# Cloudflare integration

Connect your Cloudflare account so Anyshift can inventory DNS, zones, certificates, WAF, load balancers, Workers, tunnels, and Access, and map hostnames to your infrastructure during investigations.

Source: https://anyshift.io/for-agents/integrations/cloudflare

## Availability

- Available.

## Capabilities

- Connect with OAuth / OIDC or a read-only API token

- Inventory zones, DNS, certificates, WAF rulesets, load balancers, Workers, tunnels, and Access

- Zone-scoped tokens supported — missing permissions soft-fail instead of failing the whole sync

- Map hostnames and edge config onto the versioned resource graph Annie uses for RCA

## Connect and verify

- Check the intended project's existing integration before adding a connection.

- Verify that the resources and time window needed for the task are covered. Connection status alone does not establish that the evidence is available.

[Cloudflare setup and permissions](https://docs.anyshift.io/pages/integration/cloudflare)

## Use cases

- Trace an incident from a failing hostname to the Cloudflare DNS record and upstream origin

- See which WAF rulesets and certificate packs protect a public endpoint

- Correlate Workers routes and tunnels with the services they expose

## Continue

[All integrations](https://anyshift.io/for-agents/integrations)

[Query your project with Graph MCP](https://anyshift.io/for-agents/product/context)