CLOUDFLARE EXTENSIONS
Every Swamp extension that covers Cloudflare, as published in the registry.
Install any of them with swamp extension pull.
Extensions
| Extension | Version | License | Contents |
|---|---|---|---|
| @swamp/cloudflare/resource-library | 2026.10.13.1 | - | 1 behavior types |
| @webframp/cloudflare | 2026.10.14.1 | Apache-2.0 | 5 behavior types |
| @webframp/cloudflare-audit | 2026.10.14.1 | Apache-2.0 | 1 workflows, 1 reports |
| @mccormick/cloudflare | 2026.06.09.1 | - | 1 behavior types |
@swamp/cloudflare/resource-library
swamp extension pull @swamp/cloudflare/resource-libraryBehavior type @swamp/cloudflare/resource-library/applications
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
account_id |
string | yes | Cloudflare account ID |
hostnames |
array of string | no | Hostnames matched by the application. |
ip_subnets |
array of string | no | IP subnets for this application. Custom application create and update requests accept IPv4 prefix lengths /8 through /32 and IPv6 prefix lengths /32 through /128. |
port_protocols |
array of string | no | Ports matched by the application, in protocol/port or inclusive protocol/start-end format (for example, tcp/443 or udp/10000-20000). TCP and UDP ports must be between 0 and 65535. |
support_domains |
array of string | no | Support domains matched by the application. |
category_id |
integer | no | Numeric identifier for an application category. |
human_id |
string | no | Human-readable identifier for the application. |
name |
string | no | Application name. |
apiToken |
string | no | Cloudflare API token; overrides the CLOUDFLARE_API_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault. |
apiKey |
string | no | Cloudflare API key for the legacy key+email auth path; overrides the CLOUDFLARE_API_KEY environment variable. Wire with a vault.get(...) expression. Requires email. |
email |
string | no | Cloudflare account email for the legacy key+email auth path; overrides the CLOUDFLARE_EMAIL environment variable. Requires apiKey. |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
create |
Create a Applications | - |
get |
Get a Applications | id |
lookup |
Look up an existing Applications by matching global argument values and import it into state | - |
adopt |
Import an existing Applications by ID into state for management | id |
update |
Update Applications attributes | identifier (optional) |
delete |
Delete the Applications | id |
sync |
Sync Applications state from Cloudflare | identifier (optional) |
Data written:
| Resource | Description |
|---|---|
state |
Applications resource state |
@webframp/cloudflare
swamp extension pull @webframp/cloudflareBehavior type @webframp/cloudflare/cache
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
apiToken |
string | yes | Cloudflare API token with Cache Purge permissions |
zoneId |
string | yes | Zone ID to manage cache for |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
purge_all |
Purge all cached content for the zone | - |
purge_urls |
Purge specific URLs from cache | urls |
purge_tags |
Purge cache by Cache-Tag headers (Enterprise only) | tags |
purge_prefixes |
Purge cache by URL prefixes (Enterprise only) | prefixes |
get_settings |
Get cache-related settings for the zone | - |
set_cache_level |
Set the cache level for the zone | level |
toggle_dev_mode |
Toggle development mode (bypasses cache for 3 hours) | enabled |
get_analytics |
Get cache analytics (hit rate, bandwidth) | since (optional), until (optional) |
Data written:
| Resource | Description |
|---|---|
purge |
Cache purge operation result |
settings |
Cache-related zone settings |
analytics |
Cache analytics and hit rates |
Behavior type @webframp/cloudflare/dns
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
apiToken |
string | yes | Cloudflare API token with DNS read/write permissions |
zoneId |
string | yes | Zone ID to manage DNS records for |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
list |
List all DNS records in the zone | type (optional), name (optional) |
get |
Get a specific DNS record | recordId |
create |
Create a new DNS record | type, name, content, ttl (optional), proxied (optional), priority (optional), comment (optional) |
update |
Update an existing DNS record | recordId, type, name, content, ttl (optional), proxied (optional), priority (optional), comment (optional) |
delete |
Delete a DNS record | recordId |
export |
Export all DNS records in BIND format | - |
Data written:
| Resource | Description |
|---|---|
records |
List of DNS records for the zone |
record |
Single DNS record |
export |
DNS records exported in BIND zone file format |
Behavior type @webframp/cloudflare/waf
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
apiToken |
string | yes | Cloudflare API token with Firewall read/write permissions |
zoneId |
string | yes | Zone ID to manage firewall rules for |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
list_rules |
List all firewall rules | - |
create_rule |
Create a new firewall rule | expression, action, description (optional), priority (optional), paused (optional) |
delete_rule |
Delete a firewall rule | ruleId |
toggle_rule |
Pause or unpause a firewall rule | ruleId, paused |
list_packages |
List WAF packages (managed rulesets) | - |
get_security_events |
Get recent security events (blocks, challenges, etc.) | limit (optional) |
Data written:
| Resource | Description |
|---|---|
rules |
Firewall rules for the zone |
rule |
Single firewall rule |
packages |
WAF packages (managed rulesets) |
events |
Recent security events |
Behavior type @webframp/cloudflare/worker
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
apiToken |
string | yes | Cloudflare API token with Workers read/write permissions |
accountId |
string | yes | Cloudflare account ID |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
list_scripts |
List all Worker scripts in the account | - |
get_script |
Get Worker script metadata and source code | scriptName |
deploy |
Deploy a Worker script | scriptName, script, bindings (optional) |
delete_script |
Delete a Worker script | scriptName |
list_routes |
List Worker routes for a zone | zoneId |
create_route |
Create a Worker route | zoneId, pattern, scriptName |
delete_route |
Delete a Worker route | zoneId, routeId |
toggle_subdomain |
Enable or disable workers.dev subdomain for a Worker script | scriptName, enabled |
Data written:
| Resource | Description |
|---|---|
scripts |
List of Worker scripts in the account |
script |
Single Worker script metadata |
routes |
Worker routes for a zone |
deployment |
Worker deployment result |
source |
Worker script source code |
Behavior type @webframp/cloudflare/zone
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
apiToken |
string | yes | Cloudflare API token with Zone read/write permissions |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
list |
List all zones in the account | status (optional) |
get |
Get details for a specific zone | zoneId |
get_settings |
Get all settings for a zone | zoneId |
update_setting |
Update a specific zone setting | zoneId, setting, value |
pause |
Pause a zone (disable Cloudflare proxy) | zoneId |
unpause |
Unpause a zone (enable Cloudflare proxy) | zoneId |
Data written:
| Resource | Description |
|---|---|
zones |
List of all zones in the account |
zone |
Single zone details |
settings |
Zone settings (caching, SSL, etc.) |
@webframp/cloudflare-audit
swamp extension pull @webframp/cloudflare-auditWorkflows in @webframp/cloudflare-audit
| Workflow | Description |
|---|---|
@webframp/cloudflare-audit |
Cloudflare security and configuration audit. Inspects zone settings, DNS records, WAF rules, Workers, and cache config, then generates a severity-rated report with findings and recommendations. |
Reports in @webframp/cloudflare-audit
| Report | Description |
|---|---|
@webframp/cloudflare-audit-report |
Analyzes Cloudflare zone configuration for security, DNS hygiene, WAF coverage, worker health, and cache performance |
@mccormick/cloudflare
swamp extension pull @mccormick/cloudflareBehavior type @mccormick/cloudflare/zerotrust
Global arguments, set with --global-arg on swamp behavior create:
| Name | Type | Required | Description |
|---|---|---|---|
accountIds |
array of string | no | Cloudflare account IDs to scan |
cloudflareToken |
string | yes | Cloudflare API token; supply via ${{ vault.get("cloudflare", "CLOUDFLARE_TOKEN") }} |
apiBaseUrl |
string | no | Cloudflare API v4 base URL |
Methods, run with swamp behavior run:
| Method | Description | Arguments |
|---|---|---|
scan |
Fan-out scan of Cloudflare One Access applications, policies, identity providers, service tokens, and mTLS certificates. | - |
Data written:
| Resource | Description |
|---|---|
access_app |
A Cloudflare Access application |
access_policy |
A Cloudflare Access policy (conditional-access ruleset) |
identity_provider |
A configured Cloudflare Access identity provider |
service_token |
A Cloudflare Access service token (machine credential) |
mtls_cert |
A Cloudflare Access mTLS CA certificate |
access_summary |
Roll-up of one Cloudflare One scan |