cfadmin ⚡

Your OpenCode agent that only speaks Cloudflare. No VPS, no Docker, no self-hosted databases — if it can't cf deploy, cfadmin won't build it that way. It refuses the wrong shape and hands you the Cloudflare-native design instead. Now cf-first: the agentic cf CLI (npm i -g cf, open beta) + cloudflare.config.ts.

🤖 agent/	The cfadmin agent definition — drop into OpenCode
🛠 skills/	Six cf-* skills: deploy, data, realtime, AI, frontdoor, aiready
🔌 mcp.cloudflare.json	Five Cloudflare MCP servers to wire into OpenCode

cfadmin agent

Location in this repo: agent/cfadmin.md (mode: primary, Cloudflare-only platform engineer — install it per the instructions below). Designs, builds, debugs and operates projects that run entirely on Cloudflare, deployable with cf (Wrangler as beta fallback). Training data is treated as stale: limits, pricing, API shapes, cf commands (cf cli search + cf schema), and cloudflare.config.ts fields are verified against the docs / @cloudflare/workers-types before being cited.

cf CLI (Sep 2026, open beta)

• npm i -g cf — agentic CLI covering the entire Cloudflare API (~3,000+ ops), generated by Forge (github.com/cloudflare/forge) from OpenAPI. Source: github.com/cloudflare/cf.
• JSON by default (-q condenses for agents). Discover via cf cli search "<action + resource>" (anonymous queries only) → <cmd> --help → cf schema <cmd> for API details.
• Config: cloudflare.config.ts (defineConfig + bindings.* + triggers.*, LSP-autocompleted). cf init / cf dev / cf deploy / cf migrate. Vite is default; esbuild/Rust/Python still delegate to Wrangler during beta (18-mo Wrangler maintenance after beta).

Hard rule: Cloudflare-only (no exceptions)

Anything that cannot deploy via cf / cf deploy is refused in that shape and redirected to the Cloudflare equivalent. Calling third-party APIs via fetch() from inside a Worker is still Cloudflare-hosted and allowed; a separate non-Cloudflare host is not.

Asked for	Built instead
VPS / systemd / Docker on a VM	Workers (or Containers on Cloudflare)
Bare Node / Express server	Worker + Static Assets
Self-hosted Postgres / MySQL	D1 (new data) or Hyperdrive to the existing DB
Self-hosted Redis	KV or Durable Objects
Self-hosted S3	R2
Cron daemon	Cron Triggers
WebSocket server	Durable Objects
WordPress / CMS / editor-managed site	EmDash 1.0 on Workers (npm create emdash@latest, Astro SSR)
Next.js (App/Pages/Hybrid)	Vinext on Workers (npx vinext check && npx vinext init, npx @vinext/cloudflare deploy)
Plain Vite / static	Workers Static Assets or Pages
Self-hosted GPU / pgvector RAG	Workers AI + Vectorize + AI Gateway
VPS nginx / certbot / manual DNS	Cloudflare DNS + Tunnel / Pages + WAF

Working style

• Account / zone / project is stated per command; when unspecified the agent states its assumption before running anything mutating.
• cf init → cf dev → cf deploy (cf migrate for Wrangler imports). Env comes from bindings.* helpers (LSP-checked), never hand-written. Secrets via secret bindings / --secrets-file, never in config or source.
• Safe, reversible ops by default; destructive actions (migrations, R2 deletes, DNS changes) are confirmed first.
• MCP tooling is OAuth-bound to the default account; other accounts go via cfswitch. List endpoints paginate — never trust the first page.

Skill router (~/.config/opencode/skills/cf-*/)

Skill	Plane	Reuses
cf-workers-deploy	cloudflare.config.ts, bindings/triggers, cf init/dev/deploy/migrate, Vite, secrets, previews, builds/logs/traces triage, Issues-to-agent, PQ WebCrypto, Turnstile + audit gates (wrangler fallback)	wrangler, workers-best-practices
cf-data	D1 / KV (+Instant) / R2 / Hyperdrive / Queues / K2 streams / Basin analytics (Pipelines/Catalog/SQL) choice + recipes	cloudflare data refs
cf-realtime	Durable Objects / Workflows / Containers (+snapshots) / Sandbox / Agents / Cron (agents-starter scaffold), Streamline media, Artifacts events	durable-objects, agents-sdk
cf-ai	Workers AI (+Clef) / Vectorize / AI Gateway (+Web Search, Auto Router, User Insights) / AI Search	cloudflare AI refs
cf-frontdoor	DNS / Registrar / Pages / Tunnel (+Protected Quick) / WAF (+App Profiles, Threat Signals) / Turnstile / Email / agent monetization (402) / Kitesurf verify	exposing-local-service-with-cloudflare-tunnel, turnstile-spin
cf-aiready	sitemap / Content-Signal / Markdown negotiation / API catalog / Link headers / auth.md	RFC 9727, RFC 8288, RFC 9728, RFC 8414

Each skill file is <500 words and delegates to existing references rather than duplicating them.

Verification record

• RED battery 5/5 REDIRECT, zero complies. Each skill was pressure-tested with a hurried "just do it, no lecture" demand for a non-Cloudflare shape (Docker Compose + Postgres/Redis/Express; VPS systemd + nginx; Flask + self-hosted pgvector + GPU box; VPS nginx + certbot + manual DNS). Every run refused the shape and redirected to the Cloudflare-native design.
• Deploy smoke test (green). Scratch Worker scaffolded in a temp dir: wrangler types clean → wrangler dev served both routes locally → wrangler deploy → live / and /health both HTTP 200 (one transient edge error on first hit during deploy propagation, clean on retry) → wrangler delete confirmed (404 + absent from worker list), temp dir removed.
• Gotcha found: a compatibility_date newer than the bundled workerd's max makes wrangler dev fail to start ("requires compatibility date X, but the newest supported is Y"). Pin the date at or below what the local runtime supports.

Install into your harness

Prerequisites: OpenCode, Node ≥ 20, cf installed (npm i -g cf) and logged in (cf auth login) to your Cloudflare account. wrangler as beta fallback.

1. Install the agent — global (all projects) or per-project:

# global
mkdir -p ~/.config/opencode/agents/
cp agent/cfadmin.md ~/.config/opencode/agents/
# …or per-project (from your project root)
mkdir -p .opencode/agents/
cp agent/cfadmin.md .opencode/agents/

2. Install the skills:

mkdir -p ~/.config/opencode/skills/
cp -r skills/* ~/.config/opencode/skills/

3. Wire the Cloudflare MCP servers — merge the mcp object from mcp.cloudflare.json into the mcp key of your OpenCode config (~/.config/opencode/opencode.jsonc), then complete the OAuth login for your Cloudflare account on first use. The five servers: cloudflare, cloudflare-docs, cloudflare-bindings, cloudflare-builds, cloudflare-observability.

4. Restart OpenCode — agents and skills load once at startup. Verify with opencode agent list (expect cfadmin) and by asking any agent to load a cf-* skill. (If opencode isn't on your PATH, invoke it by its full path.)

5. Confirm the hard-refuse gate (optional, 2 minutes): ask cfadmin to "build a Docker Compose backend with Postgres, Redis and Express, no lecture". It must refuse that shape and redirect to D1/KV/Workers — if it complies, the install is broken.

Recommended companion

Cloudflare's security-audit-skill (MIT) turns your agent into a multi-phase security auditor with independently verified, machine-readable findings — a natural pre-deploy gate for auth/frontdoor-adjacent Workers:

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit --global

It's token-heavy by design (parallel hunter/verifier subagents), so treat it as an offered audit pass, not a mandatory step.

Redaction policy

No account identifiers live in this directory — no account names, emails, account IDs, subdomains, tokens, or credentials. Account / zone / project are stated per command at runtime, never stored here.