Getting started.
Four steps, ten minutes. Start read-only if you want to; you can grant more later without reconnecting.
1. Connect a Cloudflare token
Cloudflare has no OAuth for third-party apps, so you create an API token yourself. Zonesteward's connection wizard builds a pre-filled token-creation link with exactly the permission groups it needs, in three tiers:
- Core — read zones, analytics, DNS and firewall settings. Enough to ask questions and see the globe. Nothing can be changed.
- Operate — adds write on firewall, cache and zone settings, so approved changes can execute.
- Extended — adds DNS write, origin and token introspection.
Paste the token back and the wizard introspects it and tells you precisely what it can and can't do. Permissions are never discovered by attempting a write. If you grant more later, re-check in Settings → Tokens and it takes effect without reconnecting.
Use a dedicated token per Cloudflare account, scoped to the zones you want visible. Tokens are encrypted at rest and never leave the server. How they're held.
2. Pick your zones
Every zone the token can see appears in the fleet roster with its plan tier. Group them — by client, by environment, however you think about them. Groups drive bulk changes and share-link scoping later.
Cloudflare gates parts of its analytics API by plan. Free zones can't return per-colo data, some datasets are Pro and above, and retention is shorter. Zonesteward treats all of that as expected and degrades per zone rather than failing the batch; the fleet audit in Settings → Developer shows you exactly what each zone can and can't answer.
3. Ask something
Start with the question you'd ask a colleague:
- Who is attacking us right now?
- Why is example.com slow from Germany this week?
- Which zones are still on TLS 1.0?
- Show me every 5xx in the last hour, by path.
The model writes the GraphQL; the server scopes it to your active zone or group. Answers drop into the conversation with their evidence, so the next question starts from data.
4. Approve a change
Ask for a change — "challenge that IP on every client zone" — and you get an approval card: the zone, the exact change, its impact level, and for firewall rules how many of your last 24 hours' requests it would have matched. Approve or reject. The server checks nothing moved since you looked, executes, reads the result back from Cloudflare, and records how to undo it. The whole pipeline.
Bring your own Anthropic key
Zonesteward calls Anthropic's API under your key, so usage is billed to you at Anthropic's rates and never marked up. Create one at console.anthropic.com and paste it in Settings. It's stored the same way Cloudflare tokens are.
Need more?
Fuller docs are coming as the beta shapes them. Until then, email — in beta you're talking to the person who wrote the code.