Cloudflare cf CLI: Agent-Ready API Tool Brings Exit-Code Risks

What Cloudflare shipped

Cloudflare has opened a beta for cf, a command-line tool designed so AI agents, as well as humans, can drive the company's platform. Its main selling point is coverage. One hands-on walkthrough puts the count at more than 2,900 Cloudflare API commands exposed through the tool 1. Other analysis rounds that to over 3,000 API operations 2. The gap probably reflects how operations get counted, or the API surface changing during the beta. Either way, the scale is the point: nearly the whole Cloudflare API is now reachable from a single CLI that an agent can call.

The practical guide covers the basics. Setup requires Node 22.18 1. It also describes a working loop suited to agents: search for the right command, inspect its schema, then run it as a dry run before doing anything for real 1. That sequence is the core design idea. An agent that can't hold thousands of endpoints in memory can find what it needs and check its inputs as it goes, without relying on training data that may be stale or invented.

The same walkthrough also flags rough edges. It notes that migration from existing workflows still carries TODOs, and it discusses what Wrangler, Cloudflare's established developer CLI, still owns 1. In other words, cf does not replace Wrangler yet. Developers should expect to use both tools during the beta.

The exit-code problem

The most consequential detail comes from Cloudflare's own agent-focused documentation. In non-interactive sessions, a destructive command such as a delete run without --force can be aborted and still exit with status 0 2. The hands-on guide calls out the same "exit-0 gotcha" 1, so both sources agree it is a real trap and not a theoretical one.

For a human at a terminal this is a minor annoyance, because the prompt or warning is visible on screen. Agents usually work differently. Many agent harnesses and CI scripts treat exit code 0 as success and move on. An agent that tries to tear down a resource, gets blocked by the missing flag, and receives a zero exit code may conclude the deletion worked 2. The next steps could then build on a false picture of the infrastructure, such as provisioning a replacement next to a resource it believes is gone or reporting a cleanup that never happened.

The usual defensive advice applies. Parse output instead of trusting status codes alone, verify state after mutations, and lean on the dry-run step the workflow already encourages 1. Still, it is notable that a tool marketed for agents ships with a behavior that undercuts one of the most basic signals agents depend on.

Config files as an attack surface

A second concern is less about bugs and more about architecture. cf supports TypeScript configuration files, and analysts point out that these are executable code, not inert data 2. A malicious cloudflare.config.ts, or one an agent hallucinated, could run arbitrary code as soon as it is loaded 2. That pushes security teams toward sandboxing agent execution environments and statically validating config files before the tool reads them 2.

This follows a familiar pattern in developer tooling, where "config as code" trades safety for flexibility. Agents raise the stakes. An agent may generate config files itself, or pull them from repositories and prompts it does not fully understand. A poisoned config is close to a supply-chain problem, except it sits one step from credentials that can reconfigure DNS, edge rules, or storage.

Reading the launch

The two perspectives fit together. The hands-on coverage presents cf as a capable, well-structured tool, and the search, schema, and dry-run loop is a sensible way to let agents work across a huge API without guessing 1. The security reading calls the launch's breadth a liability as much as a feature, because widening an agent's reach to thousands of operations also widens the ways a misread exit code or tampered config can damage real infrastructure 2.

Both views hold, and they point to the same conclusion. cf is a credible step toward agent-operated cloud infrastructure, but in its current beta it assumes a careful operator. Teams trying it with agents should scope API tokens narrowly, run agents in sandboxes, treat config files as untrusted code, and confirm destructive actions independently instead of trusting exit codes. Cloudflare's decision to document the exit-0 behavior openly is to its credit 2. The fix belongs in the tool, though, not in a warning in the docs. Until that happens, the safest assumption is that a zero exit code from cf shows the command ran, not that it did what the agent intended.