Cloudflare Simplifies Zero Trust with Agents

Migrating to a Zero Trust network architecture is a complex undertaking, demanding a deep understanding of existing infrastructure. Cloudflare is aiming to simplify this process with the introduction of the Cloudflare One stack, a toolkit designed to empower agents to configure, deploy, and manage Zero Trust environments.

This new offering packages years of Cloudflare's migration expertise, addressing common challenges and streamlining the adoption of its security suite. It's built to help organizations map their current security setups into Cloudflare with greater automation.

Bridging the Agent Gap in Security

Agents are increasingly utilized for tasks like coding and workflow automation. The Cloudflare One stack extends this by providing agents with the specific context and guidance needed to execute security workflows effectively.

Cloudflare has long positioned itself as a user-friendly SASE vendor, and this move extends that philosophy to agent-based operations.

What is the Cloudflare One Stack?

The Cloudflare One stack is a collection of skills that agents can leverage. These skills are purpose-built to assist security practitioners throughout the entire lifecycle of evaluating, deploying, and managing Cloudflare One.

The stack synthesizes knowledge from employees with extensive customer experience, offering tools for planning, managing, and implementing user and agent security infrastructure. It includes specific logic for migrating from legacy vendors like Zscaler and Palo Alto Networks.

When paired with the Cloudflare code mode MCP server, the stack grants agents a typed interface to the Cloudflare API. This allows agents to inspect configurations and make changes via curated, recommended workflows.

Inside the Stack

• Remote access and VPN replacement via Cloudflare Access.
• User, network, device, and data security with Cloudflare Gateway.
• Connectivity solutions including Cloudflare Tunnel, Mesh, and WAN.
• Detailed migration guidance for various SASE vendors.
• Network diagram interpretation and generation for visualization.
• Vendor concept translation to ease provider switching.
• Troubleshooting and operations support, including the Digital Experience Monitoring (DEX) toolkit.

The stack is available in the Cloudflare Skills repository as two lightweight files: cloudflare-one for general guidance and cloudflare-one-migration for vendor-specific transitions.

For instance, the cloudflare-one skill can guide an agent on replacing VPN infrastructure by inventorying applications, mapping them to Cloudflare primitives, and generating a deployment sequence.

The cloudflare-one-migration skill translates vendor-specific definitions, like Zscaler Private Access applications, into Cloudflare Access equivalents. This logic mirrors the effectiveness of Cloudflare's Descaler and Deskope programs, which have accelerated enterprise migrations.

The stack also supports recommending security rules, investigating HTTP log anomalies, and reporting on user stability with DEX data.

This new capability is also a boon for Cloudflare's partner network, enabling faster deployments and more effective customer management.

The Cloudflare One stack is available now, best utilized with the Cloudflare code mode MCP server for secure API access. Cloudflare plans to expand the stack with new skills for additional migration sources and advanced troubleshooting.