Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.
SkillScore73Maintained
Automatic
◆Security & AppSec pack
Last verified 8/16/2026
What it changes
Passed 15 of 21 test cases with the skill, and 7 of 21 without it.
Without skill32%
With skill73%
Checks it passed that the model alone missed
Selects get_threat_score to check IP risk values.
Uses list_firewall_rules to list active firewall rules.
Selects get_firewall_events to fetch request execution logs.
and 6 more in the full report
9 fixed7 passed either way6 still failing0 broke
Pass-rate lift
+41 pp
Tokens
-41%
Agent turns
0%
Response time
-61%
Model gemini-3.6-flashMeasured 8/16/2026v116 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 9
Prompt
Which Model Context Protocol server service handles firewall log streaming and security observability requests in this environment?
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies cloudflare-observability as the MCP server for firewall events.
Missed
Passed
case-09 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md38 linessingle file
Cloudflare Security Skill
Monitor Cloudflare WAF, firewall events, audit logs, and threat intelligence.
Tools
Tool
Description
list_firewall_rules
List WAF and firewall rules
get_firewall_events
Get firewall event logs
list_audit_logs
List account audit log entries
get_audit_log
Get details for an audit log entry
list_security_events
List security events and threats
get_threat_score
Get threat score for an IP address
Example Queries
List all firewall rules for example.com
Show firewall events from the last 24 hours
Show Cloudflare audit logs for today
What is the threat score for IP 1.2.3.4?
Prerequisites
CLOUDFLARE_API_TOKEN with Firewall:Read, Audit Logs:Read scopes
CLOUDFLARE_ACCOUNT_ID from dashboard
Servers
This skill uses:
cloudflare-observability at observability.mcp.cloudflare.com
cloudflare-audit-logs at audit-logs.mcp.cloudflare.com
cloudflare-radar at radar.mcp.cloudflare.com (for threat intel)
CML node operations — start, stop, console access, CLI execution, config management, node details. Use when starting or stopping a CML node, running show commands on a lab router, setting startup configs, or reading console logs.