How to use the Cloudflare Access Zero Trust Deployment agent skill

What the skill makes the agent do

The skill covers deploying Cloudflare Access together with Cloudflare Tunnel to give zero trust access to self-hosted applications. Its description covers configuring identity-aware policies, device posture checks and WARP client enrollment as a VPN replacement.

The workflow in the skill is organised into four steps: create a Cloudflare Tunnel to internal applications, configure identity provider integration, create Access applications and policies, and deploy the WARP client for device enrollment. The examples cover internal web apps, SSH and RDP services, with access granted per application rather than to the whole network.

The skill also includes Python scripts that can query your Cloudflare account to audit existing Access applications, policies and identity providers.

• Expose internal web, SSH and RDP apps through a Cloudflare Tunnel without opening inbound ports
• Connect an identity provider such as Okta or Microsoft Entra ID
• Write allow policies that can also require device checks
• Audit an existing Access setup for missing session timeouts or weak policies

Install the skill from the ZIP or the Claude apps

Download the ZIP of the skill from this page. To use it with Claude Code for your user account, unzip it into ~/.claude/skills/. To use it for one project only, unzip it into the .claude/skills/ folder of that project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal use across projects: ~/.claude/skills/
• Single project: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills

Trigger the skill with a natural request

You do not need to name the skill. The skill's description says when to use it: replacing VPN with Cloudflare One, exposing internal apps without open inbound ports, or securing contractor or third-party access to specific applications. Describe your goal in those terms and include the details the agent will need, such as the apps and the identity provider you use.

• "Help me replace our VPN with Cloudflare One. We run a wiki, Grafana and an SSH bastion."
• "Set up contractor access to only our staging Git server through Cloudflare Access."
• "Audit our existing Cloudflare Access apps and policies for missing session timeouts."

What you need before you start

The skill assumes a working Cloudflare setup. Its requirements are a Cloudflare account with a Zero Trust subscription, a domain managed by Cloudflare DNS, a Linux, Windows or macOS server to run the cloudflared daemon, and a Cloudflare API token (CF_API_TOKEN) with Access permissions.

You also need identity provider credentials (Okta, Microsoft Entra ID, Google, GitHub or SAML/OIDC), Python 3 with the requests library for the audit scripts, and cloudflared. The Cloudflare WARP client is optional.

• Cloudflare account with a Zero Trust subscription
• Domain managed by Cloudflare DNS
• Linux, Windows or macOS server for cloudflared
• CF_API_TOKEN with Access permissions
• Identity provider credentials
• Python 3 with the requests library
• cloudflared, and optionally the WARP client

Safety notes: scripts and network use

This skill runs scripts and uses the network. The audit scripts query your Cloudflare account through its API, and the setup steps create tunnels, applications and policies. Review the scripts in scripts/ and the commands before running them, and use an API token scoped to what you need.

The skill is not suited to environments that must stay fully on-premises or air-gapped, because traffic is routed through Cloudflare's cloud. It also does not apply to applications that need persistent UDP connections, which the skill says Cloudflare Tunnel does not support.

• scripts/agent.py and scripts/process.py are included; read them before running
• Setup commands change live Cloudflare configuration
• Store CF_API_TOKEN securely and do not paste it into chats

Tips for a smoother deployment

Start with one low-risk internal application, confirm that login and policy behave as expected, then add the rest. The skill's examples set a session_duration on each application, and its checklist template in assets/template.md tracks tunnels, applications and identity providers in one place.

Keep the catch-all ingress rule at the bottom of the tunnel configuration, as the skill's example does, and use an explicit precedence on policies so you know which one applies first.

• Migrate one application at a time
• Use assets/template.md as a deployment checklist
• Keep the required catch-all rule in the tunnel config