Agents meet Zero Trust: Cloudflare packages migration know-how into skills files

Migrating to a Zero Trust architecture usually starts with a painful exercise in institutional archaeology: teams must reconstruct which applications exist, how they authenticate, and what assumptions the current security and routing policies encode. Cloudflare is now packaging the expertise it has accumulated from thousands of such migrations into a set of agent-ready skills, available in the Cloudflare Skills repository.

The Cloudflare One stack consists of two lightweight skill files — cloudflare-one and cloudflare-one-migration — that provide agents with structured knowledge, decision trees, and tool definitions. These skills are designed to work with any agent, either standalone or layered into existing tooling, and are intended to cover the full lifecycle of evaluating, deploying, and managing a Cloudflare One environment.

The foundation of the stack is synthesized guidance from Cloudflare employees with tens of thousands of hours of customer-facing experience. It includes logic for migrating from legacy vendors such as Zscaler and Palo Alto Networks, and it draws directly from Cloudflare's Descaler and Deskope programs, which have moved enterprise customers off competing SASE platforms "in hours rather than months."

Bridging the agent knowledge gap

Organizations are increasingly asking agents to handle security workflows, but agents lack context about an organization's specific network topology or vendor configuration nuances. The Cloudflare One stack addresses this by supplying prescriptive, authoritative guidance that agents can use to make better decisions. When paired with the Cloudflare code mode MCP server, the skills give agents a typed interface to query live accounts, inspect configurations, and execute changes through curated, recommended workflows rather than ad-hoc API calls.

Coverage areas and capabilities

The two skill files span a broad set of use cases:

  • Remote access and VPN replacement with Cloudflare Access
  • User, network, device, and data security with Cloudflare Gateway
  • Connectivity via Cloudflare Tunnel, Cloudflare Mesh, and Cloudflare WAN
  • Migration guidance, including explicit steps for moving from other SASE vendors
  • Network diagram interpretation and generation for visualizing proposed changes
  • Vendor concept translation to map terminology between SASE platforms
  • Troubleshooting and operations via the Digital Experience Monitoring (DEX) toolkit and automated rule recommendations

The cloudflare-one skill file contains general product guidance. As an example, when tasked with replacing a VPN infrastructure, the skill can inventory existing VPN applications, map each one to the appropriate Cloudflare primitive — whether a self-hosted Access application, a Tunnel-connected service, or a Mesh-connected network segment — and generate a deployment sequence that minimizes cutover disruption.

The cloudflare-one-migration file handles vendor-to-vendor translation. For a request to migrate Zscaler Private Access applications to Cloudflare Access, the skill maps application definitions, transforms user groups and policies, uses the Cloudflare API to create equivalent resources, and produces a summary indicating what was migrated and what still requires manual review.

Beyond configuration: Operations and troubleshooting

In addition to deployment and migration, the stack supports ongoing operational workflows. Agents can reference the skills to recommend security rules based on observed traffic, migrate Zscaler Private Access applications into self-hosted Cloudflare Access applications, investigate secure web gateway HTTP logs to diagnose user-facing issues, or use the DEX toolkit to report on user stability and address latency problems.

Read https://github.com/cloudflare/skills#cloudflare-one then help create my first agent to manage my Zero Trust environment.

Availability for partners

The stack is not limited to direct customers managing existing Cloudflare One deployments. Cloudflare's partner network can use the skills to accelerate customer deployments, improve troubleshooting accuracy, and drive issues to resolution more efficiently.

The Cloudflare One stack is available now. Cloudflare recommends pairing it with the code mode MCP server, which keeps authentication credentials out of the model context by exposing the API through a single, compressed interface. Future expansions include additional migration sources and more advanced troubleshooting workflows, with ongoing development informed by feedback from customers and partners.