| name | cloudflare-deploy |
| description | Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare. |
Cloudflare Deploy
Consolidated skill for building on the Cloudflare platform. Use decision trees below to find the right product, then load detailed references.
Prerequisites
- When sandboxing blocks the deployment network calls, rerun with
sandbox_permissions=require_escalated.
- The deployment might take a few minutes. Use appropriate timeout values.
Authentication (Required Before Deploy)
Verify auth before wrangler deploy, wrangler pages deploy, or npm run deploy:
npx wrangler whoami
Not authenticated? โ references/wrangler/auth.md
- Interactive/local:
wrangler login (one-time OAuth)
- CI/CD: Set
CLOUDFLARE_API_TOKEN env var
When to Read references/
This SKILL.md is an index + decision tree. Actual implementation details (wrangler.jsonc binding syntax, SDK-specific APIs, product gotchas) live under references/<product>/.
Rules of thumb:
- Picking a product? Use decision trees below, then load
references/<picked-product>/
- Writing a new
wrangler.jsonc? Always references/workers/configuration.md first (binding shapes are non-inheritable and easy to get wrong)
- CI/CD setup? Load
references/ci/github-actions.md (GitHub Actions + OIDC + PR preview + tag deploy recipes)
- Deploy fails / unexpected error? Grep
references/<product>/gotchas.md before re-running
- The minimal example below covers Workers + KV + secret โ for anything beyond that, descend into references
Minimal Worker Example (copy-paste starter)
For a Hello-world Worker with one KV binding and one secret, you don't need to read references/ at all:
{
"$schema": "node_modules/wrangler/config-schema.json",
"name": "my-worker",
"main": "src/index.ts",
"compatibility_date": "2026-04-01",
"compatibility_flags": ["nodejs_compat"],
"observability": { "enabled": true },
"kv_namespaces": [
{ "binding": "CACHE", "id": "<replace-with-kv-id>" }
]
}
export interface Env {
CACHE: KVNamespace;
API_SECRET: string;
}
export default {
async fetch(req: Request, env: Env): Promise<Response> {
const hit = await env.CACHE.get("greeting");
return new Response(hit ?? "hello");
}
};
Bootstrap commands:
npx wrangler kv namespace create CACHE
npx wrangler secret put API_SECRET
npx wrangler types
npx wrangler dev
npx wrangler deploy
Pick compatibility_date = today's date (YYYY-MM-DD). Update when upgrading wrangler.
For Pages / D1 / Durable Objects / multi-env / CI โ descend into references/.
Quick Decision Trees
"I need to run code"
Need to run code?
โโ Serverless functions at the edge โ workers/
โโ Full-stack web app with Git deploys โ pages/
โโ Stateful coordination/real-time โ durable-objects/
โโ Long-running multi-step jobs โ workflows/
โโ Run containers โ containers/
โโ Multi-tenant (customers deploy code) โ workers-for-platforms/
โโ Scheduled tasks (cron) โ cron-triggers/
โโ Lightweight edge logic (modify HTTP) โ snippets/
โโ Process Worker execution events (logs/observability) โ tail-workers/
โโ Optimize latency to backend infrastructure โ smart-placement/
"I need to store data"
Need storage?
โโ Key-value (config, sessions, cache) โ kv/
โโ Relational SQL โ d1/ (SQLite) or hyperdrive/ (existing Postgres/MySQL)
โโ Object/file storage (S3-compatible) โ r2/
โโ Message queue (async processing) โ queues/
โโ Vector embeddings (AI/semantic search) โ vectorize/
โโ Strongly-consistent per-entity state โ durable-objects/ (DO storage)
โโ Secrets management โ secrets-store/
โโ Streaming ETL to R2 โ pipelines/
โโ Persistent cache (long-term retention) โ cache-reserve/
"I need AI/ML"
Need AI?
โโ Run inference (LLMs, embeddings, images) โ workers-ai/
โโ Vector database for RAG/search โ vectorize/
โโ Build stateful AI agents โ agents-sdk/
โโ Gateway for any AI provider (caching, routing) โ ai-gateway/
โโ AI-powered search widget โ ai-search/
"I need networking/connectivity"
Need networking?
โโ Expose local service to internet โ tunnel/
โโ TCP/UDP proxy (non-HTTP) โ spectrum/
โโ WebRTC TURN server โ turn/
โโ Private network connectivity โ network-interconnect/
โโ Optimize routing โ argo-smart-routing/
โโ Optimize latency to backend (not user) โ smart-placement/
โโ Real-time video/audio โ realtimekit/ or realtime-sfu/
"I need security"
Need security?
โโ Web Application Firewall โ waf/
โโ DDoS protection โ ddos/
โโ Bot detection/management โ bot-management/
โโ API protection โ api-shield/
โโ CAPTCHA alternative โ turnstile/
โโ Credential leak detection โ waf/ (managed ruleset)
"I need media/content"
Need media?
โโ Image optimization/transformation โ images/
โโ Video streaming/encoding โ stream/
โโ Browser automation/screenshots โ browser-rendering/
โโ Third-party script management โ zaraz/
"I need infrastructure-as-code"
Need IaC? โ pulumi/ (Pulumi), terraform/ (Terraform), or api/ (REST API)
Product Index
Compute & Runtime
| Product | Reference |
|---|
| Workers | references/workers/ |
| Pages | references/pages/ |
| Pages Functions | references/pages-functions/ |
| Durable Objects | references/durable-objects/ |
| Workflows | references/workflows/ |
| Containers | references/containers/ |
| Workers for Platforms | references/workers-for-platforms/ |
| Cron Triggers | references/cron-triggers/ |
| Tail Workers | references/tail-workers/ |
| Snippets | references/snippets/ |
| Smart Placement | references/smart-placement/ |
Storage & Data
| Product | Reference |
|---|
| KV | references/kv/ |
| D1 | references/d1/ |
| R2 | references/r2/ |
| Queues | references/queues/ |
| Hyperdrive | references/hyperdrive/ |
| DO Storage | references/do-storage/ |
| Secrets Store | references/secrets-store/ |
| Pipelines | references/pipelines/ |
| R2 Data Catalog | references/r2-data-catalog/ |
| R2 SQL | references/r2-sql/ |
AI & Machine Learning
| Product | Reference |
|---|
| Workers AI | references/workers-ai/ |
| Vectorize | references/vectorize/ |
| Agents SDK | references/agents-sdk/ |
| AI Gateway | references/ai-gateway/ |
| AI Search | references/ai-search/ |
Networking & Connectivity
| Product | Reference |
|---|
| Tunnel | references/tunnel/ |
| Spectrum | references/spectrum/ |
| TURN | references/turn/ |
| Network Interconnect | references/network-interconnect/ |
| Argo Smart Routing | references/argo-smart-routing/ |
| Workers VPC | references/workers-vpc/ |
Security
| Product | Reference |
|---|
| WAF | references/waf/ |
| DDoS Protection | references/ddos/ |
| Bot Management | references/bot-management/ |
| API Shield | references/api-shield/ |
| Turnstile | references/turnstile/ |
Media & Content
| Product | Reference |
|---|
| Images | references/images/ |
| Stream | references/stream/ |
| Browser Rendering | references/browser-rendering/ |
| Zaraz | references/zaraz/ |
Real-Time Communication
| Product | Reference |
|---|
| RealtimeKit | references/realtimekit/ |
| Realtime SFU | references/realtime-sfu/ |
Developer Tools
| Product | Reference |
|---|
| Wrangler | references/wrangler/ |
| Miniflare | references/miniflare/ |
| C3 | references/c3/ |
| Observability | references/observability/ |
| Analytics Engine | references/analytics-engine/ |
| Web Analytics | references/web-analytics/ |
| Sandbox | references/sandbox/ |
| Workerd | references/workerd/ |
| Workers Playground | references/workers-playground/ |
Infrastructure as Code
| Product | Reference |
|---|
| Pulumi | references/pulumi/ |
| Terraform | references/terraform/ |
| API | references/api/ |
Other Services
| Product | Reference |
|---|
| Email Routing | references/email-routing/ |
| Email Workers | references/email-workers/ |
| Static Assets | references/static-assets/ |
| Bindings | references/bindings/ |
| Cache Reserve | references/cache-reserve/ |
Troubleshooting
Escalated Network Access
If deployment fails due to network issues (timeouts, DNS errors, connection resets), rerun the deploy with escalated permissions (use sandbox_permissions=require_escalated). The deploy requires escalated network access when sandbox networking blocks outbound requests.
Example guidance to the user:
The deploy needs escalated network access to deploy to Cloudflare. I can rerun the command with escalated permissionsโwant me to proceed?
