Cloudflare Admin ⚡

Your OpenCode agent that only speaks Cloudflare. No VPS, no Docker, no self-hosted databases — if it can’t wrangler deploy, cfadmin won’t build it that way. It refuses the wrong shape and hands you the Cloudflare-native design instead.

● LIVE via Tunnel ★ stalane/cfadmin
cf-* skills
5
deploy · data · realtime · ai · frontdoor
RED battery
5/5 ▲
redirect, zero complies
MCP servers
5
workers · docs · bindings · builds · observability
Deploy smoke test
PASS ▲
dev → types → deploy → delete

🛠 Skill router

one plane per skill · thin files, heavy reuse
SkillPlane
cf-workers-deploywrangler.jsonc · envs · secrets · CI · triage
cf-dataD1 · KV · R2 · Hyperdrive · Queues
cf-realtimeDO · Workflows · Containers · Sandbox · Agents · Cron
cf-aiWorkers AI · Vectorize · AI Gateway
cf-frontdoorDNS · Pages · Tunnel · WAF · Turnstile · Email

⛔ Hard rule: Cloudflare-only

refuse the shape, redirect to the equivalent
Asked forBuilt instead
VPS / DockerWorkers / Containers
Express serverWorker + Static Assets
Postgres / MySQLD1 · Hyperdrive
RedisKV · Durable Objects
S3R2
Cron daemonCron Triggers
Socket.io serverDurable Objects
GPU / pgvector RAGWorkers AI · Vectorize

⬇ Install into your harness

OpenCode · Node ≥ 20 · wrangler logged in
cp agent/cfadmin.md ~/.config/opencode/agents/
cp -r skills/* ~/.config/opencode/skills/
  • Merge mcp.cloudflare.json into your opencode.jsonc, complete OAuth on first use.
  • Restart OpenCode, verify with opencode agent list (expect cfadmin).
  • Recommended companion: Cloudflare’s security-audit-skill as a pre-deploy gate.

✔ Verification record

measured, not claimed
  • RED battery 5/5 REDIRECT — every skill refused a hurried non-Cloudflare demand (Docker+Postgres, VPS+systemd, Flask+pgvector, nginx+certbot) and redirected to the native design.
  • Deploy smoke test green — scratch Worker: wrangler types → wrangler dev → live deploy (both routes HTTP 200) → wrangler delete, account left clean.
  • Install validated on a second host — README steps executed verbatim found and fixed the missing mkdir -p.
  • Gotcha banked: compatibility_date newer than the bundled workerd breaks wrangler dev — pin at or below local runtime max.