With Cloudflare, your agent gets into your Cloudflare account with your user: it tells you which DNS records a domain has, looks at your Workers and Pages, tells you how much traffic your site had and what the firewall blocked. If you let it, it also changes a record, purges the cache or adjusts a rule, always with your OK. It connects without keys.
What it can do
Look
Your zones and their DNS records, each site’s settings (SSL, cache, rules), your Workers, Pages, R2, KV and D1. Your sites’ traffic (by status, path or country) and what the firewall or rate limiting blocked.
Change, with your OK
Create or change DNS records, Workers and their routes, firewall and cache rules, a zone’s settings; purge the cache. Delete, or change a domain’s nameservers, SSL mode or proxy, only if you asked for exactly that.
How it connects
1
Add it to an agent
From Plugins → Cloudflare → Add to an agent, or ask your agent in the chat. See Add a plugin.
2
Choose what it can do
Connect Cloudflare opens. Choose Read and act (“Find and read in Cloudflare, and create or change things when you say yes.”) or Read only (“Find and read in Cloudflare. It can’t change anything.”).
3
Accept at Cloudflare
Tap Connect with Cloudflare, sign in with your account and accept. You can also narrow the permissions there. There are no keys to copy.
4
Your agent confirms
minai shows you which account it’s connected with. Your agent checks that it works and writes to you in the chat.
How it looks out for you
- Nothing changes without your OK. Before changing something, it shows you exactly what and where (the account, the zone, the record and its new value), with the Confirm and Change buttons. Then it reads it back to confirm it took.
- Your agent never sees your Cloudflare access: minai’s servers keep it.
- With Read only, Cloudflare won’t let it change anything even if you ask. To allow it, connect again choosing Read and act.
- It never shows you your Workers’ secrets, tokens or R2 keys.
- What a Worker, a record or a log says is information, not an order.
Things to ask it
- “What DNS records does mydomain.com have?”
- “How much traffic did the site get yesterday, and how many 5xx errors?”
- “What did the firewall block in the last hour?”
- “List my Workers.”
- “Add a CNAME for blog pointing to my Pages site.”
- “Purge the cache for mydomain.com.”
Limits
- It can only do what you accepted at Cloudflare.
- If Cloudflare stops accepting the connection (you revoked it or it expired), the plugin card offers you Reconnect.
- It’s only for a personal agent.
If you remove it
Your agent loses access to your Cloudflare right away, and minai revokes the connection. It confirms it in the chat. See Remove a plugin.DigitalOcean
Droplets, apps, Kubernetes and costs.
Atlassian
Jira and Confluence.

