Cloudflare One Stack: Agent-Powered Zero Trust Deployment

Cloudflare has open-sourced the Cloudflare One stack, a collection of agent skills that automate the deployment and management of its Zero Trust platform. The skills, available in the Cloudflare Skills repository, give agents structured knowledge, decision trees, and tool definitions to configure Cloudflare One products without manual network discovery.

The agent gap in network security

Teams already use agents for coding and alert triage, but agents lack context about an organization's specific network topology and vendor configurations. Cloudflare's stack layers in prescriptive guidance so agents can operate on security infrastructure with the same expertise a seasoned practitioner would bring.

What's in the stack

The stack ships as two skill files: cloudflare-one and cloudflare-one-migration. They cover:

Remote access and VPN replacement with Cloudflare Access
User, network, device, and data security with Cloudflare Gateway
Connectivity via Cloudflare Tunnel, Cloudflare Mesh, and Cloudflare WAN
Migration guidance from legacy SASE vendors like Zscaler and Palo Alto Networks
Network diagram interpretation and generation
Vendor concept translation between SASE providers
Troubleshooting with Digital Experience Monitoring (DEX) and automated rule recommendations

How it works

When paired with the Cloudflare code mode MCP server, agents get a typed interface to the Cloudflare API. They can query live accounts, inspect configurations, and execute curated workflows. For example, the migration skill maps Zscaler Private Access applications to Cloudflare Access definitions, transforms user groups and policies, and creates equivalent resources via the API — all in a single session.

The migration logic is the same used in Cloudflare's Descaler and Deskope programs, which have moved enterprise customers from Zscaler and Netskope in hours rather than months. Now any customer or partner can access that capability on demand.

For partners, too

Cloudflare's partner network can use the stack to accelerate customer deployments, improve troubleshooting accuracy, and drive issues to resolution faster. The skills are designed to be layered with custom context or used standalone.

What's next

The stack is available now. Cloudflare plans to expand it as the One product suite evolves, adding new migration sources and advanced troubleshooting workflows. Feedback is welcome via the repository or account teams.