175 lines
3.9 KiB
Markdown
175 lines
3.9 KiB
Markdown
# Cloudflare Control Plane Capability Registry v2
|
|
|
|
Generated: 2025-12-18T02:38:01.740122+00:00
|
|
Version: 1.0.1
|
|
|
|
## MCP Servers
|
|
|
|
### cloudflare_safe
|
|
**Module**: `cloudflare.mcp.cloudflare_safe`
|
|
**Entrypoint**: `cloudflare.mcp.cloudflare_safe`
|
|
**Purpose**: Secure Cloudflare API operations
|
|
|
|
**Tools**:
|
|
- cf_snapshot (read/write token required)
|
|
- cf_refresh (write token required)
|
|
- cf_config_diff (read; requires snapshot_id)
|
|
- cf_export_config (read)
|
|
- cf_tunnel_status (read)
|
|
- cf_tunnel_ingress_summary (read)
|
|
- cf_access_policy_list (read)
|
|
|
|
**Auth/Env**: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
|
|
**Side Effects**: read-only unless token present; cf_refresh/cf_snapshot are mutating
|
|
**Outputs**: json, terraform_hcl
|
|
|
|
**Capabilities**:
|
|
- dns_record_management
|
|
- waf_rule_configuration
|
|
- tunnel_health_monitoring
|
|
- zone_analytics_query
|
|
- terraform_state_synchronization
|
|
|
|
### waf_intelligence
|
|
**Module**: `cloudflare.mcp.waf_intelligence`
|
|
**Entrypoint**: `cloudflare.mcp.waf_intelligence.mcp_server`
|
|
**Purpose**: WAF rule analysis and synthesis
|
|
|
|
**Tools**:
|
|
- waf_capabilities (read)
|
|
- waf_analyze (read)
|
|
- waf_assess (read)
|
|
- waf_generate_gitops_proposals (propose)
|
|
|
|
**Auth/Env**:
|
|
**Side Effects**: propose-only; generates GitOps proposals
|
|
**Outputs**: json, terraform_hcl, gitops_mr
|
|
|
|
**Capabilities**:
|
|
- waf_config_analysis
|
|
- threat_intelligence_integration
|
|
- compliance_mapping
|
|
- rule_gap_identification
|
|
- terraform_ready_rule_generation
|
|
|
|
### oracle_answer
|
|
**Module**: `cloudflare.mcp.oracle_answer`
|
|
**Entrypoint**: `cloudflare.mcp.oracle_answer`
|
|
**Purpose**: Security decision support
|
|
|
|
**Tools**:
|
|
- oracle_answer (read)
|
|
|
|
**Auth/Env**:
|
|
**Side Effects**: read-only; security classification only
|
|
**Outputs**: json, security_classification
|
|
|
|
**Capabilities**:
|
|
- security_classification
|
|
- routing_decision_support
|
|
- threat_assessment
|
|
- pre_execution_screening
|
|
|
|
## Terraform Resources
|
|
|
|
### dns_management
|
|
**Files**: dns.tf
|
|
|
|
**Capabilities**:
|
|
- automated_dns_provisioning
|
|
- spf_dmarc_mx_configuration
|
|
- tunnel_based_routing
|
|
- proxied_record_management
|
|
|
|
### waf_security
|
|
**Files**: waf.tf
|
|
|
|
**Capabilities**:
|
|
- custom_waf_rules
|
|
- managed_ruleset_integration
|
|
- bot_management
|
|
- rate_limiting
|
|
- country_blocking
|
|
|
|
### tunnel_infrastructure
|
|
**Files**: tunnels.tf
|
|
|
|
**Capabilities**:
|
|
- multi_service_tunnel_routing
|
|
- ingress_rule_management
|
|
- health_monitoring
|
|
- credential_rotation
|
|
|
|
## GitOps Tools
|
|
|
|
### waf_rule_proposer
|
|
**File**: gitops/waf_rule_proposer.py
|
|
**Purpose**: Automated WAF rule generation
|
|
**Side Effects**: creates GitLab merge requests
|
|
**Outputs**: terraform_hcl, gitops_mr
|
|
|
|
**Capabilities**:
|
|
- threat_intel_driven_rules
|
|
- gitlab_ci_integration
|
|
- automated_mr_creation
|
|
- compliance_mapping
|
|
|
|
### invariant_checker
|
|
**File**: scripts/invariant_checker_py.py
|
|
**Purpose**: Real-time state validation
|
|
**Side Effects**: generates anomaly reports
|
|
**Outputs**: json, anomaly_report
|
|
|
|
**Capabilities**:
|
|
- dns_integrity_checks
|
|
- waf_compliance_validation
|
|
- tunnel_health_monitoring
|
|
- drift_detection
|
|
|
|
### drift_guardian
|
|
**File**: scripts/drift_guardian_py.py
|
|
**Purpose**: Automated remediation
|
|
**Side Effects**: applies Terraform changes
|
|
**Outputs**: terraform_apply, remediation_report
|
|
|
|
**Capabilities**:
|
|
- state_reconciliation
|
|
- auto_remediation
|
|
- ops_notification
|
|
|
|
## Security Framework
|
|
|
|
### layer0
|
|
**Components**: entrypoint.py, shadow_classifier.py, preboot_logger.py
|
|
|
|
**Capabilities**:
|
|
- pre_execution_security_classification
|
|
- threat_assessment
|
|
- security_event_logging
|
|
- routing_decision_support
|
|
|
|
**Classification Levels**:
|
|
- catastrophic
|
|
- forbidden
|
|
- ambiguous
|
|
- blessed
|
|
|
|
## Operational Tools
|
|
|
|
### systemd_services
|
|
**Services**: autonomous-remediator, drift-guardian, tunnel-rotation
|
|
|
|
**Capabilities**:
|
|
- continuous_monitoring
|
|
- automated_remediation
|
|
- scheduled_operations
|
|
|
|
### test_suites
|
|
**Test Suites**: layer0_validation, mcp_integration, cloudflare_safe_ingress
|
|
|
|
**Capabilities**:
|
|
- security_classification_testing
|
|
- mcp_server_validation
|
|
- api_integration_testing
|
|
|