[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cloudflare-cloudflare-one-migrations":3,"mdc-nw6jp6-key":43,"related-org-cloudflare-cloudflare-one-migrations":798,"related-repo-cloudflare-cloudflare-one-migrations":981},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":38,"sourceUrl":41,"mdContent":42},"cloudflare-one-migrations","plan migrations to Cloudflare One","Plans migrations from Zscaler ZIA\u002FZPA, Palo Alto, legacy VPN, SWG, or SASE stacks to Cloudflare One. Use for migration assessments, policy mapping, rollout plans, and parity\u002Fgap analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cloudflare","Cloudflare","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcloudflare.jpg",[12,16,19,20,23,26],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Networking","networking",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Migration","migration",{"name":24,"slug":25,"type":15},"Strategy","strategy",{"name":27,"slug":28,"type":15},"Risk Assessment","risk-assessment",2112,"https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fskills","2026-06-15T09:51:35.348691",null,192,[35,8,36,37],"agents","skills","workers",{"repoUrl":30,"stars":29,"forks":33,"topics":39,"description":40},[35,8,36,37],"Skills for teaching agents how to build on Cloudflare.","https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fcloudflare-one-migrations","---\nname: cloudflare-one-migrations\ndescription: Plans migrations from Zscaler ZIA\u002FZPA, Palo Alto, legacy VPN, SWG, or SASE stacks to Cloudflare One. Use for migration assessments, policy mapping, rollout plans, and parity\u002Fgap analysis.\n---\n\n# Cloudflare One Migrations\n\nRetrieve current Cloudflare docs, Cloudflare API schemas, and source-vendor export docs before generating exact configuration.\n\n## Workflow\n\n1. Identify the source stack: Zscaler ZIA, Zscaler ZPA, Palo Alto NGFW\u002FPrisma\u002FGlobalProtect, legacy VPN\u002FSWG\u002FSD-WAN, or other.\n2. Request exports and logs before mapping. Prefer structured exports over screenshots or prose summaries.\n3. Build an inventory: identities, groups, apps, destinations, connectors\u002Ftunnels, DNS\u002FURL\u002Ffirewall\u002FDLP\u002FTLS policies, objects\u002Flists, locations\u002Fsites, exceptions, hit counts, and compliance logging.\n4. Produce a mapping plan: source object, Cloudflare One target resource, confidence, prerequisites, unsupported\u002Fpartial mappings, and manual decisions.\n5. Create dependencies first: identity\u002F[SCIM](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fteam-and-resources\u002Fusers\u002Fscim\u002F), connectors\u002Fon-ramps, routes\u002FDNS, lists\u002Fobjects, TLS bypasses, Access apps\u002Fpolicies, Gateway policies, DLP\u002FCASB, logging.\n6. Stage safely: use a migration prefix, create disabled\u002Faudit-mode rules by default, pilot with small groups\u002Fsites, compare logs, then expand rollout.\n7. Account for every source rule. Each rule must map to a Cloudflare object or an explicit Not Migrated row with reason and security impact.\n\n## Exports To Ask For\n\n- ZIA: URL filtering, firewall filtering, SSL inspection, DLP, custom URL categories, IP groups, network services\u002Fservice groups, users\u002Fgroups\u002Fdepartments, locations, GRE tunnels, and static IPs.\n- ZPA: app segments, segment groups, server groups, app connectors\u002Fconnector groups, access policies, IdP\u002Fgroup mapping, private DNS domains, ports, and protocols.\n- Palo Alto\u002FPrisma: security\u002FNAT\u002Fdecryption rules, address\u002Fservice objects and groups, URL categories, HIP profiles, GlobalProtect config, Prisma Access remote network\u002Fservice connection config, zones, tags, logs, and hit counts.\n\n## Mapping Heuristics\n\n- ZIA\u002FSWG policies usually map to [Gateway traffic policies](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002F) and Gateway lists.\n- ZPA private app access usually maps to [Access application types](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Faccess-controls\u002Fapplications\u002Fchoose-application-type\u002F), [Cloudflare Tunnel](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fnetworks\u002Fconnectors\u002Fcloudflare-tunnel\u002F), private network routing\u002FDNS, and [Access policies](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Faccess-controls\u002Fpolicies\u002F).\n- Palo Alto rules map only after understanding traffic direction, zones, objects, users, apps, decryption, and hit counts. Do not flatten zones blindly into lists.\n- Legacy VPN replacement is usually Access + Cloudflare One Client \u002F WARP + Tunnel or Mesh for app access. Use [Cloudflare WAN](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-wan\u002F) only when site-to-site traffic is required; use the [Network VPN migration design guide](https:\u002F\u002Fdevelopers.cloudflare.com\u002Freference-architecture\u002Fdesign-guides\u002Fnetwork-vpn-migration\u002F) and [Replace your VPN](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fsetup\u002Freplace-vpn\u002F) docs for current patterns.\n\n## Migration Assessment Prompts\n\n- Source coverage: which products are in scope, which exports are available, and whether screenshots\u002Fprose summaries are hiding missing object files.\n- Rule volume and hit data: counts by rule type, disabled\u002Fstale rules, no-hit rules, high-hit rules, and business-critical exceptions.\n- Object dependencies: address objects, service objects, groups, custom categories, network services, app IDs, zones, tags, connectors, and server groups.\n- Identity readiness: IdP, SCIM\u002Fgroup sync, group-name normalization, individual-user rules, local groups, service accounts, and contractor identities.\n- TLS\u002FDLP readiness: source decryption rules, certificate-pinned bypasses, [DLP](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fdata-loss-prevention\u002F) engines\u002Fprofiles, custom regex, exact-match data, and payload logging expectations.\n- Connectivity readiness: source tunnels\u002Fconnectors, private DNS, [Split Tunnels](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fteam-and-resources\u002Fdevices\u002Fcloudflare-one-client\u002Fconfigure\u002Froute-traffic\u002Fsplit-tunnels\u002F) or bypass behavior, source IP preservation, [egress IP](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fegress-policies\u002F) allowlists, and site-to-site requirements.\n- Rollout readiness: pilot groups\u002Fsites, parallel-run period, rollback owner, source-stack decommission criteria, and monitoring\u002Flog comparison plan.\n\n## Source-Specific Traps\n\n### Zscaler ZIA \u002F SWG\n\n- Custom URL categories often split into separate IP, domain, and URL lists. Count the generated lists, not just source categories.\n- ZIA locations with IPs are useful as source IP lists; they are not automatically [Gateway DNS locations](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fnetworks\u002Fresolvers-and-proxies\u002Fdns\u002Flocations\u002F) for DNS policy scoping.\n- GRE tunnel source IPs can inform policy conditions, but the transport migration is a separate WARP Connector or Cloudflare WAN workstream.\n- CAUTION\u002Fwarn behavior has no exact Gateway equivalent. Treat it as an explicit customer decision, not a silent allow\u002Fblock choice.\n- DLP engines and custom regex usually require manual Cloudflare DLP profile recreation. Placeholder policies must not be enabled as if DLP is complete.\n- Network application groups and unsupported protocols are partial mappings. Review them before enablement.\n- If SCIM is unavailable, identity-scoped source rules become overly broad unless you add an enforceable alternative such as user\u002Femail lists. Check [Gateway identity selectors](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fidentity-selectors\u002F) before creating those rules.\n\n### Zscaler ZPA \u002F Private Access\n\n- ZPA app segments, server groups, and connector groups do not map 1:1. Cloudflare separates Access apps, tunnel routes, DNS, and policies.\n- Creating tunnels through the API does not complete connector deployment. Plan cloudflared installation, authentication, and origin reachability separately.\n- Create one Cloudflare Tunnel per ZPA connector group regardless of connector runtime status (AUTHENTICATED, DISCONNECTED, or disabled). Status is operational, not architectural. Tag disconnected or legacy groups in the tunnel description and let the customer decide what to decommission after validation.\n- Each ZPA connector instance within a group maps to one cloudflared replica running against that tunnel's token. Match replica count to connector instance count per group to preserve the same topology. A single tunnel token supports multiple simultaneous cloudflared processes. Recommend installing replicas within the same data center but on different hosts or subnets.\n- For each connector group, identify all server groups linked to it and all app segments assigned to those server groups. IP addresses and CIDRs in those app segments become CIDR routes on the corresponding tunnel; domain names become hostname routes on the same tunnel. Prefer one CIDR route per subnet over per-host \u002F32 routes where a broad subnet covers all app segment IPs.\n- ZPA bypass means split-tunnel bypass in Cloudflare, not an Access `bypass` decision. Bypass rules map to WARP [Split Tunnel](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fteam-and-resources\u002Fdevices\u002Fcloudflare-one-client\u002Fconfigure\u002Froute-traffic\u002Fsplit-tunnels\u002F) exclude entries. This is a manual configuration step with no API automation - the customer must add bypassed domains and IPs to the device profile split tunnel exclude list through the dashboard.\n- Agentless\u002Fbrowser apps may become separate public-hostname Access apps per domain. WARP private apps remain private-destination apps.\n- The default Cloudflare Access application destination limit is 5 hostnames per app. For ZPA migrations with large app segments, contact the Cloudflare account team to request an increase (up to 50) before implementation. Confirm the limit is active on the account before creating apps - without it, large segments must be split into multiple apps with identical policies, significantly increasing object count.\n- IP-anchored apps require an explicit egress decision before migration: preserve source IP through customer egress, use Cloudflare [dedicated egress](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fegress-policies\u002F) where available, or accept that the target service must be updated to allow new source IPs. This is a customer decision that blocks implementation if unresolved.\n- Resolver policies can be account-wide. Be careful with overlapping private DNS namespaces across sites or virtual networks; retrieve [resolver policy](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fresolver-policies\u002F) docs before making DNS changes.\n- Each ZPA access policy rule maps to a Cloudflare reusable Access policy. Create all reusable policies before attaching them to Access apps. In default-deny Gateway Network environments, additionally create a Network allow rule with selector \"Self-hosted Access App with Private Address is Present\" (wirefilter: `any(access.private_app[*] in {\"*\"})`) at higher precedence than any broad L4 block rules - without it, Gateway blocks private app traffic before Access policy evaluation occurs.\n- In combined ZIA and ZPA migrations, Gateway Network rules can accidentally block Access private-app traffic. The Gateway Network allow rule above is the fix - place it at higher precedence (lower number) than ZIA-migrated block rules. Add and validate this rule before enabling broad L4 blocks.\n\n### Palo Alto \u002F Prisma \u002F NGFW\n\n- One Palo Alto rule can produce multiple Cloudflare resources. Preserve rule intent, not rule count.\n- App-ID, URL category, zone, HIP, schedule, and decryption behavior rarely translate exactly. Mark partial mappings rather than forcing false equivalence.\n- Export address\u002Fservice objects and groups with rules. Missing object exports cause silent-looking drops unless explicitly detected.\n- Broad `any` destination\u002Fservice rules and very broad CIDRs require manual review. Do not auto-create broad catchalls.\n- HIP\u002Fdevice checks require Cloudflare [device posture](https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Freusable-components\u002Fposture-checks\u002F) integrations before enforcement.\n\n## Gotchas\n\n- Source exports often split references across files. Resolve IDs against object, service, and group files before declaring a rule unmappable.\n- Individual users, local groups, departments, and dynamic application IDs often need identity normalization. SCIM\u002Fgroup sync is the gating prerequisite for group selectors.\n- Zscaler caution\u002Fwarn behavior, Palo Alto App-ID behavior, and TLS\u002Fdecryption exceptions may not have exact equivalents. Flag them as decision points instead of forcing a 1:1 mapping.\n- Preserve source rule order and hit counts where available. Disable or delete stale\u002Fno-hit rules only with user approval.\n- Never create broad allow-all catchalls to preserve connectivity unless explicitly requested and time-limited.\n\n## Validation Gates\n\n- After each migration stage, compare Cloudflare object counts against parsed source counts. Stop on mismatches.\n- Review every `unsupported`, `partial`, `unmapped`, `needs_identity`, `needs_posture`, and `manual_review` item before enabling policies.\n- Validate group matching with real pilot users after SCIM sync and re-authentication.\n- Test TLS inspection and Do Not Inspect behavior before enabling HTTP\u002FDLP blocks broadly.\n- Keep rollback paths explicit: disable migrated rules by prefix, restore source routing, or revert the pilot group\u002Fsite.\n- Before declaring done, produce a source-rule accounting table: migrated object, partial mapping, not migrated reason, security impact, and owner for each manual action.\n\n## Assessment Template\n\n```markdown\n## Migration Assessment\n\nSource stack:\nArtifacts reviewed:\nAssumptions \u002F missing exports:\nRecommended Cloudflare One target:\nMapping summary:\nRisks \u002F partial mappings:\nNot migrated:\nPilot plan:\nValidation:\nRollback:\n```\n",{"data":44,"body":45},{"name":4,"description":6},{"type":46,"children":47},"root",[48,56,62,69,120,126,145,151,237,243,308,314,321,377,383,488,494,539,545,573,579,656,662,792],{"type":49,"tag":50,"props":51,"children":52},"element","h1",{"id":4},[53],{"type":54,"value":55},"text","Cloudflare One Migrations",{"type":49,"tag":57,"props":58,"children":59},"p",{},[60],{"type":54,"value":61},"Retrieve current Cloudflare docs, Cloudflare API schemas, and source-vendor export docs before generating exact configuration.",{"type":49,"tag":63,"props":64,"children":66},"h2",{"id":65},"workflow",[67],{"type":54,"value":68},"Workflow",{"type":49,"tag":70,"props":71,"children":72},"ol",{},[73,79,84,89,94,110,115],{"type":49,"tag":74,"props":75,"children":76},"li",{},[77],{"type":54,"value":78},"Identify the source stack: Zscaler ZIA, Zscaler ZPA, Palo Alto NGFW\u002FPrisma\u002FGlobalProtect, legacy VPN\u002FSWG\u002FSD-WAN, or other.",{"type":49,"tag":74,"props":80,"children":81},{},[82],{"type":54,"value":83},"Request exports and logs before mapping. Prefer structured exports over screenshots or prose summaries.",{"type":49,"tag":74,"props":85,"children":86},{},[87],{"type":54,"value":88},"Build an inventory: identities, groups, apps, destinations, connectors\u002Ftunnels, DNS\u002FURL\u002Ffirewall\u002FDLP\u002FTLS policies, objects\u002Flists, locations\u002Fsites, exceptions, hit counts, and compliance logging.",{"type":49,"tag":74,"props":90,"children":91},{},[92],{"type":54,"value":93},"Produce a mapping plan: source object, Cloudflare One target resource, confidence, prerequisites, unsupported\u002Fpartial mappings, and manual decisions.",{"type":49,"tag":74,"props":95,"children":96},{},[97,99,108],{"type":54,"value":98},"Create dependencies first: identity\u002F",{"type":49,"tag":100,"props":101,"children":105},"a",{"href":102,"rel":103},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fteam-and-resources\u002Fusers\u002Fscim\u002F",[104],"nofollow",[106],{"type":54,"value":107},"SCIM",{"type":54,"value":109},", connectors\u002Fon-ramps, routes\u002FDNS, lists\u002Fobjects, TLS bypasses, Access apps\u002Fpolicies, Gateway policies, DLP\u002FCASB, logging.",{"type":49,"tag":74,"props":111,"children":112},{},[113],{"type":54,"value":114},"Stage safely: use a migration prefix, create disabled\u002Faudit-mode rules by default, pilot with small groups\u002Fsites, compare logs, then expand rollout.",{"type":49,"tag":74,"props":116,"children":117},{},[118],{"type":54,"value":119},"Account for every source rule. Each rule must map to a Cloudflare object or an explicit Not Migrated row with reason and security impact.",{"type":49,"tag":63,"props":121,"children":123},{"id":122},"exports-to-ask-for",[124],{"type":54,"value":125},"Exports To Ask For",{"type":49,"tag":127,"props":128,"children":129},"ul",{},[130,135,140],{"type":49,"tag":74,"props":131,"children":132},{},[133],{"type":54,"value":134},"ZIA: URL filtering, firewall filtering, SSL inspection, DLP, custom URL categories, IP groups, network services\u002Fservice groups, users\u002Fgroups\u002Fdepartments, locations, GRE tunnels, and static IPs.",{"type":49,"tag":74,"props":136,"children":137},{},[138],{"type":54,"value":139},"ZPA: app segments, segment groups, server groups, app connectors\u002Fconnector groups, access policies, IdP\u002Fgroup mapping, private DNS domains, ports, and protocols.",{"type":49,"tag":74,"props":141,"children":142},{},[143],{"type":54,"value":144},"Palo Alto\u002FPrisma: security\u002FNAT\u002Fdecryption rules, address\u002Fservice objects and groups, URL categories, HIP profiles, GlobalProtect config, Prisma Access remote network\u002Fservice connection config, zones, tags, logs, and hit counts.",{"type":49,"tag":63,"props":146,"children":148},{"id":147},"mapping-heuristics",[149],{"type":54,"value":150},"Mapping Heuristics",{"type":49,"tag":127,"props":152,"children":153},{},[154,168,200,205],{"type":49,"tag":74,"props":155,"children":156},{},[157,159,166],{"type":54,"value":158},"ZIA\u002FSWG policies usually map to ",{"type":49,"tag":100,"props":160,"children":163},{"href":161,"rel":162},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002F",[104],[164],{"type":54,"value":165},"Gateway traffic policies",{"type":54,"value":167}," and Gateway lists.",{"type":49,"tag":74,"props":169,"children":170},{},[171,173,180,182,189,191,198],{"type":54,"value":172},"ZPA private app access usually maps to ",{"type":49,"tag":100,"props":174,"children":177},{"href":175,"rel":176},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Faccess-controls\u002Fapplications\u002Fchoose-application-type\u002F",[104],[178],{"type":54,"value":179},"Access application types",{"type":54,"value":181},", ",{"type":49,"tag":100,"props":183,"children":186},{"href":184,"rel":185},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fnetworks\u002Fconnectors\u002Fcloudflare-tunnel\u002F",[104],[187],{"type":54,"value":188},"Cloudflare Tunnel",{"type":54,"value":190},", private network routing\u002FDNS, and ",{"type":49,"tag":100,"props":192,"children":195},{"href":193,"rel":194},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Faccess-controls\u002Fpolicies\u002F",[104],[196],{"type":54,"value":197},"Access policies",{"type":54,"value":199},".",{"type":49,"tag":74,"props":201,"children":202},{},[203],{"type":54,"value":204},"Palo Alto rules map only after understanding traffic direction, zones, objects, users, apps, decryption, and hit counts. Do not flatten zones blindly into lists.",{"type":49,"tag":74,"props":206,"children":207},{},[208,210,217,219,226,228,235],{"type":54,"value":209},"Legacy VPN replacement is usually Access + Cloudflare One Client \u002F WARP + Tunnel or Mesh for app access. Use ",{"type":49,"tag":100,"props":211,"children":214},{"href":212,"rel":213},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-wan\u002F",[104],[215],{"type":54,"value":216},"Cloudflare WAN",{"type":54,"value":218}," only when site-to-site traffic is required; use the ",{"type":49,"tag":100,"props":220,"children":223},{"href":221,"rel":222},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Freference-architecture\u002Fdesign-guides\u002Fnetwork-vpn-migration\u002F",[104],[224],{"type":54,"value":225},"Network VPN migration design guide",{"type":54,"value":227}," and ",{"type":49,"tag":100,"props":229,"children":232},{"href":230,"rel":231},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fsetup\u002Freplace-vpn\u002F",[104],[233],{"type":54,"value":234},"Replace your VPN",{"type":54,"value":236}," docs for current patterns.",{"type":49,"tag":63,"props":238,"children":240},{"id":239},"migration-assessment-prompts",[241],{"type":54,"value":242},"Migration Assessment Prompts",{"type":49,"tag":127,"props":244,"children":245},{},[246,251,256,261,266,280,303],{"type":49,"tag":74,"props":247,"children":248},{},[249],{"type":54,"value":250},"Source coverage: which products are in scope, which exports are available, and whether screenshots\u002Fprose summaries are hiding missing object files.",{"type":49,"tag":74,"props":252,"children":253},{},[254],{"type":54,"value":255},"Rule volume and hit data: counts by rule type, disabled\u002Fstale rules, no-hit rules, high-hit rules, and business-critical exceptions.",{"type":49,"tag":74,"props":257,"children":258},{},[259],{"type":54,"value":260},"Object dependencies: address objects, service objects, groups, custom categories, network services, app IDs, zones, tags, connectors, and server groups.",{"type":49,"tag":74,"props":262,"children":263},{},[264],{"type":54,"value":265},"Identity readiness: IdP, SCIM\u002Fgroup sync, group-name normalization, individual-user rules, local groups, service accounts, and contractor identities.",{"type":49,"tag":74,"props":267,"children":268},{},[269,271,278],{"type":54,"value":270},"TLS\u002FDLP readiness: source decryption rules, certificate-pinned bypasses, ",{"type":49,"tag":100,"props":272,"children":275},{"href":273,"rel":274},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fdata-loss-prevention\u002F",[104],[276],{"type":54,"value":277},"DLP",{"type":54,"value":279}," engines\u002Fprofiles, custom regex, exact-match data, and payload logging expectations.",{"type":49,"tag":74,"props":281,"children":282},{},[283,285,292,294,301],{"type":54,"value":284},"Connectivity readiness: source tunnels\u002Fconnectors, private DNS, ",{"type":49,"tag":100,"props":286,"children":289},{"href":287,"rel":288},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fteam-and-resources\u002Fdevices\u002Fcloudflare-one-client\u002Fconfigure\u002Froute-traffic\u002Fsplit-tunnels\u002F",[104],[290],{"type":54,"value":291},"Split Tunnels",{"type":54,"value":293}," or bypass behavior, source IP preservation, ",{"type":49,"tag":100,"props":295,"children":298},{"href":296,"rel":297},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fegress-policies\u002F",[104],[299],{"type":54,"value":300},"egress IP",{"type":54,"value":302}," allowlists, and site-to-site requirements.",{"type":49,"tag":74,"props":304,"children":305},{},[306],{"type":54,"value":307},"Rollout readiness: pilot groups\u002Fsites, parallel-run period, rollback owner, source-stack decommission criteria, and monitoring\u002Flog comparison plan.",{"type":49,"tag":63,"props":309,"children":311},{"id":310},"source-specific-traps",[312],{"type":54,"value":313},"Source-Specific Traps",{"type":49,"tag":315,"props":316,"children":318},"h3",{"id":317},"zscaler-zia-swg",[319],{"type":54,"value":320},"Zscaler ZIA \u002F SWG",{"type":49,"tag":127,"props":322,"children":323},{},[324,329,343,348,353,358,363],{"type":49,"tag":74,"props":325,"children":326},{},[327],{"type":54,"value":328},"Custom URL categories often split into separate IP, domain, and URL lists. Count the generated lists, not just source categories.",{"type":49,"tag":74,"props":330,"children":331},{},[332,334,341],{"type":54,"value":333},"ZIA locations with IPs are useful as source IP lists; they are not automatically ",{"type":49,"tag":100,"props":335,"children":338},{"href":336,"rel":337},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Fnetworks\u002Fresolvers-and-proxies\u002Fdns\u002Flocations\u002F",[104],[339],{"type":54,"value":340},"Gateway DNS locations",{"type":54,"value":342}," for DNS policy scoping.",{"type":49,"tag":74,"props":344,"children":345},{},[346],{"type":54,"value":347},"GRE tunnel source IPs can inform policy conditions, but the transport migration is a separate WARP Connector or Cloudflare WAN workstream.",{"type":49,"tag":74,"props":349,"children":350},{},[351],{"type":54,"value":352},"CAUTION\u002Fwarn behavior has no exact Gateway equivalent. Treat it as an explicit customer decision, not a silent allow\u002Fblock choice.",{"type":49,"tag":74,"props":354,"children":355},{},[356],{"type":54,"value":357},"DLP engines and custom regex usually require manual Cloudflare DLP profile recreation. Placeholder policies must not be enabled as if DLP is complete.",{"type":49,"tag":74,"props":359,"children":360},{},[361],{"type":54,"value":362},"Network application groups and unsupported protocols are partial mappings. Review them before enablement.",{"type":49,"tag":74,"props":364,"children":365},{},[366,368,375],{"type":54,"value":367},"If SCIM is unavailable, identity-scoped source rules become overly broad unless you add an enforceable alternative such as user\u002Femail lists. Check ",{"type":49,"tag":100,"props":369,"children":372},{"href":370,"rel":371},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fidentity-selectors\u002F",[104],[373],{"type":54,"value":374},"Gateway identity selectors",{"type":54,"value":376}," before creating those rules.",{"type":49,"tag":315,"props":378,"children":380},{"id":379},"zscaler-zpa-private-access",[381],{"type":54,"value":382},"Zscaler ZPA \u002F Private Access",{"type":49,"tag":127,"props":384,"children":385},{},[386,391,396,401,406,411,433,438,443,456,470,483],{"type":49,"tag":74,"props":387,"children":388},{},[389],{"type":54,"value":390},"ZPA app segments, server groups, and connector groups do not map 1:1. Cloudflare separates Access apps, tunnel routes, DNS, and policies.",{"type":49,"tag":74,"props":392,"children":393},{},[394],{"type":54,"value":395},"Creating tunnels through the API does not complete connector deployment. Plan cloudflared installation, authentication, and origin reachability separately.",{"type":49,"tag":74,"props":397,"children":398},{},[399],{"type":54,"value":400},"Create one Cloudflare Tunnel per ZPA connector group regardless of connector runtime status (AUTHENTICATED, DISCONNECTED, or disabled). Status is operational, not architectural. Tag disconnected or legacy groups in the tunnel description and let the customer decide what to decommission after validation.",{"type":49,"tag":74,"props":402,"children":403},{},[404],{"type":54,"value":405},"Each ZPA connector instance within a group maps to one cloudflared replica running against that tunnel's token. Match replica count to connector instance count per group to preserve the same topology. A single tunnel token supports multiple simultaneous cloudflared processes. Recommend installing replicas within the same data center but on different hosts or subnets.",{"type":49,"tag":74,"props":407,"children":408},{},[409],{"type":54,"value":410},"For each connector group, identify all server groups linked to it and all app segments assigned to those server groups. IP addresses and CIDRs in those app segments become CIDR routes on the corresponding tunnel; domain names become hostname routes on the same tunnel. Prefer one CIDR route per subnet over per-host \u002F32 routes where a broad subnet covers all app segment IPs.",{"type":49,"tag":74,"props":412,"children":413},{},[414,416,423,425,431],{"type":54,"value":415},"ZPA bypass means split-tunnel bypass in Cloudflare, not an Access ",{"type":49,"tag":417,"props":418,"children":420},"code",{"className":419},[],[421],{"type":54,"value":422},"bypass",{"type":54,"value":424}," decision. Bypass rules map to WARP ",{"type":49,"tag":100,"props":426,"children":428},{"href":287,"rel":427},[104],[429],{"type":54,"value":430},"Split Tunnel",{"type":54,"value":432}," exclude entries. This is a manual configuration step with no API automation - the customer must add bypassed domains and IPs to the device profile split tunnel exclude list through the dashboard.",{"type":49,"tag":74,"props":434,"children":435},{},[436],{"type":54,"value":437},"Agentless\u002Fbrowser apps may become separate public-hostname Access apps per domain. WARP private apps remain private-destination apps.",{"type":49,"tag":74,"props":439,"children":440},{},[441],{"type":54,"value":442},"The default Cloudflare Access application destination limit is 5 hostnames per app. For ZPA migrations with large app segments, contact the Cloudflare account team to request an increase (up to 50) before implementation. Confirm the limit is active on the account before creating apps - without it, large segments must be split into multiple apps with identical policies, significantly increasing object count.",{"type":49,"tag":74,"props":444,"children":445},{},[446,448,454],{"type":54,"value":447},"IP-anchored apps require an explicit egress decision before migration: preserve source IP through customer egress, use Cloudflare ",{"type":49,"tag":100,"props":449,"children":451},{"href":296,"rel":450},[104],[452],{"type":54,"value":453},"dedicated egress",{"type":54,"value":455}," where available, or accept that the target service must be updated to allow new source IPs. This is a customer decision that blocks implementation if unresolved.",{"type":49,"tag":74,"props":457,"children":458},{},[459,461,468],{"type":54,"value":460},"Resolver policies can be account-wide. Be careful with overlapping private DNS namespaces across sites or virtual networks; retrieve ",{"type":49,"tag":100,"props":462,"children":465},{"href":463,"rel":464},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Ftraffic-policies\u002Fresolver-policies\u002F",[104],[466],{"type":54,"value":467},"resolver policy",{"type":54,"value":469}," docs before making DNS changes.",{"type":49,"tag":74,"props":471,"children":472},{},[473,475,481],{"type":54,"value":474},"Each ZPA access policy rule maps to a Cloudflare reusable Access policy. Create all reusable policies before attaching them to Access apps. In default-deny Gateway Network environments, additionally create a Network allow rule with selector \"Self-hosted Access App with Private Address is Present\" (wirefilter: ",{"type":49,"tag":417,"props":476,"children":478},{"className":477},[],[479],{"type":54,"value":480},"any(access.private_app[*] in {\"*\"})",{"type":54,"value":482},") at higher precedence than any broad L4 block rules - without it, Gateway blocks private app traffic before Access policy evaluation occurs.",{"type":49,"tag":74,"props":484,"children":485},{},[486],{"type":54,"value":487},"In combined ZIA and ZPA migrations, Gateway Network rules can accidentally block Access private-app traffic. The Gateway Network allow rule above is the fix - place it at higher precedence (lower number) than ZIA-migrated block rules. Add and validate this rule before enabling broad L4 blocks.",{"type":49,"tag":315,"props":489,"children":491},{"id":490},"palo-alto-prisma-ngfw",[492],{"type":54,"value":493},"Palo Alto \u002F Prisma \u002F NGFW",{"type":49,"tag":127,"props":495,"children":496},{},[497,502,507,512,525],{"type":49,"tag":74,"props":498,"children":499},{},[500],{"type":54,"value":501},"One Palo Alto rule can produce multiple Cloudflare resources. Preserve rule intent, not rule count.",{"type":49,"tag":74,"props":503,"children":504},{},[505],{"type":54,"value":506},"App-ID, URL category, zone, HIP, schedule, and decryption behavior rarely translate exactly. Mark partial mappings rather than forcing false equivalence.",{"type":49,"tag":74,"props":508,"children":509},{},[510],{"type":54,"value":511},"Export address\u002Fservice objects and groups with rules. Missing object exports cause silent-looking drops unless explicitly detected.",{"type":49,"tag":74,"props":513,"children":514},{},[515,517,523],{"type":54,"value":516},"Broad ",{"type":49,"tag":417,"props":518,"children":520},{"className":519},[],[521],{"type":54,"value":522},"any",{"type":54,"value":524}," destination\u002Fservice rules and very broad CIDRs require manual review. Do not auto-create broad catchalls.",{"type":49,"tag":74,"props":526,"children":527},{},[528,530,537],{"type":54,"value":529},"HIP\u002Fdevice checks require Cloudflare ",{"type":49,"tag":100,"props":531,"children":534},{"href":532,"rel":533},"https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-one\u002Freusable-components\u002Fposture-checks\u002F",[104],[535],{"type":54,"value":536},"device posture",{"type":54,"value":538}," integrations before enforcement.",{"type":49,"tag":63,"props":540,"children":542},{"id":541},"gotchas",[543],{"type":54,"value":544},"Gotchas",{"type":49,"tag":127,"props":546,"children":547},{},[548,553,558,563,568],{"type":49,"tag":74,"props":549,"children":550},{},[551],{"type":54,"value":552},"Source exports often split references across files. Resolve IDs against object, service, and group files before declaring a rule unmappable.",{"type":49,"tag":74,"props":554,"children":555},{},[556],{"type":54,"value":557},"Individual users, local groups, departments, and dynamic application IDs often need identity normalization. SCIM\u002Fgroup sync is the gating prerequisite for group selectors.",{"type":49,"tag":74,"props":559,"children":560},{},[561],{"type":54,"value":562},"Zscaler caution\u002Fwarn behavior, Palo Alto App-ID behavior, and TLS\u002Fdecryption exceptions may not have exact equivalents. Flag them as decision points instead of forcing a 1:1 mapping.",{"type":49,"tag":74,"props":564,"children":565},{},[566],{"type":54,"value":567},"Preserve source rule order and hit counts where available. Disable or delete stale\u002Fno-hit rules only with user approval.",{"type":49,"tag":74,"props":569,"children":570},{},[571],{"type":54,"value":572},"Never create broad allow-all catchalls to preserve connectivity unless explicitly requested and time-limited.",{"type":49,"tag":63,"props":574,"children":576},{"id":575},"validation-gates",[577],{"type":54,"value":578},"Validation Gates",{"type":49,"tag":127,"props":580,"children":581},{},[582,587,636,641,646,651],{"type":49,"tag":74,"props":583,"children":584},{},[585],{"type":54,"value":586},"After each migration stage, compare Cloudflare object counts against parsed source counts. Stop on mismatches.",{"type":49,"tag":74,"props":588,"children":589},{},[590,592,598,599,605,606,612,613,619,620,626,628,634],{"type":54,"value":591},"Review every ",{"type":49,"tag":417,"props":593,"children":595},{"className":594},[],[596],{"type":54,"value":597},"unsupported",{"type":54,"value":181},{"type":49,"tag":417,"props":600,"children":602},{"className":601},[],[603],{"type":54,"value":604},"partial",{"type":54,"value":181},{"type":49,"tag":417,"props":607,"children":609},{"className":608},[],[610],{"type":54,"value":611},"unmapped",{"type":54,"value":181},{"type":49,"tag":417,"props":614,"children":616},{"className":615},[],[617],{"type":54,"value":618},"needs_identity",{"type":54,"value":181},{"type":49,"tag":417,"props":621,"children":623},{"className":622},[],[624],{"type":54,"value":625},"needs_posture",{"type":54,"value":627},", and ",{"type":49,"tag":417,"props":629,"children":631},{"className":630},[],[632],{"type":54,"value":633},"manual_review",{"type":54,"value":635}," item before enabling policies.",{"type":49,"tag":74,"props":637,"children":638},{},[639],{"type":54,"value":640},"Validate group matching with real pilot users after SCIM sync and re-authentication.",{"type":49,"tag":74,"props":642,"children":643},{},[644],{"type":54,"value":645},"Test TLS inspection and Do Not Inspect behavior before enabling HTTP\u002FDLP blocks broadly.",{"type":49,"tag":74,"props":647,"children":648},{},[649],{"type":54,"value":650},"Keep rollback paths explicit: disable migrated rules by prefix, restore source routing, or revert the pilot group\u002Fsite.",{"type":49,"tag":74,"props":652,"children":653},{},[654],{"type":54,"value":655},"Before declaring done, produce a source-rule accounting table: migrated object, partial mapping, not migrated reason, security impact, and owner for each manual action.",{"type":49,"tag":63,"props":657,"children":659},{"id":658},"assessment-template",[660],{"type":54,"value":661},"Assessment Template",{"type":49,"tag":663,"props":664,"children":669},"pre",{"className":665,"code":666,"language":667,"meta":668,"style":668},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## Migration Assessment\n\nSource stack:\nArtifacts reviewed:\nAssumptions \u002F missing exports:\nRecommended Cloudflare One target:\nMapping summary:\nRisks \u002F partial mappings:\nNot migrated:\nPilot plan:\nValidation:\nRollback:\n","markdown","",[670],{"type":49,"tag":417,"props":671,"children":672},{"__ignoreMap":668},[673,691,701,711,720,729,738,747,756,765,774,783],{"type":49,"tag":674,"props":675,"children":678},"span",{"class":676,"line":677},"line",1,[679,685],{"type":49,"tag":674,"props":680,"children":682},{"style":681},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[683],{"type":54,"value":684},"## ",{"type":49,"tag":674,"props":686,"children":688},{"style":687},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[689],{"type":54,"value":690},"Migration Assessment\n",{"type":49,"tag":674,"props":692,"children":694},{"class":676,"line":693},2,[695],{"type":49,"tag":674,"props":696,"children":698},{"emptyLinePlaceholder":697},true,[699],{"type":54,"value":700},"\n",{"type":49,"tag":674,"props":702,"children":704},{"class":676,"line":703},3,[705],{"type":49,"tag":674,"props":706,"children":708},{"style":707},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[709],{"type":54,"value":710},"Source stack:\n",{"type":49,"tag":674,"props":712,"children":714},{"class":676,"line":713},4,[715],{"type":49,"tag":674,"props":716,"children":717},{"style":707},[718],{"type":54,"value":719},"Artifacts reviewed:\n",{"type":49,"tag":674,"props":721,"children":723},{"class":676,"line":722},5,[724],{"type":49,"tag":674,"props":725,"children":726},{"style":707},[727],{"type":54,"value":728},"Assumptions \u002F missing exports:\n",{"type":49,"tag":674,"props":730,"children":732},{"class":676,"line":731},6,[733],{"type":49,"tag":674,"props":734,"children":735},{"style":707},[736],{"type":54,"value":737},"Recommended Cloudflare One target:\n",{"type":49,"tag":674,"props":739,"children":741},{"class":676,"line":740},7,[742],{"type":49,"tag":674,"props":743,"children":744},{"style":707},[745],{"type":54,"value":746},"Mapping summary:\n",{"type":49,"tag":674,"props":748,"children":750},{"class":676,"line":749},8,[751],{"type":49,"tag":674,"props":752,"children":753},{"style":707},[754],{"type":54,"value":755},"Risks \u002F partial mappings:\n",{"type":49,"tag":674,"props":757,"children":759},{"class":676,"line":758},9,[760],{"type":49,"tag":674,"props":761,"children":762},{"style":707},[763],{"type":54,"value":764},"Not migrated:\n",{"type":49,"tag":674,"props":766,"children":768},{"class":676,"line":767},10,[769],{"type":49,"tag":674,"props":770,"children":771},{"style":707},[772],{"type":54,"value":773},"Pilot plan:\n",{"type":49,"tag":674,"props":775,"children":777},{"class":676,"line":776},11,[778],{"type":49,"tag":674,"props":779,"children":780},{"style":707},[781],{"type":54,"value":782},"Validation:\n",{"type":49,"tag":674,"props":784,"children":786},{"class":676,"line":785},12,[787],{"type":49,"tag":674,"props":788,"children":789},{"style":707},[790],{"type":54,"value":791},"Rollback:\n",{"type":49,"tag":793,"props":794,"children":795},"style",{},[796],{"type":54,"value":797},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":799,"total":980},[800,815,829,844,857,871,885,899,918,935,948,963],{"slug":801,"name":801,"fn":802,"description":803,"org":804,"tags":805,"stars":812,"repoUrl":813,"updatedAt":814},"code-review","review code changes for quality and risk","Review code changes for correctness, clarity, and risk. Use when the user asks for a review, a second opinion on a diff, or feedback on code they wrote.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[806,807,809],{"name":9,"slug":8,"type":15},{"name":808,"slug":801,"type":15},"Code Review",{"name":810,"slug":811,"type":15},"Engineering","engineering",5284,"https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fagents","2026-06-08T08:19:41.621858",{"slug":816,"name":816,"fn":817,"description":818,"org":819,"tags":820,"stars":812,"repoUrl":813,"updatedAt":828},"debug-plan","create systematic debugging plans","Create a systematic debugging plan for a bug report. Use when the user asks how to investigate a failure, regression, or unexpected behavior.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[821,824,827],{"name":822,"slug":823,"type":15},"Code Analysis","code-analysis",{"name":825,"slug":826,"type":15},"Debugging","debugging",{"name":810,"slug":811,"type":15},"2026-05-30T06:16:58.837407",{"slug":830,"name":830,"fn":831,"description":832,"org":833,"tags":834,"stars":812,"repoUrl":813,"updatedAt":843},"escalation","escalate customer issues to human agents","Decide when and how to escalate a customer conversation to a human agent. Use when a request is high-risk, the customer is frustrated, or the issue is outside what you can resolve.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[835,838,841],{"name":836,"slug":837,"type":15},"Communications","communications",{"name":839,"slug":840,"type":15},"Customer Support","customer-support",{"name":842,"slug":830,"type":15},"Escalation","2026-06-08T08:19:43.130686",{"slug":845,"name":845,"fn":846,"description":847,"org":848,"tags":849,"stars":812,"repoUrl":813,"updatedAt":856},"pirate-voice","rewrite text in pirate voice","Rewrite or answer in a playful pirate voice. Use when the user asks for pirate tone, nautical phrasing, or says to talk like a pirate.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[850,853],{"name":851,"slug":852,"type":15},"Creative","creative",{"name":854,"slug":855,"type":15},"Writing","writing","2026-05-30T06:17:00.080367",{"slug":858,"name":858,"fn":859,"description":860,"org":861,"tags":862,"stars":812,"repoUrl":813,"updatedAt":870},"release-notes","draft product release notes","Draft short release notes from a list of changes. Use when the user asks for changelogs, release notes, or a concise product update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[863,866,869],{"name":864,"slug":865,"type":15},"Content Creation","content-creation",{"name":867,"slug":868,"type":15},"Documentation","documentation",{"name":854,"slug":855,"type":15},"2026-05-30T06:17:01.278643",{"slug":872,"name":872,"fn":873,"description":874,"org":875,"tags":876,"stars":812,"repoUrl":813,"updatedAt":884},"test-plan","produce focused test plans","Produce a focused test plan for a change. Use when the user asks how to test a feature, what cases to cover, or for a QA checklist before shipping.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[877,878,881],{"name":810,"slug":811,"type":15},{"name":879,"slug":880,"type":15},"QA","qa",{"name":882,"slug":883,"type":15},"Testing","testing","2026-05-30T06:17:02.479863",{"slug":886,"name":886,"fn":887,"description":888,"org":889,"tags":890,"stars":812,"repoUrl":813,"updatedAt":898},"workspace-digest","summarize files in the shared workspace","Summarize the files saved in this assistant's shared workspace. Use when the user asks what is in their workspace, for a file inventory, or a digest of saved work.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[891,892,895],{"name":867,"slug":868,"type":15},{"name":893,"slug":894,"type":15},"Knowledge Management","knowledge-management",{"name":896,"slug":897,"type":15},"Summarization","summarization","2026-06-07T07:51:27.265303",{"slug":900,"name":900,"fn":901,"description":902,"org":903,"tags":904,"stars":915,"repoUrl":916,"updatedAt":917},"cloudflare-bundler-apps","author Cloudflare Worker Bundler applications","Author Cloudflare Worker Bundler-compatible apps that build and preview correctly inside a space. Use this skill whenever you scaffold, modify, or deploy a project that will be built with `@cloudflare\u002Fworker-bundler` (i.e. anything served from `\u002Fspace\u002F:name\u002Fpreview\u002F:branch\u002F`). Covers wrangler config, project layout, static asset rules, server entry conventions, npm dependency limits, and the most common cause of blank previews (JSX in browser scripts).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[905,906,909,912],{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},"Cloudflare Workers","cloudflare-workers",{"name":910,"slug":911,"type":15},"Deployment","deployment",{"name":913,"slug":914,"type":15},"Web Development","web-development",5145,"https:\u002F\u002Fgithub.com\u002Fcloudflare\u002Fvibesdk","2026-06-16T09:45:57.551207",{"slug":919,"name":919,"fn":920,"description":921,"org":922,"tags":923,"stars":915,"repoUrl":916,"updatedAt":934},"frontend-design","create production-grade frontend interfaces","Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML\u002FCSS layouts, or when styling\u002Fbeautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[924,927,930,933],{"name":925,"slug":926,"type":15},"Design","design",{"name":928,"slug":929,"type":15},"Frontend","frontend",{"name":931,"slug":932,"type":15},"HTML","html",{"name":913,"slug":914,"type":15},"2026-06-16T09:46:01.852741",{"slug":936,"name":936,"fn":937,"description":938,"org":939,"tags":940,"stars":915,"repoUrl":916,"updatedAt":947},"frontend-design-landing-page","build marketing landing pages","Marketing landing page and conversion-focused product page reference. Use this skill when building hero sections, feature grids, pricing pages, testimonials, CTAs, footers, navigation bars, or any public-facing marketing surface. Covers a warm, professional, developer-friendly design language (cream backgrounds, generous whitespace, pill CTAs, corner-bracket card decorations) and a complete token set, animation system, and copy-paste component snippets. NOT for product\u002Fdashboard UIs — use frontend-design-saas for those.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[941,942,943,946],{"name":928,"slug":929,"type":15},{"name":931,"slug":932,"type":15},{"name":944,"slug":945,"type":15},"Marketing","marketing",{"name":913,"slug":914,"type":15},"2026-06-16T09:46:00.515859",{"slug":949,"name":949,"fn":950,"description":951,"org":952,"tags":953,"stars":915,"repoUrl":916,"updatedAt":962},"frontend-design-saas","build SaaS dashboard and product UIs","S-tier SaaS dashboard and product UI reference. Use this skill when building application shells, data tables, settings panels, billing pages, dashboards, auth flows, admin tools, or any internal\u002Fcustomer-facing SaaS product UI. Inspired by Stripe, Linear, Vercel, Airbnb, Notion. Covers neutral-led design tokens, sidebar+content shells, dense data UIs, form-heavy configuration pages, command palettes, empty states, and the accessibility (WCAG AA+) bar these products clear.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[954,955,956,959],{"name":925,"slug":926,"type":15},{"name":928,"slug":929,"type":15},{"name":957,"slug":958,"type":15},"SaaS","saas",{"name":960,"slug":961,"type":15},"UI Components","ui-components","2026-06-16T09:45:58.956063",{"slug":964,"name":964,"fn":965,"description":966,"org":967,"tags":968,"stars":29,"repoUrl":30,"updatedAt":979},"agents-sdk","build AI agents on Cloudflare Workers","Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, chat applications, voice agents, or browser automation. Covers Agent class, state management, callable RPC, Workflows, durable execution, queues, retries, observability, and React hooks. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[969,971,972,973,976],{"name":970,"slug":35,"type":15},"Agents",{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},{"name":974,"slug":975,"type":15},"MCP","mcp",{"name":977,"slug":978,"type":15},"WebSockets","websockets","2026-04-06T18:07:36.660888",22,{"items":982,"total":776},[983,991,1005,1018,1040,1049,1062],{"slug":964,"name":964,"fn":965,"description":966,"org":984,"tags":985,"stars":29,"repoUrl":30,"updatedAt":979},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[986,987,988,989,990],{"name":970,"slug":35,"type":15},{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},{"name":974,"slug":975,"type":15},{"name":977,"slug":978,"type":15},{"slug":8,"name":8,"fn":992,"description":993,"org":994,"tags":995,"stars":29,"repoUrl":30,"updatedAt":1004},"build on the full Cloudflare platform","Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), feature flags (Flagship), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[996,997,998,1001],{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},{"name":999,"slug":1000,"type":15},"Serverless","serverless",{"name":1002,"slug":1003,"type":15},"Storage","storage","2026-04-06T18:07:35.399081",{"slug":1006,"name":1006,"fn":1007,"description":1008,"org":1009,"tags":1010,"stars":29,"repoUrl":30,"updatedAt":1017},"cloudflare-email-service","manage transactional emails with Cloudflare","Send and receive transactional emails with Cloudflare Email Service (Email Sending + Email Routing). Use when building email sending (Workers binding or REST API), email routing, Agents SDK email handling, or integrating email into any app — Workers, Node.js, Python, Go, etc. Also use for email deliverability, SPF\u002FDKIM\u002FDMARC, wrangler email setup, MCP email tools, or when a coding agent needs to send emails. Even for simple requests like \"add email to my Worker\" — this skill has critical config details.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1011,1012,1013,1016],{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},{"name":1014,"slug":1015,"type":15},"Email","email",{"name":999,"slug":1000,"type":15},"2026-04-16T05:02:38.301955",{"slug":1019,"name":1019,"fn":1020,"description":1021,"org":1022,"tags":1023,"stars":29,"repoUrl":30,"updatedAt":1039},"cloudflare-one","configure and manage Cloudflare One Zero Trust","Guides Cloudflare One Zero Trust and SASE work across Access, Gateway, WARP, Tunnel, Cloudflare WAN, DLP, CASB, device posture, and identity. Use when designing, configuring, troubleshooting, or reviewing Cloudflare One deployments. Retrieval-first: use current Cloudflare docs\u002FAPI schemas instead of embedded product docs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1024,1027,1028,1031,1032,1035,1036],{"name":1025,"slug":1026,"type":15},"Access Control","access-control",{"name":9,"slug":8,"type":15},{"name":1029,"slug":1030,"type":15},"Infrastructure","infrastructure",{"name":17,"slug":18,"type":15},{"name":1033,"slug":1034,"type":15},"SASE","sase",{"name":13,"slug":14,"type":15},{"name":1037,"slug":1038,"type":15},"Zero Trust","zero-trust","2026-06-15T09:51:34.015251",{"slug":4,"name":4,"fn":5,"description":6,"org":1041,"tags":1042,"stars":29,"repoUrl":30,"updatedAt":31},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1043,1044,1045,1046,1047,1048],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":17,"slug":18,"type":15},{"name":27,"slug":28,"type":15},{"name":13,"slug":14,"type":15},{"name":24,"slug":25,"type":15},{"slug":1050,"name":1050,"fn":1051,"description":1052,"org":1053,"tags":1054,"stars":29,"repoUrl":30,"updatedAt":1061},"durable-objects","build Cloudflare Durable Objects","Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite storage, alarms, WebSockets, or reviewing DO code for best practices. Covers Workers integration, wrangler config, and testing with Vitest. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1055,1056,1057,1060],{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},{"name":1058,"slug":1059,"type":15},"State Management","state-management",{"name":977,"slug":978,"type":15},"2026-04-06T18:07:39.148434",{"slug":1063,"name":1063,"fn":1064,"description":1065,"org":1066,"tags":1067,"stars":29,"repoUrl":30,"updatedAt":1077},"sandbox-sdk","build sandboxed code execution apps on Cloudflare","Build sandboxed applications for secure code execution. Load when building AI code execution, code interpreters, CI\u002FCD systems, interactive dev environments, or executing untrusted code. Covers Sandbox SDK lifecycle, commands, files, code interpreter, and preview URLs. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1068,1069,1070,1073,1076],{"name":9,"slug":8,"type":15},{"name":907,"slug":908,"type":15},{"name":1071,"slug":1072,"type":15},"Code Execution","code-execution",{"name":1074,"slug":1075,"type":15},"Sandboxing","sandboxing",{"name":999,"slug":1000,"type":15},"2026-04-06T18:07:37.89439"]