accounts_list
List all accounts in your Cloudflare account
set_active_account
Set active account to be used for tool calls that require accountId
list_autonomous_systems
List Autonomous Systems
get_as_details
Get Autonomous System details by ASN
get_ip_details
Get IP address information including full ASN details (name, country, population estimates from APNIC).
get_traffic_anomalies
Get traffic anomalies and outages
get_internet_services_ranking
Get top Internet services
get_domains_ranking
Get top or trending domains
get_domain_rank_details
Get domain rank details
get_http_data
Retrieve HTTP traffic trends.
get_dns_queries_data
Retrieve trends in DNS queries to the 1.1.1.1 resolver.
get_l7_attack_data
Retrieve application layer (L7) attack trends.
get_l3_attack_data
Retrieve network layer (L3/DDoS) attack trends.
get_email_routing_data
Retrieve Email Routing trends.
get_email_security_data
Retrieve Email Security trends.
get_internet_speed_data
Retrieve summary of bandwidth, latency, jitter, and packet loss, from the previous 90 days of Cloudflare Speed Test.
get_internet_quality_data
Retrieves a summary or time series of bandwidth, latency, or DNS response time percentiles from the Radar Internet Quality Index (IQI).
get_ai_data
Retrieves AI-related data, including traffic from AI user agents, as well as popular models and model tasks specifically from Cloudflare Workers AI.
get_bgp_hijacks
Retrieve BGP hijack events. BGP hijacks occur when an AS announces routes it does not own, potentially redirecting traffic.
get_bgp_leaks
Retrieve BGP route leak events. Route leaks occur when an AS improperly announces routes learned from one peer to another.
get_bgp_route_stats
Retrieve BGP routing table statistics including number of routes, origin ASes, and more.
get_bots_data
Retrieve bot traffic data including trends by bot name, operator, category, and kind. Covers AI crawlers, search engines, monitoring bots, and more.
get_certificate_transparency_data
Retrieve Certificate Transparency (CT) log data. CT provides visibility into SSL/TLS certificates issued for domains, useful for security monitoring.
get_netflows_data
Retrieve NetFlows traffic data showing network traffic patterns. Supports filtering by ADM1 (administrative level 1, e.g., states/provinces) via geoId.
list_origins
List cloud provider origins (hyperscalers) available in Cloud Observatory. Returns Amazon (AWS), Google (GCP), Microsoft (Azure), and Oracle (OCI) with their available regions.
get_origin_details
Get details for a specific cloud provider origin, including all available regions.
get_origins_data
Retrieve cloud provider (AWS, GCP, Azure, OCI) performance metrics. Supports timeseries, summaries grouped by region/success_rate/percentile, and grouped timeseries.
get_robots_txt_data
Retrieve robots.txt analysis data. Shows how websites configure crawler access rules, particularly for AI crawlers. Useful for understanding web crawler policies across domains.
get_bots_crawlers_data
Retrieve web crawler HTTP request data. Shows crawler traffic patterns by client type, user agent, referrer, and industry. Useful for analyzing crawler behavior and traffic distribution.
list_bots
List known bots with their details. Includes AI crawlers, search engines, monitoring bots, and more. Filter by category, operator, kind, or verification status.
get_bot_details
Get detailed information about a specific bot by its slug identifier.
get_leaked_credentials_data
Retrieve trends in HTTP authentication requests and compromised credential detection. Shows distribution by compromised status and bot class.
get_as112_data
Retrieve AS112 DNS sink hole data. AS112 handles reverse DNS lookups for private IP addresses (RFC 1918). Useful for analyzing DNS misconfiguration patterns.
list_geolocations
List available geolocations (ADM1 - administrative divisions like states/provinces). Use this to find GeoNames IDs for filtering HTTP and NetFlows data by region.
get_geolocation_details
Get details for a specific geolocation by its GeoNames ID.
get_tcp_resets_timeouts_data
Retrieve TCP connection quality metrics including resets and timeouts. Useful for understanding connection reliability across networks and locations.
get_annotations
Retrieve annotations including Internet events, outages, and anomalies from various Cloudflare data sources.
get_outages
Retrieve Internet outages and anomalies. Provides information about detected connectivity issues across ASes and locations.
list_ct_authorities
List Certificate Authorities (CAs) tracked in Certificate Transparency logs.
get_ct_authority_details
Get details for a specific Certificate Authority by its SHA256 fingerprint.
list_ct_logs
List Certificate Transparency logs.
get_ct_log_details
Get details for a specific Certificate Transparency log by its slug.
get_bgp_timeseries
Retrieve BGP updates time series data. Shows BGP announcement and withdrawal patterns over time.
get_bgp_top_ases
Get top Autonomous Systems by BGP update count.
get_bgp_top_prefixes
Get top IP prefixes by BGP update count.
get_bgp_moas
Get Multi-Origin AS (MOAS) prefixes. MOAS occurs when a prefix is announced by multiple ASes, which can indicate hijacking or legitimate anycast.
get_bgp_pfx2as
Get prefix-to-ASN mapping. Useful for looking up which AS announces a given IP prefix.
get_bgp_ip_space_timeseries
Retrieve announced IP address space time series data. Shows the count of announced IPv4 /24s and IPv6 /48s over time. Essential for monitoring BGP route withdrawals, IPv6 address space changes, and detecting significant routing events by ASN or country.
get_bgp_routes_realtime
Get real-time BGP routes for a specific IP prefix using public route collectors (RouteViews and RIPE RIS). Shows current routing state including AS paths, RPKI validation status, and visibility across peers. Useful for troubleshooting routing issues and verifying route announcements.
get_as_set
Get IRR AS-SETs that an Autonomous System is a member of. AS-SETs are used in routing policies.
get_as_relationships
Get AS-level relationships for an Autonomous System. Shows peer, upstream, and downstream relationships with other ASes.
list_tlds
List top-level domains (TLDs) including generic, country-code, and sponsored TLDs. Filter by type or manager.
get_tld_details
Get detailed information about a specific top-level domain (TLD).
get_domains_ranking_timeseries
Get domain ranking timeseries data. Track how specific domains rank over time.
get_speed_histogram
Get speed test histogram data. Shows distribution of speed test results for bandwidth, latency, or jitter.
get_internet_services_timeseries
Track internet service ranking changes over time. Useful for monitoring how services like ChatGPT, Google, etc. rank over time.
get_outages_by_location
Get outage counts aggregated by location. Useful for identifying which countries have the most Internet outages.
get_traffic_anomalies_by_location
Get traffic anomalies aggregated by location. Shows which countries have the most detected outage signals, automatically detected by Radar.
get_bgp_routing_table_ases
List all ASes in global routing tables with routing statistics (prefix counts, IPv4/IPv6 address count, RPKI validation status). Data comes from public BGP MRT archives.
get_bgp_top_ases_by_prefixes
Get top ASes ordered by announced prefix count. Useful for understanding which networks have the largest routing footprint. Data comes from public BGP MRT archives and updates every 2 hours.
get_bgp_rpki_aspa_snapshot
Retrieve a snapshot of current or historical RPKI ASPA (Autonomous System Provider Authorization) objects. ASPA objects define which ASNs are authorized upstream providers for a customer ASN, helping prevent route leaks and hijacks.
get_bgp_rpki_aspa_changes
Retrieve RPKI ASPA changes over time, including additions, removals, and modifications of ASPA objects.
get_bgp_rpki_aspa_timeseries
Retrieve a timeseries of RPKI ASPA object counts over time.
search_url_scans
Search URL scans using ElasticSearch-like query syntax. Examples: 'page.domain:example.com', 'verdicts.malicious:true', 'page.asn:AS24940 AND hash:xxx', 'apikey:me AND date:[2025-01 TO 2025-02]'
create_url_scan
Submit a URL to scan. Returns the scan UUID which can be used to retrieve results.
get_url_scan
Get the results of a URL scan by its UUID. Returns detailed information including verdicts, page info, requests, cookies, and more.
get_url_scan_screenshot
Get the screenshot URL for a completed scan.
get_url_scan_har
Get the HAR (HTTP Archive) data for a completed scan. Contains detailed network request/response information.