# How to connect Cloudflare to Hermes Agent (paste one key, 20 tools)

> Connect Cloudflare to Hermes with ClawLink: paste your Cloudflare key once and 20 tools work from chat. No MCP server to run, nothing stored on your machine.

Web version: https://claw-link.dev/hermes/cloudflare

Most guides for giving Hermes Agent Cloudflare access start with registering your own OAuth app or pasting API keys into env files, then leave the token refresh and tool wiring to you. ClawLink gives Hermes a more practical Cloudflare setup: pair once in the browser and your always-on Hermes agent can act on Cloudflare for you, reading and doing real work on your behalf with no auth, token refresh, or tool wiring to build yourself.

**Start here — paste this into Hermes to set up ClawLink:**

> Set up ClawLink for Hermes and tell me when it's ready.
> 1. Install the plugin: `hermes plugins install ClawLink-HQ/hermes-plugin --enable`
> 2. Start pairing with `hermes clawlink begin`. It prints an approval link, so show me the link and stop, don't wait.
> 3. I'll approve it in my browser, then reply "approved".
> 4. When I say approved, finish setup: `hermes clawlink finish`
> 5. Then run `hermes clawlink test` and tell me whether ClawLink is ready.

## Setup

It takes three steps to connect Hermes to Cloudflare.

1. **Install ClawLink** — add the plugin to Hermes Agent once.
2. **Connect Cloudflare** — one-click OAuth in the ClawLink dashboard.
3. **Use it from chat** — ask Hermes Agent in plain English.

**Alternative for any agent (no plugin needed):** if the Hermes Agent plugin route isn't available or doesn't work, any AI agent with shell access can use the ClawLink CLI instead:

```bash
npx -y @useclawlink/cli login          # sign in via browser — no API key to paste
npx -y @useclawlink/cli connect cloudflare  # connect Cloudflare (browser OAuth)
npx -y @useclawlink/cli actions cloudflare  # list available actions
npx -y @useclawlink/cli run cloudflare <action> --input '<json>'  # execute (add --confirm for writes)
```

### Install by command

The prompt above walks Hermes through this. By hand, it is four commands and a browser approval:

```bash
hermes plugins install ClawLink-HQ/hermes-plugin --enable
hermes clawlink begin    # prints an approval link — open it and approve
hermes clawlink finish   # after approving in the browser
hermes clawlink test
```

Then connect Cloudflare in the [ClawLink dashboard](https://claw-link.dev/dashboard) — paste your Cloudflare API key once.

Verify the connection by asking Hermes:

> List my accounts with cloudflare_list_accounts, then cloudflare_list_zones and show me each zone with its status and plan. Do not change anything yet.

### Using a different agent?

The Hermes plugin is one client of ClawLink's MCP server. Claude Code, Cursor, Codex, or any agent that can run a shell command pairs with the same ClawLink account through the CLI:

```bash
npx -y @useclawlink/cli login
```

`login` opens the same browser approval and stores a credential locally. Once Cloudflare is connected in the dashboard, that agent calls the same 20 Cloudflare tools over MCP. Full setup for MCP clients and shell agents: [connect apps to any AI agent](https://claw-link.dev/learn/connect-apps-to-any-ai-agent).

## Cloudflare MCP for Hermes

Looking for a Cloudflare MCP server for Hermes Agent? ClawLink connects Cloudflare to Hermes Agent and exposes 20 Cloudflare tools your agent can call over [MCP](https://claw-link.dev/learn/what-is-an-mcp-server), with [hosted auth](https://claw-link.dev/learn/oauth-for-ai-agents) and nothing to run or maintain yourself. Using OpenClaw instead? The [OpenClaw Cloudflare integration](https://claw-link.dev/openclaw/cloudflare) works the same way.

Cloudflare authenticates with an API key, so you do paste one here: the difference is what happens afterwards. The routes the AI Overview teaches for connecting Cloudflare to Hermes are a developer's pile of work: Composio's Connect CLI with an MCP block in `~/.hermes/config.yaml`, a `cloudflared` tunnel exposing a server to the internet, or a browser-rendering plugin, each with its own token handling. Here the key goes into a hosted setup page once, the Hermes plugin pairs in four commands, and the 20 Cloudflare tools below are callable from chat: no config file edited, no tunnel run, nothing hosted on your machine, and the key lives server-side where rotating it means changing one thing. Cloudflare's own docs tell the closest story to ours, remote MCP with OAuth; this page is that shape already built for Hermes.

## What the Hermes Agent Cloudflare integration can do

20 Cloudflare tools are ready for Hermes Agent once the account is connected. The 17 below are the ones people reach for most; your agent can call all 20.

### 17 of 20 Cloudflare tools for Hermes

| Tool | What it does |
|---|---|
| **Create dns record** `cloudflare_create_dns_record` | Tool to create a new DNS record within a specific zone. Requires write privileges and makes live changes to the zone. |
| **Create list** `cloudflare_create_list` | Create a new empty custom list for use in WAF rules and filters. Lists can contain IP addresses, hostnames, ASNs, or redirects. Once created, use separate actions to add items to the list. |
| **Create zone** `cloudflare_create_zone` | Creates a new DNS zone (domain) in Cloudflare. A zone represents a domain and its DNS records. Use this when adding a new domain to manage with Cloudflare. |
| **Get bot management settings** `cloudflare_get_bot_management_settings` | Tool to retrieve a zone's Bot Management configuration (Bot Fight Mode / Super Bot Fight Mode / Enterprise Bot Management). Use after identifying the correct zone_id (e.g., via CLOUDFLARE_LIST_ZONES). |
| **Get lists** `cloudflare_get_lists` | Tool to fetch all WAF lists (no items) for an account. Results are paginated; iterate using page and per_page parameters until result_info.total_pages is reached to retrieve all lists. |
| **List account members** `cloudflare_list_account_members` | Lists all members of a Cloudflare account with their roles, permissions, and status. |
| **List accounts** `cloudflare_list_accounts` | List all Cloudflare accounts you have ownership or verified access to. Retrieves a paginated list of accounts with their details including account ID, name, type, settings, and creation date. |
| **List dns records** `cloudflare_list_dns_records` | Tool to list and search DNS records in a Cloudflare zone. |
| **List firewall rules** `cloudflare_list_firewall_rules` | Tool to list firewall rules for a specific DNS zone. Use after confirming the zone ID to retrieve and audit current firewall rules. Does not expose Workers routes or other routing constructs. |
| **List monitors** `cloudflare_list_monitors` | List all load-balancer monitors in a Cloudflare account |
| **List pools** `cloudflare_list_pools` | List all load balancer pools in a Cloudflare account |
| **List tunnels** `cloudflare_list_tunnels` | List Cloudflare Tunnel (cloudflared) tunnels in an account to discover tunnel IDs, names, and |
| **List zones** `cloudflare_list_zones` | Lists, searches, sorts, and filters zones in the authenticated account |
| **Update dns record** `cloudflare_update_dns_record` | Update an existing DNS record within a specific zone |
| **Update list** `cloudflare_update_list` | Update the description of a WAF list (cannot update items) |
| **Update tunnel configuration** `cloudflare_update_tunnel_configuration` | Update a remotely-managed Cloudflare Tunnel's configuration (ingress rules and routing) |
| **Update zone** `cloudflare_update_zone` | Update properties of an existing zone; changes apply immediately to the live zone |

## Example prompts

**Map your zones**

> List my accounts with cloudflare_list_accounts, then cloudflare_list_zones and show me each zone with its status and plan. Do not change anything yet.

**Audit DNS**

> List the DNS records for zone \<zone id> with cloudflare_list_dns_records and flag records that look stale, like old A records pointing at retired IPs.

**Create a DNS record**

> Create an A record with cloudflare_create_dns_record for zone \<zone id>, name "api", value \<ip>, proxied. Show me the arguments before sending, since this changes live DNS.

**Check account access**

> List the members of my Cloudflare account with cloudflare_list_account_members and tell me who has admin roles and who has been inactive.

## How the Cloudflare tools behave

Details that decide whether a Cloudflare prompt audits the right zone or edits live DNS by accident.

- **Zones are the root object.** `cloudflare_list_zones` is where real zone ids come from, and every zone-scoped call takes the id, never the domain name. An id from documentation fails like a typo.
- **Key permissions decide what works.** Cloudflare API keys carry per-key permissions, so a read-only key fails on writes with a 403 naming the missing `com.cloudflare.api.*` permission; the error includes a hint pointing to the Cloudflare dashboard.
- **DNS writes are live.** `cloudflare_create_dns_record` and `cloudflare_update_dns_record` change real DNS for real domains, so a confirmation step in the prompt is the habit that keeps an audit from becoming an incident.
- **Tunnels and lists are separate surfaces.** `cloudflare_list_tunnels`, the WAF list tools, and the load-balancer tools each answer their own question; an agent that conflates them over-fetches and hits rate limits.
- **Accounts and members are readable.** `cloudflare_list_accounts` and `cloudflare_list_account_members` answer access and role questions without opening the dashboard, which is the first call to make on a 403.

## ClawLink vs. building it yourself

The alternative to ClawLink is usually manual API key setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Cloudflare working from chat.

| | Manual | ClawLink |
|---|---|---|
| **Credential handling** | Collect, validate, store, and rotate the Cloudflare API key yourself, then make sure every tool call uses the right account. | Users complete the hosted ClawLink setup once and the connected Cloudflare account becomes available to the agent without you building credential management. |
| **Ongoing maintenance** | You own refresh logic, permission debugging, environment config, and every provider-specific edge case for Cloudflare. | ClawLink handles the repetitive integration plumbing so your team can focus on the workflow instead of the infrastructure. |
| **Agent usability** | You still need to expose the right Cloudflare actions to the runtime in a format your agent can reliably use. | 20 tools for Cloudflare are already exposed through ClawLink, so the agent can read and act from chat immediately. |

## ClawLink vs. Composio

Composio also exposes Cloudflare to AI agents. It is developer infrastructure: Python and TypeScript SDKs, an MCP server, and a catalog past 1,000 apps, aimed at teams shipping agent products. ClawLink is built for Hermes Agent users instead. You install the plugin once, connect Cloudflare in the browser, and the 20 tools above work from chat. There is no SDK and no config file, and the Cloudflare key you paste at setup is stored server-side rather than kept in your environment. Choosing between them? Read the full [Composio alternatives](https://claw-link.dev/hub/composio-alternatives) comparison.

### Hermes paired but still can't use Cloudflare
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

### Connection succeeds but no tools appear
Reconnect Cloudflare from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

### "Tool schema not loaded yet" error when calling Cloudflare tools
Cloudflare tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every Cloudflare call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

### Cloudflare returns 403 or "permission denied" on one action while others work
Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

### Cloudflare returns 401 "invalid token" although the account shows as connected
The causes the search results teach for this error are the manual route's: a wrong Authorization header format, confusing a Global Key with an API token, propagation delay after creating a token, or a token with wrong permissions. On a hosted connection the request formatting is handled, so the remaining causes are two. First, the stored key was regenerated or deleted in Cloudflare after setup, in which case every Cloudflare call fails from that moment and re-pasting the current key from the dashboard is the fix. Second, the key's permissions changed in Cloudflare, which shows up as permission errors rather than token errors. What is not the cause is anything in `~/.hermes` or the plugin's pairing: the plugin token and the Cloudflare key are different credentials, and search answers that conflate them will send you down the wrong path.

Ask the agent to diagnose it:

```text
Call cloudflare_list_accounts to check which Cloudflare account the connection acts as, then quote the exact error from the failed call. If it is an invalid-token error I will re-paste the key; do not retry before then.
```

### Cloudflare returns 403 or "permission denied" on one action while others work
Two usual causes, and both are about the key and the request rather than the connection. First, Cloudflare API keys carry per-key permissions, so a key created with only zone-read access fails on writes like `cloudflare_create_dns_record`, and the error names the missing permission: a `com.cloudflare.api.*` permission error means the key itself is too limited, and the fix is a key with the right permissions in Cloudflare, not a reconnect. Second, the agent may have sent a placeholder or guessed id (like "YOUR_ID" or a zone name from documentation) instead of a real one: ask it to run `cloudflare_list_zones` first and retry with the real zone id. The backend even adds a hint pointing to the Cloudflare dashboard on these permission errors, so read the full error before touching anything.

Ask the agent to diagnose it:

```text
Run cloudflare_list_accounts and cloudflare_list_zones and show me the real ids. Quote the exact 403 text, including any hint about the dashboard, then retry with a real id from that list.
```

### Cloudflare starts returning 429 or the agent stalls partway through an audit
Cloudflare rate-limits its API per account, and an agent walking every zone, then every record, firewall rule, pool, and tunnel, one call at a time, is exactly the traffic shape that meets the limit. The response is not to retry immediately, which lands in the same window, but to change the shape of the work: one zone at a time, and have the agent tell you what it intends to enumerate before it starts. If a full audit is genuinely needed, running it in stages across turns is more reliable than one sweep.

Ask the agent to diagnose it:

```text
Tell me how many Cloudflare calls you have made in the last minute and what you were enumerating. Quote any rate-limit text from the last response. Do not call Cloudflare again until I reply.
```

### Cloudflare tools are missing, or one tool name is not found
Two different failures. If Hermes shows no Cloudflare tools at all, the connection or pairing is incomplete: confirm the plugin was installed with `--enable`, that both `hermes clawlink begin` and `hermes clawlink finish` ran, that Cloudflare shows as connected in the dashboard, and start a fresh chat. If most tools work and a single name fails, that name is wrong rather than missing: the error lists the closest real tools, and the real catalog is one `clawlink_list_tools --integration cloudflare` away. There is also a first-call timing case unique to this setup: schemas load on demand, so the opening Cloudflare call in a fresh session can arrive before the catalog and needs one retry. What does not apply is the advice for this symptom that blames a client's MCP server registering only a couple of tools, which is Cloudflare's own Code Mode server, not this connection.

Ask the agent to diagnose it:

```text
List the Cloudflare tools you actually have access to. If there are none, run clawlink_list_integrations and confirm the plugin pair, then tell me what you see. If there are, tell me which one lists zones and use that exact name.
```

### API key setup works but results look incomplete
Double-check that the API key for Cloudflare has the right scopes or account access. A valid key can still be too limited for some reads or writes.

### Is there a Hermes Agent Cloudflare integration?
Yes. ClawLink is the fastest way to connect Hermes to Cloudflare: link your Cloudflare account once in the browser and Hermes Agent can call the Cloudflare API through 20 ready-made tools — no custom code or token handling.

### How do I connect Cloudflare to Hermes with ClawLink?
Install the plugin with `hermes plugins install ClawLink-HQ/hermes-plugin --enable`, then pair once: run `hermes clawlink begin`, approve the link in your browser, and run `hermes clawlink finish`. Connect Cloudflare in the dashboard and Hermes can use it from the next message — no config files, and the Cloudflare key you paste is stored server-side instead of in your environment.

### How long does it take to connect Cloudflare to Hermes Agent?
About two minutes. Sign in, click Connect next to Cloudflare in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

### Why use ClawLink instead of wiring Cloudflare up myself?
The alternative to ClawLink is usually manual API key setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want Cloudflare working from chat.

### Do I need a Cloudflare API token or a Global Key?
You paste one Cloudflare API key at setup, generated in your Cloudflare account settings, and it is stored server-side. The distinction the search results teach, Global Key versus API token, and the 401 causes that follow from it (wrong header format, propagation delay after creating a token), matter only on the manual route where you are building requests by hand. On a hosted connection you see none of that plumbing: the key is entered once, the agent calls the tools, and regenerating the key in Cloudflare means updating a single place in the dashboard. Cloudflare keys carry per-key permissions, so a key with limited access is a 403 you will see in chat, not a setup error.

### What can the agent do in Cloudflare?
The 20 tools cover the account and zone surface: zones and their DNS records, accounts and members, lists for WAF rules, firewall rules, load-balancer monitors and pools, tunnels, and bot management settings. The writes to be deliberate about are creating or updating DNS records and zones, because those change live DNS for real domains, and updating tunnel configuration, which changes routing. Reads, starting with `cloudflare_list_accounts` and `cloudflare_list_zones`, are the safe first steps.

### Is it safe to connect Cloudflare to an always-on Hermes agent?
The AI Overview answers this query "yes, generally safe" and its cited mitigations are AI Gateway, least privilege, and scoped tokens. The hosted connection implements the scoped-token half by construction: the key you paste is stored server-side, the agent never sees it, and revoking the connection from the dashboard ends its use immediately. The behavioral half is yours: DNS and zone changes are live internet changes, so require a confirmation step before writes, and treat any fetched content as untrusted input, since a zone's records are just data until an agent is told to act on them.

### How is this different from the Composio Connect route the AI Overview teaches?
The underlying Cloudflare API is the same, so the capability difference is small; the setup and upkeep difference is not. The Composio route involves their Connect CLI, an MCP server block hand-edited into `~/.hermes/config.yaml` with a consumer key, and infrastructure you then own. Here the plugin install and one pairing handshake are the entire client-side story, the key is entered once in the dashboard, and Cloudflare sits alongside your other connected accounts with one place to revoke. Choose on how much you want to run, not on features.

### Hermes paired but still can't use Cloudflare
Pairing is a two-step handshake: run `hermes clawlink begin`, approve the link in your browser, then run `hermes clawlink finish`. If you ran finish before approving, or the approval link expired, run `hermes clawlink begin` again to get a fresh link. Confirm the plugin was installed with `--enable`, then verify with `hermes clawlink test`.

## Related

- [GitHub tools](https://claw-link.dev/hermes/github) — Manage repositories, issues, pull requests, and workflows
- [Hermes PagerDuty integration](https://claw-link.dev/hermes/pagerduty) — Manage incidents, on-call schedules, and services
- [Connect SafetyCulture](https://claw-link.dev/hermes/safetyculture) — SafetyCulture (formerly iAuditor) is a workplace operations platform that enables teams to conduct digital inspections, manage audits, track issues, schedule tasks, and maintain compliance through mobile and web applications.