Connect OpenClaw to Cloudflare
Let an OpenClaw agent manage DNS records, zones, WAF lists and tunnels in your Cloudflare account, with no credentials handed to the agent.
Cloudflare sits in front of a large share of the web, handling DNS, TLS, caching, firewall rules, tunnels and load balancing for everything from personal blogs to enterprise platforms. It is infrastructure people touch rarely but urgently: a DNS record for a new subdomain, an IP range that needs blocking right now, a tunnel config to double-check, a zone to set up for a client’s domain. Each is a two-minute dashboard task that still interrupts an engineer.
With Claworc’s External Connections, an OpenClaw agent can manage
your Cloudflare account on your behalf. You provide a Cloudflare API token once, Composio
stores it, and the agent gets an auto-generated claworc-cloudflare skill that tells it
which Cloudflare tools exist and how to call them. The agent never sees the token itself.
Tools available to OpenClaw agents
Section titled “Tools available to OpenClaw agents”Composio’s Cloudflare toolkit exposes 20 actions across zones, DNS, WAF lists, tunnels and load balancing. In practice an OpenClaw agent leans on a handful of capabilities:
- List and create zones — see every domain in the account, or add a new one when onboarding a site.
- Read DNS records — list a zone’s records, the first step in any “why isn’t this resolving?” question.
- Change DNS records — add a CNAME for a new service, change an A record after a migration, or remove a stale entry.
- Maintain IP lists — manage the lists your firewall rules reference, such as an office allowlist or an abuse blocklist.
- Review firewall rules — see what is currently blocking or challenging traffic.
- Manage tunnels — check on Cloudflare Tunnels and adjust their configuration.
- Inspect load balancers — look at origin pools and their health checks.
Every tool is called through a small broker running next to the agent, so the agent only needs to describe what it wants done in plain language and let the skill handle the rest.
Use cases
Section titled “Use cases”Ship a subdomain
Section titled “Ship a subdomain”“Point app.example.com at the new load balancer, proxied.” The agent finds the zone,
checks the existing records for a conflicting entry, then creates the record. It replies
with the record it created and whether proxying is on, and you never open the dashboard.
Block an abusive range during an incident
Section titled “Block an abusive range during an incident”Tell the agent “add 203.0.113.0/24 to the blocklist.” It finds the right list, appends the range, and reviews the firewall rules to confirm one actually references that list. The whole exchange takes less time than finding the right tab.
DNS audit across every zone
Section titled “DNS audit across every zone”Ask the agent to walk every zone, read each one’s DNS records and produce a table of records pointing at decommissioned hosts, duplicate entries, or origins left unproxied. The cleanup you have meant to do for months becomes a list you can act on.
Get started
Section titled “Get started”Connecting Cloudflare takes three steps: an admin adds a Composio API key to Claworc’s
settings, you open the instance’s Settings tab, click + Add connection, pick
Cloudflare and sign in with a Cloudflare API token. The claworc-cloudflare skill appears
in the instance a moment later. The full walkthrough, including the exact Composio
permissions the key needs, is in the
External Connections documentation.