What cloudflare.com declares an agent can do

Measured 2026-10-04 04:17 UTC from the declarations the site publishes (record m9lacvgakb). Each capability is shown as declared, under the policy class that decides whether anything may call it, beside what a call observed.

23declared

4public read-only

0called and verified

2declared ≠ observed

agent_skill, mcp, openapiprotocols

Public read-only 4 · Unknown 2 · Metadata 17

Declared versus observed

Capability	Policy class	Declared	Observed
GET /llms.txt openapi · GET · https://www.cloudflare.com/llms.txt	Public read-only	HTTP GET with no declared security auth: none · required inputs: 0	schema mismatch HTTP 200 · text/plain declared_media_mismatch
GET /llms-full.txt openapi · GET · https://www.cloudflare.com/llms-full.txt	Public read-only	HTTP GET with no declared security auth: none · required inputs: 0	schema mismatch HTTP 200 · text/plain declared_media_mismatch
GET /.well-known/api-catalog openapi · GET · https://www.cloudflare.com/.well-known/api-catalog	Public read-only	HTTP GET with no declared security auth: none · required inputs: 0	not attempted outside the per-scan call budget (2 GETs, 1 MCP tool)
GET /.well-known/agents.json openapi · GET · https://www.cloudflare.com/.well-known/agents.json	Public read-only	HTTP GET with no declared security auth: none · required inputs: 0	not attempted outside the per-scan call budget (2 GETs, 1 MCP tool)
read_llms_txt mcp	Unknown never called automatically	its effect is not stated in the declaration auth: unknown	not attempted classed unknown: only read-only public actions are ever called
read_markdown_page mcp	Unknown never called automatically	its effect is not stated in the declaration auth: unknown	not attempted classed unknown: only read-only public actions are ever called
server mcp · https://docs.mcp.cloudflare.com/mcp	Metadata never called automatically	a server declaration; its tools are listed only by the server itself (tools/list), which is not called auth: unknown	not attempted on another origin (docs.mcp.cloudflare.com): only the scanned origin is called
agents-sdk agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/agents-sdk.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
basin agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/basin.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
cloudflare agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/cloudflare.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
cloudflare-email-service agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/cloudflare-email-service.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
cloudflare-one agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/cloudflare-one/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
cloudflare-one-migrations agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/cloudflare-one-migrations/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
durable-objects agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/durable-objects.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
k2 agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/k2/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
nextjs-on-cloudflare agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/nextjs-on-cloudflare/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
sandbox-migrate-to-next agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/sandbox-migrate-to-next/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
sandbox-next agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/sandbox-next.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
sandbox-stable agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/sandbox-stable/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
turnstile-spin agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/turnstile-spin.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
web-perf agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/web-perf/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
workers-best-practices agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/workers-best-practices.tar.gz	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called
wrangler agent_skill · https://developers.cloudflare.com/.well-known/agent-skills/wrangler/SKILL.md	Metadata never called automatically	an instruction file an agent reads; not an operation auth: none	not attempted on another origin (developers.cloudflare.com): only the scanned origin is called

Where the declaration and the call disagree

Mismatch	Declared	Observed
declared_media_mismatch GET /llms.txt	text/markdown	text/plain
declared_media_mismatch GET /llms-full.txt	text/markdown	text/plain

Signed certificate

This page’s rows, signed by the observer’s Ed25519 key: every capability’s id, endpoint, safety class, policy class and observed state, the declaration hashes and the record’s sealed manifest. The certificate is derived from the record alone, so the same record always yields the same id.

certificate_id ccap1:aaaa91221f68bba34a3769f80fe931ad1d8a3c5053c7f71edd40024d0ea3c3eb
alg Ed25519 · kid hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo
sig XFgdHbZUuwQ4SqezZ0P50EZhlDageKlT9IekbzPdTEBz7_LdDFeCkxCZ4gvcpfR-wcSHzF9Xy68LMKjpYEhLDw

The certificate as JSON · verify it now · the key directory · machine-readability certificate

To verify it yourself: SHA-256 the certificate object as canonical JSON (keys sorted, no whitespace); the hex digest must equal certificate_sha256 and the id; then check the Ed25519 signature over "crawlcheck-capability-certificate-v1\n" followed by that hex digest, with the key in the directory whose RFC 7638 thumbprint is the kid.

Policy classes

Policy class	Called automatically?	Rule
Public read-only public_read_only	yes, to verify	May be called without credentials. CrawlCheck calls it only to check the declaration: GET with no input, on the scanned origin.
Authenticated read-only authenticated_read_only	never	Never called by CrawlCheck. An agent needs the user's own credentials and consent.
Reversible write reversible_write	never	Never invoked automatically. Needs the owner's written authorisation and a test account.
Irreversible write irreversible_write	never	Never invoked automatically. Deletes or changes something that cannot be undone.
Financial financial	never	Never invoked automatically. Moves money or creates a charge.
External communication external_communication	never	Never invoked automatically. Sends a message, email or notification to someone.
Identity and accounts identity	never	Never invoked automatically. Creates, signs in to or changes an account or credential.
Unknown unknown	never	Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case.
Metadata metadata	never	Nothing to invoke: a listing, a server card or a skill file, not an operation.