Cloudflare has launched the Cloudflare One stack, a specialized open-source library on GitHub that arms AI agents with the vendor-translation logic needed to automate Zero Trust migrations from Zscaler and Palo Alto Networks.
On 17 June 2026, Cloudflare introduced the Cloudflare One stack, an open-source library of specialised “agent skills.” The toolkit equips autonomous AI agents with the domain-specific knowledge required to plan, deploy, configure, and manage Zero Trust and Secure Access Service Edge (SASE) environments.
Packaged as two lightweight files, cloudflare-one handles comprehensive product lifecycle guidance (like VPN replacement and gateway network security), while cloudflare-one-migration contains explicit vendor-to-vendor translation logic. The tool prioritises automating migration workflows to transition complex rulesets away from legacy vendors like Zscaler and Palo Alto Networks, mirroring the logic used in Cloudflare’s internal Descaler and Deskope programmes to compress migrations from months down to hours.
When paired with Cloudflare’s Code Mode Model Context Protocol (MCP) server, agents gain a typed interface to the live Cloudflare API to query active configurations, audit rulesets, and implement automated adjustments. For security, API credentials are kept entirely isolated from the agent’s logic layer. The stack also allows agents to interpret visual network diagrams to generate automated provisioning scripts.
To mitigate risks within critical security networks, the framework mandates a strict “review-before-apply” pattern: agents compile configuration diffs and proposals, but human operators must explicitly approve any live policy changes. The Cloudflare One stack is fully available on GitHub, with additional vendor migrations and Digital Experience Monitoring (DEX) troubleshooting skills currently in development.
