and retrievable.

    terms_access: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Does the vendor deliberately describe access for web agents?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The provided evidence mentions robots.txt rules API endpoints and crawlers in documentation, but does not provide the explicit web-agent access permissions or disallows for the assessed resources.

    verified_web_agent_access: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

  2. 02

    Sign up

    Limited

    Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.

    Cloudflare provides scoped, revocable API tokens with defined permissions, but token secret delivery requires manual user copying from the dashboard.

    A stable canonical route begins the required access bootstrap.

    Evidence and actions5 signals

    Can an agent operate the access controls and safe handoffs deterministically?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The registration capture at dash.cloudflare.com returned a bot-verification interstitial ('Just a moment... Performing security verification') rather than the sign-up form; the access flow itself was not observed.

    access_control_operability: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent obtain access without an unsupported CAPTCHA boundary?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The registration capture at dash.cloudflare.com returned a bot-verification interstitial ('Just a moment... Performing security verification') rather than the sign-up form; the access flow itself was not observed.

    captcha_compatible_access: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent obtain scoped, revocable authority for this service?

    supported: fresh

    Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.

    Cloudflare provides scoped, revocable API tokens with defined permissions, but token secret delivery requires manual user copying from the dashboard.

    delegated_identity_access: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    What would improve this stage

    • Provide scoped delegated authorization with consent, revocation, and deterministic resumption.
  3. 03

    Pay

    Limited

    Self-service is tier- or condition-limited, or a bounded vendor review exposes status.

    Documentation establishes self-service management paths to purchase Cloudflare products, add payment methods, or upgrade domain plans in the dashboard, but contract plans for mission-critical applications require custom enterprise billing.

    Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

    Evidence and actions4 signals

    Can an agent construct checkout, hand off approval safely, and resume?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained evidence describes adding primary and additional payment methods in the Cloudflare dashboard, but it does not establish an API, protocol, or web flow for deterministic checkout construction, approval handoff, and resumption.

    checkout_operability: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Is the exact commercial commitment disclosed before authorization?

    supported: fresh

    Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

    Cloudflare discloses commercial commitments for its plans and products, including free ($0/month), Pro ($20/mo billed annually or $25/mo billed monthly), Business ($200/mo billed annually or $250/mo billed monthly), and Workers usage rates ($0.30 / million requests, $0.02 / million CPU ms).

    commitment_disclosure: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can payment be authorized within scoped agent or explicit human authority?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    While documentation lists payment methods such as credit cards, PayPal, Apple Pay, Google Pay, and Stripe Link along with 3D Secure authentication, the retained text does not define a payment authorization mechanism with scoped agent delegation or explicit human-confirmed authorization with receipts.

    payment_authorization: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Is a direct self-service path to paid access documented?

    supported: fresh

    Self-service is tier- or condition-limited, or a bounded vendor review exposes status.

    Documentation establishes self-service management paths to purchase Cloudflare products, add payment methods, or upgrade domain plans in the dashboard, but contract plans for mission-critical applications require custom enterprise billing.

    self_service_purchase: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    What would improve this stage

    • Document a direct purchase path or bounded vendor review with machine-readable status.
  4. 04

    Provision

    Limited

    Delivery needs additional human transfer or has weak scope or lifecycle semantics.

    According to Cloudflare documentation, selecting Create Token generates the token's secret, which must be copied to a secure place by the user and is only shown once. Because access material delivery relies on manual human copying/transfer, it satisfies partial delivery.

    Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.

    Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

    Evidence and actions3 signals

    Can usable access material be delivered securely to an authorized agent?

    supported: fresh

    Delivery needs additional human transfer or has weak scope or lifecycle semantics.

    According to Cloudflare documentation, selecting Create Token generates the token's secret, which must be copied to a secure place by the user and is only shown once. Because access material delivery relies on manual human copying/transfer, it satisfies partial delivery.

    access_material_delivery: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent determine successful provisioning completion and reconcile asynchronous failure?

    supported: fresh

    Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.

    A deployment records which version is actively serving traffic and who created it and when, so an agent can confirm a deployment completed; the tested pages do not document polling, terminal failure states or reconciliation of an asynchronous provisioning failure.

    provisioning_completion: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can provisioning be initiated within supported agent authority?

    supported: fresh

    Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

    Provisioning and updates can be triggered directly by agents through Cloudflare's API endpoints (such as Workers scripts upload) or CLI tools like Wrangler via 'wrangler deploy'.

    provisioning_operability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    What would improve this stage

    • Deliver scoped access material through a secure documented machine-usable flow.
    • Expose bounded machine-readable terminal status and reconciliation semantics.
  5. 05

    Operate

    Limited

    Safe failure handling is documented only partially.

    Cloudflare troubleshooting documentation states that verifying an API token via /user/tokens/verify returns success status and expiration metadata, but it does not establish full failure mode semantics such as retries, idempotency, or reconciliation.

    Only part of the credential lifecycle is agent-operable.

    Every essential target has a stable documented agent-usable interface alternative.

    Request-time authentication is documented and usable under scoped agent authority.

    Essential operations have stable readable request, response, and effect semantics.

    Evidence and actions6 signals

    Is an agent-native protocol interface verified against the essential targets?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Cloudflare Developer Platform; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets.

    agent_protocol_interface: Unknown: tested 6 Sept

    • resource-api

    Method public-semantic-assessment 2026-09-06

    Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?

    supported: fresh

    Only part of the credential lifecycle is agent-operable.

    Cloudflare API documentation describes creating and verifying API tokens with specific permissions and TTLs, and using the /user/tokens/verify endpoint to check status. Complete agent management of rotation, revocation, compromise response, and recovery is not established.

    credential_lifecycle: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent handle applicable failure modes safely?

    supported: fresh

    Safe failure handling is documented only partially.

    Cloudflare troubleshooting documentation states that verifying an API token via /user/tokens/verify returns success status and expiration metadata, but it does not establish full failure mode semantics such as retries, idempotency, or reconciliation.

    failure_contract: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent authenticate service operations with scoped authority?

    supported: fresh

    Request-time authentication is documented and usable under scoped agent authority.

    Cloudflare API operations authenticate using HTTP Bearer tokens via the Authorization header, which can be verified at the /user/tokens/verify endpoint.

    operation_authentication: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Are essential operation inputs, outputs, and effects stable and decidable?

    supported: fresh

    Essential operations have stable readable request, response, and effect semantics.

    Cloudflare API endpoints provide defined request parameters, response schemas, and rate-limiting headers across troubleshooting, rate limits, and Workers script update resources.

    operation_contract: Ready: tested 6 Sept

    • resource-api

    Method public-semantic-assessment 2026-09-06

    Can an agent perform every essential assessment target through a usable interface?

    supported: fresh

    Every essential target has a stable documented agent-usable interface alternative.

    Cloudflare provides documented API HTTP interfaces across API troubleshooting, rate limit references, and Workers script update endpoints.

    target_interface_access: Ready: tested 6 Sept

    • resource-api

    Method public-semantic-assessment 2026-09-06

    What would improve this stage

    • Document applicable structured errors, retry, cancellation, and reconciliation semantics.
    • Provide scoped expiry, rotation, revocation, compromise, and recovery operations.

What works

  • Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.

What blocks agents

No stage is established as blocked.

Where autonomy is limited

  • Sign up: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
  • Pay: Self-service is tier- or condition-limited, or a bounded vendor review exposes status.
  • Provision: Delivery needs additional human transfer or has weak scope or lifecycle semantics.
  • Operate: Safe failure handling is documented only partially.

What this grade establishes

14 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.

How the grade is derived

A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.

Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.

Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.

Startup offers

Cloudflare on the startup-offers board

catalog record →

Distribution

The grade’s badge

One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.

Live sourcey badge for Cloudflare Agent Readiness grade C+
[![sourcey record](https://sourcey.com/badges/agent-readiness/arp_01kzf0m4x62a9z5fqb4kvp1hme.svg)](https://sourcey.com/log/cloudflare/agent-readiness/cloudflare-developer-platform/api-resource-management)

Improve the report

Correct it, rerun it, or improve the funnel.

Report outdated evidenceRequest reassessmentClaim this record
Profile
arp_01kzf0m4x62a9z5fqb4kvp1hme
Projection
sha256:7c9aab2e86f70cd6f9a2de83caca999172fb5670938fea3af8cd773340fed4fa
Policy
service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d

Every request carries these exact identifiers.How report cards are assessed →View the exact declaration