Cloudflare Releases Agent Skills for Zero Trust Deployment and Migration

Cloudflare has open-sourced the Cloudflare One stack, a library of agent skills designed to give AI agents the ability to manage Zero Trust security infrastructure. The release includes two core skill modules: one for general product guidance and deployment workflows, and a second focused on migrating from competing vendors like Zscaler and Palo Alto Networks.

What the Skills Can Do#

The agent skills automate several high-value workflows:

• VPN Replacement: Inventory existing applications, map them to Cloudflare primitives, generate a safe deployment sequence, and produce configuration summaries for review
• Vendor Migration: Translate user groups, policies, and application definitions from legacy platforms and create equivalent Cloudflare resources via API
• Ongoing Management: Query live configurations, troubleshoot connectivity issues, and recommend policy changes based on observed traffic

The migration logic reuses the same translation engine behind Cloudflare's Descaler and Deskope programs—which have historically compressed multi-month migrations into days.

Safety by Design#

The skills follow a review-before-apply pattern: agents propose changes, generate diffs, and wait for human approval before committing anything. When paired with Cloudflare's MCP server, agents gain a typed interface to the Cloudflare API while credentials remain isolated from the model context.

This design acknowledges the stakes—a misconfigured policy could expose internal services or lock out users—and preserves the security team's role as decision-maker rather than replacing it.

Impact for Partners#

For Cloudflare's partner network, the skills function as packaged expertise, reducing the manual work of vendor-to-vendor translation and enabling faster, more accurate deployments.

The stack is available now on GitHub, with additional migration sources and advanced troubleshooting workflows planned.