--- name: pp-cloudflare description: "Printing Press CLI for Cloudflare accounts, zones, DNS, Workers, Pages, R2, tunnels, Zero Trust, and agent infrastructure operations." author: "Cathryn Lavery" license: "Apache-2.0" argument-hint: " [args] | install cli|mcp" allowed-tools: "Read Bash" metadata: openclaw: requires: bins: - cloudflare-pp-cli install: - kind: go bins: [cloudflare-pp-cli] module: github.com/mvanhorn/printing-press-library/library/cloud/cloudflare/cmd/cloudflare-pp-cli --- # Cloudflare — Printing Press CLI ## Prerequisites: Install the CLI This skill drives the `cloudflare-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first: 1. Install via the Printing Press installer. It defaults binaries to `$HOME/.local/bin` on macOS/Linux and `%LOCALAPPDATA%\Programs\PrintingPress\bin` on Windows: ```bash npx -y @mvanhorn/printing-press-library install cloudflare --cli-only ``` 2. Verify: `cloudflare-pp-cli --version` 3. Ensure the reported install directory is on `$PATH` for the agent/runtime that will invoke this skill. If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.6 or newer). This installs into `$GOPATH/bin` (default `$HOME/go/bin`), so add that directory to `$PATH` instead: ```bash go install github.com/mvanhorn/printing-press-library/library/cloud/cloudflare/cmd/cloudflare-pp-cli@latest ``` If `--version` reports "command not found" after install, the runtime cannot see the binary directory on `$PATH`. Do not proceed with skill commands until verification succeeds. `cloudflare-pp-cli` is the Printing Press CLI for Cloudflare operations. Use it when you need agent-safe access to accounts, zones, DNS, Workers, Pages, R2, Email Routing, tunnels, Zero Trust, Radar, token diagnostics, and deployment workflows from the terminal. The CLI is most useful for compound Cloudflare work that is painful in the dashboard: checking token permissions before a task, connecting a domain to Pages or Workers, diagnosing DNS/SSL/Email Routing readiness, managing Worker secrets with redacted output, scanning cost and usage signals, or bootstrapping R2/D1/KV/Queues/Vectorize/AI Gateway resources for agent infrastructure. Authentication is token-first. Prefer a scoped API token in `CLOUDFLARE_API_TOKEN` or `cloudflare-pp-cli auth set-token`; avoid global API keys unless a legacy endpoint requires them. Use the `token doctor` and recipe commands before live mutations so the agent can request the narrowest viable permissions. ## Command Reference **accounts** — Manage accounts - `cloudflare-pp-cli accounts batch-move` — Batch move a collection of accounts to a specific organization. ⚠️ Not implemented. - `cloudflare-pp-cli accounts creation` — Create an account (only available for tenant admins at this time) - `cloudflare-pp-cli accounts deletion` — Delete a specific account (only available for tenant admins at this time). - `cloudflare-pp-cli accounts details` — Get information about a specific account that you are a member of. - `cloudflare-pp-cli accounts list` — List all accounts you have ownership or verified access to. - `cloudflare-pp-cli accounts update` — Update an existing account. **certificates** — Manage certificates - `cloudflare-pp-cli certificates origin-ca-create` — Create an Origin CA certificate. - `cloudflare-pp-cli certificates origin-ca-get` — Get an existing Origin CA certificate by its serial number. - `cloudflare-pp-cli certificates origin-ca-list` — List all existing Origin CA certificates for a given zone. - `cloudflare-pp-cli certificates origin-ca-revoke` — Revoke an existing Origin CA certificate by its serial number. **internal** — Manage internal - `cloudflare-pp-cli internal` — Internal route for testing URL submissions **ips** — Manage ips - `cloudflare-pp-cli ips` — Get IPs used on the Cloudflare/JD Cloud network, see https://www.cloudflare. **live** — Manage live - `cloudflare-pp-cli live` — Return a success message after running liveness checks **memberships** — Manage memberships - `cloudflare-pp-cli memberships user-s-account-delete` — Remove the associated member from an account. - `cloudflare-pp-cli memberships user-s-account-details` — Get a specific membership. - `cloudflare-pp-cli memberships user-s-account-list` — List memberships of accounts the user can access. - `cloudflare-pp-cli memberships user-s-account-update` — Accept or reject this account invitation. **oauth** — Manage oauth - `cloudflare-pp-cli oauth` — List all available OAuth scopes. This endpoint requires authentication but has no authorization role requirements. **organizations** — Manage organizations - `cloudflare-pp-cli organizations create-user` — Create a new organization for a user. (Currently in Public Beta - see https://developers.cloudflare. - `cloudflare-pp-cli organizations delete` — Delete an organization. The organization MUST be empty before deleting. - `cloudflare-pp-cli organizations list` — Retrieve a list of organizations a particular user has access to. (Currently in Public Beta - see https://developers. - `cloudflare-pp-cli organizations modify` — Modify organization. (Currently in Public Beta - see https://developers.cloudflare.com/fundamentals/organizations/) - `cloudflare-pp-cli organizations retrieve` — Retrieve the details of a certain organization. (Currently in Public Beta - see https://developers.cloudflare. **radar** — Manage radar - `cloudflare-pp-cli radar get-agent-readiness-summary` — Returns a summary of AI agent readiness scores across scanned domains, grouped by the specified dimension. - `cloudflare-pp-cli radar get-ai-bots-summary` — Retrieves an aggregated summary of AI bots HTTP requests grouped by the specified dimension. - `cloudflare-pp-cli radar get-ai-bots-summary-by-user-agent` — Retrieves the distribution of traffic by AI user agent. - `cloudflare-pp-cli radar get-ai-bots-timeseries` — Retrieves AI bots HTTP request volume over time. - `cloudflare-pp-cli radar get-ai-bots-timeseries-group` — Retrieves the distribution of HTTP requests from AI bots, grouped by the specified dimension over time. - `cloudflare-pp-cli radar get-ai-bots-timeseries-group-by-user-agent` — Retrieves the distribution of traffic by AI user agent over time. - `cloudflare-pp-cli radar get-ai-inference-summary` — Retrieves an aggregated summary of unique accounts using Workers AI inference grouped by the specified dimension. - `cloudflare-pp-cli radar get-ai-inference-summary-by-model` — Retrieves the distribution of unique accounts by model. - `cloudflare-pp-cli radar get-ai-inference-summary-by-task` — Retrieves the distribution of unique accounts by task. - `cloudflare-pp-cli radar get-ai-inference-timeseries-group` — Retrieves the distribution of unique accounts using Workers AI inference, grouped by the specified dimension over time. - `cloudflare-pp-cli radar get-ai-inference-timeseries-group-by-model` — Retrieves the distribution of unique accounts by model over time. - `cloudflare-pp-cli radar get-ai-inference-timeseries-group-by-task` — Retrieves the distribution of unique accounts by task over time. - `cloudflare-pp-cli radar get-ai-markdown-for-agents-summary` — Retrieves the overall median HTML-to-markdown reduction ratio for AI agent requests over the given date range. - `cloudflare-pp-cli radar get-ai-markdown-for-agents-timeseries` — Retrieves the median HTML-to-markdown reduction ratio over time for AI agent requests. - `cloudflare-pp-cli radar get-annotations` — Retrieves the latest annotations. - `cloudflare-pp-cli radar get-annotations-outages` — Retrieves the latest Internet outages and anomalies. - `cloudflare-pp-cli radar get-annotations-outages-top` — Retrieves the number of outages by location. - `cloudflare-pp-cli radar get-as-botnet-threat-feed` — Retrieves a ranked list of Autonomous Systems based on their presence in the Cloudflare Botnet Threat Feed. - `cloudflare-pp-cli radar get-asns-as-set` — Retrieves Internet Routing Registry AS-SETs that an AS is a member of. - `cloudflare-pp-cli radar get-asns-rel` — Retrieves AS-level relationship for given networks. - `cloudflare-pp-cli radar get-attacks-layer3-summary` — Retrieves the distribution of layer 3 attacks by the specified dimension. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-bitrate` — Retrieves the distribution of layer 3 attacks by bitrate. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-duration` — Retrieves the distribution of layer 3 attacks by duration. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-industry` — Retrieves the distribution of layer 3 attacks by targeted industry. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-ip-version` — Retrieves the distribution of layer 3 attacks by IP version. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-protocol` — Retrieves the distribution of layer 3 attacks by protocol. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-vector` — Retrieves the distribution of layer 3 attacks by vector. - `cloudflare-pp-cli radar get-attacks-layer3-summary-by-vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-by-bytes` — Get layer 3 attacks by bytes time series - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group` — Retrieves the distribution of layer 3 attacks grouped by dimension over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-bitrate` — Retrieves the distribution of layer 3 attacks by bitrate over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-duration` — Retrieves the distribution of layer 3 attacks by duration over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-industry` — Retrieves the distribution of layer 3 attacks by targeted industry over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-ip-version` — Retrieves the distribution of layer 3 attacks by IP version over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-protocol` — Retrieves the distribution of layer 3 attacks by protocol over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-vector` — Retrieves the distribution of layer 3 attacks by vector over time. - `cloudflare-pp-cli radar get-attacks-layer3-timeseries-group-by-vertical` — Retrieves the distribution of layer 3 attacks by targeted vertical over time. - `cloudflare-pp-cli radar get-attacks-layer3-top-attacks` — Retrieves the top layer 3 attacks from origin to target location. - `cloudflare-pp-cli radar get-attacks-layer3-top-industries` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. - `cloudflare-pp-cli radar get-attacks-layer3-top-origin-locations` — Retrieves the origin locations of layer 3 attacks. - `cloudflare-pp-cli radar get-attacks-layer3-top-target-locations` — Retrieves the target locations of layer 3 attacks. - `cloudflare-pp-cli radar get-attacks-layer3-top-verticals` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. - `cloudflare-pp-cli radar get-attacks-layer7-summary` — Retrieves the distribution of layer 7 attacks by the specified dimension. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-http-method` — Retrieves the distribution of layer 7 attacks by HTTP method. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-http-version` — Retrieves the distribution of layer 7 attacks by HTTP version. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-industry` — Retrieves the distribution of layer 7 attacks by targeted industry. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-ip-version` — Retrieves the distribution of layer 7 attacks by IP version. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product. - `cloudflare-pp-cli radar get-attacks-layer7-summary-by-vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries` — Retrieves layer 7 attacks over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group` — Retrieves the distribution of layer 7 attacks grouped by dimension over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-http-method` — Retrieves the distribution of layer 7 attacks by HTTP method over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-http-version` — Retrieves the distribution of layer 7 attacks by HTTP version over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-industry` — Retrieves the distribution of layer 7 attacks by targeted industry over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-ip-version` — Retrieves the distribution of layer 7 attacks by IP version used over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-managed-rules` — Retrieves the distribution of layer 7 attacks by managed rules over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-mitigation-product` — Retrieves the distribution of layer 7 attacks by mitigation product over time. - `cloudflare-pp-cli radar get-attacks-layer7-timeseries-group-by-vertical` — Retrieves the distribution of layer 7 attacks by targeted vertical over time. - `cloudflare-pp-cli radar get-attacks-layer7-top-attacks` — Retrieves the top attacks from origin to target location. - `cloudflare-pp-cli radar get-attacks-layer7-top-industries` — This endpoint is deprecated. To continue getting this data, switch to the summary by industry endpoint. - `cloudflare-pp-cli radar get-attacks-layer7-top-origin-as` — Retrieves the top origin autonomous systems of layer 7 attacks. - `cloudflare-pp-cli radar get-attacks-layer7-top-origin-location` — Retrieves the top origin locations of layer 7 attacks. - `cloudflare-pp-cli radar get-attacks-layer7-top-target-location` — Retrieves the top target locations of and by layer 7 attacks. Values are a percentage out of the total layer 7 attacks. - `cloudflare-pp-cli radar get-attacks-layer7-top-verticals` — This endpoint is deprecated. To continue getting this data, switch to the summary by vertical endpoint. - `cloudflare-pp-cli radar get-bgp-hijacks-events` — Retrieves the BGP hijack events. - `cloudflare-pp-cli radar get-bgp-ips-timeseries` — Retrieves time series data for the announced IP space count, represented as the number of IPv4 /24s and IPv6 /48s - `cloudflare-pp-cli radar get-bgp-ips-top-ases` — Returns the top-N autonomous systems by announced IP space at the nearest 8-hour RIB boundary at or before the - `cloudflare-pp-cli radar get-bgp-pfx2as` — Retrieves the prefix-to-ASN mapping from global routing tables. - `cloudflare-pp-cli radar get-bgp-pfx2as-moas` — Retrieves all Multi-Origin AS (MOAS) prefixes in the global routing tables. - `cloudflare-pp-cli radar get-bgp-route-leak-events` — Retrieves the BGP route leak events. - `cloudflare-pp-cli radar get-bgp-routes-asns` — Retrieves all ASes in the current global routing tables with routing statistics. - `cloudflare-pp-cli radar get-bgp-routes-realtime` — Retrieves real-time BGP routes for a prefix, using public real-time data collectors (RouteViews and RIPE RIS). - `cloudflare-pp-cli radar get-bgp-routes-stats` — Retrieves the BGP routing table stats. - `cloudflare-pp-cli radar get-bgp-rpki-aspa-changes` — Retrieves ASPA (Autonomous System Provider Authorization) changes over time. - `cloudflare-pp-cli radar get-bgp-rpki-aspa-snapshot` — Retrieves current or historical ASPA (Autonomous System Provider Authorization) objects. - `cloudflare-pp-cli radar get-bgp-rpki-aspa-timeseries` — Retrieves ASPA (Autonomous System Provider Authorization) object count over time. - `cloudflare-pp-cli radar get-bgp-rpki-roas-timeseries` — Retrieves RPKI ROA (Route Origin Authorization) validation ratios over time. - `cloudflare-pp-cli radar get-bgp-timeseries` — Retrieves BGP updates over time. - `cloudflare-pp-cli radar get-bgp-top-ases` — Retrieves the top autonomous systems by BGP updates (announcements only). - `cloudflare-pp-cli radar get-bgp-top-asns-by-prefixes` — Retrieves the full list of autonomous systems on the global routing table ordered by announced prefixes count. - `cloudflare-pp-cli radar get-bgp-top-prefixes` — Retrieves the top network prefixes by BGP updates. - `cloudflare-pp-cli radar get-bot-details` — Retrieves the requested bot information. - `cloudflare-pp-cli radar get-bots` — Retrieves a list of bots. - `cloudflare-pp-cli radar get-bots-summary` — Retrieves an aggregated summary of bots HTTP requests grouped by the specified dimension. - `cloudflare-pp-cli radar get-bots-timeseries` — Retrieves bots HTTP request volume over time. - `cloudflare-pp-cli radar get-bots-timeseries-group` — Retrieves the distribution of HTTP requests from bots, grouped by the specified dimension over time. - `cloudflare-pp-cli radar get-certificate-authorities` — Retrieves a list of certificate authorities. - `cloudflare-pp-cli radar get-certificate-authority-details` — Retrieves the requested CA information. - `cloudflare-pp-cli radar get-certificate-log-details` — Retrieves the requested certificate log information. - `cloudflare-pp-cli radar get-certificate-logs` — Retrieves a list of certificate logs. - `cloudflare-pp-cli radar get-crawlers-summary` — Retrieves an aggregated summary of HTTP requests from crawlers, grouped by the specified dimension. - `cloudflare-pp-cli radar get-crawlers-timeseries-group` — Retrieves the distribution of HTTP requests from crawlers, grouped by the specified dimension over time. - `cloudflare-pp-cli radar get-ct-summary` — Retrieves an aggregated summary of certificates grouped by the specified dimension. - `cloudflare-pp-cli radar get-ct-timeseries` — Retrieves certificate volume over time. - `cloudflare-pp-cli radar get-ct-timeseries-group` — Retrieves the distribution of certificates grouped by the specified dimension over time. - `cloudflare-pp-cli radar get-dns-as112-summary` — Retrieves the distribution of AS112 queries by the specified dimension. - `cloudflare-pp-cli radar get-dns-as112-timeseries` — Retrieves the AS112 DNS queries over time. - `cloudflare-pp-cli radar get-dns-as112-timeseries-by-dnssec` — Retrieves the distribution of DNS queries to AS112 by DNSSEC (DNS Security Extensions) support. - `cloudflare-pp-cli radar get-dns-as112-timeseries-by-edns` — Retrieves the distribution of DNS queries to AS112 by EDNS (Extension Mechanisms for DNS) support. - `cloudflare-pp-cli radar get-dns-as112-timeseries-by-ip-version` — Retrieves the distribution of DNS queries to AS112 by IP version. - `cloudflare-pp-cli radar get-dns-as112-timeseries-by-protocol` — Retrieves the distribution of DNS queries to AS112 by protocol. - `cloudflare-pp-cli radar get-dns-as112-timeseries-by-query-type` — Retrieves the distribution of DNS queries to AS112 by type. - `cloudflare-pp-cli radar get-dns-as112-timeseries-by-response-codes` — Retrieves the distribution of AS112 DNS requests classified by response code. - `cloudflare-pp-cli radar get-dns-as112-timeseries-group` — Retrieves the distribution of AS112 queries grouped by dimension over time. - `cloudflare-pp-cli radar get-dns-as112-timeseries-group-by-dnssec` — Retrieves the distribution of AS112 DNS queries by DNSSEC (DNS Security Extensions) support over time. - `cloudflare-pp-cli radar get-dns-as112-timeseries-group-by-edns` — Retrieves the distribution of AS112 DNS queries by EDNS (Extension Mechanisms for DNS