cloudflare/skills: Agent Skills for Building on Cloudflare Workers

What cloudflare/skills is for

Cloudflare ships a lot of surface area: Workers, Durable Objects, the Agents SDK, R2, D1, Vectorize, Queues, Workflows, Turnstile, Cloudflare One. A general-purpose coding agent trained months ago will still produce Workers code, but it tends to produce the version of Workers it saw during training. The repository's own framing is that skills give agents "accurate, up-to-date guidance" by loading context when a request matches a skill's triggers.

The intended user is an engineer who already works with an agent that supports the Agent Skills standard, and who wants that agent to write Cloudflare code against current documentation rather than recall. The repository is a Shell-language collection of skill folders plus plugin manifests, not a runtime library. Nothing here executes in your Worker. It is instruction material that your agent reads.

The skills table is the clearest statement of scope. It covers product discovery, Next.js on Workers through vinext, the Agents SDK, Durable Objects, three separate Sandbox skills, Wrangler, Workers best practices, Email Service, Turnstile, web performance auditing, and two Cloudflare One skills including migration assessment from Zscaler, Palo Alto and legacy VPN or SWG setups. That last pair is aimed at a different reader than the Workers developer: a network or security engineer planning a SASE migration.

How skill loading and the bundled MCP server fit together

Two mechanisms are described, and they are not the same thing. The first is skill loading. Per the README, skills are "contextual and auto-loaded based on your conversation": when a request matches a skill's triggers, the agent loads that skill and applies it. That is the Agent Skills model linked from the top of the README, where guidance lives in files that the agent pulls in on demand instead of holding every skill in context permanently.

The second is MCP. The plugin bundles Cloudflare's main remote MCP server, described as giving access to the Cloudflare API and current developer documentation through the Code Mode MCP server. So the plugin installs guidance and a live documentation and API channel. The README is explicit that Cloudflare publishes product-specific MCP servers and that this plugin "intentionally bundles only the main cloudflare server." If you want a narrower product server, you wire it up yourself.

The repository layout reflects the multi-agent target: .claude-plugin/, .codex-plugin/ and .cursor-plugin/ directories, a top-level .mcp.json plus a separate mcp.json, plugin.json, and a rules/ directory alongside skills/. Separate manifests exist because each host expects its own plugin format. The cost of that breadth is that the install instructions are per-agent and uneven in detail, which is the next problem.

Installing cloudflare/skills in Codex, Claude Code and Cursor

The README gives a native plugin path first, and says to use it where supported because it installs both the Cloudflare guidance and the Cloudflare MCP server. For Codex, two commands from the Cloudflare plugin marketplace, then a new session:

codex plugin marketplace add cloudflare/skills
codex plugin add cloudflare@cloudflare

The README notes you should start a new Codex session after installation, which is the signal that skills are read at session start rather than mid-conversation.

Claude Code uses slash commands against the plugin marketplace:

/plugin marketplace add cloudflare/skills
/plugin install cloudflare@cloudflare

Cursor installs from the Cursor Marketplace, or manually through Settings > Rules > Add Rule > Remote Rule (Github) with cloudflare/skills.

VS Code and GitHub Copilot take a different route: enable chat.plugins.enabled in VS Code settings, open the Command Palette, run Chat: Install Plugin From Source, and enter https://github.com/cloudflare/skills. The README points to VS Code's agent plugin documentation for marketplace installation and troubleshooting, which is worth reading before filing anything, because the settings key is the part most likely to be missing.

There is also a CLI path, npx skills add https://github.com/cloudflare/skills, for agents that only support the Agent Skills standard and cannot consume the plugin.

The manual copy route and what it costs you

If your agent has no plugin marketplace, the README falls back to cloning the repository and copying skill folders into the agent's skills directory. The mapping is given as a table, and the paths matter because they differ per host:

# Claude Code
~/.claude/skills/

# Cursor
~/.cursor/skills/

# OpenCode
~/.config/opencode/skills/

# OpenAI Codex
~/.codex/skills/

# Pi
~/.pi/agent/skills/

This route is where the design trade-off shows. Copying folders gives you the skills but not the bundled MCP server, so the agent gets static guidance without the live API and documentation channel the plugin provides. It also means updates are manual: you re-clone and re-copy, and there is no release history in the repository metadata to tell you what changed between two copies. The README does not document a rollback path for a skill that starts producing worse output, and it does not describe versioning for individual skills. If you need reproducible agent behaviour across a team, that gap is the thing to plan around, not the install command.

Where cloudflare/skills is the wrong tool

The failure mode is a mismatch between the request and the skill's triggers. Because loading is contextual, a skill that never matches never loads, and the agent falls back to whatever it already knew. If you ask for something adjacent to a skill's domain but phrased in a way that does not trip the trigger, you get no guidance and no error. Nothing in the repository documentation describes a diagnostic for that, so the practical check is behavioural: if the agent's Cloudflare output looks like generic training-data Workers code, the skill probably did not load.

The second boundary is platform. This repository is Cloudflare-specific by construction. It will not help you write a Lambda handler, and the cloudflare-one-migrations skill is scoped to migrations toward Cloudflare One, not away from it. Installing it in an agent used mostly for non-Cloudflare work adds context the agent has to consider for no benefit.

Third, the sandbox skills are version-split in a way that needs attention. There are three: sandbox-next for @cloudflare/sandbox@next, described as a 1.0 preview and recommended for new projects; sandbox-stable for the current stable @cloudflare/sandbox package; and sandbox-migrate-to-next for porting a stable app forward. If your agent picks the wrong one, you get instructions for a package version you are not running. The README does not explain how the triggers disambiguate between them, so if you are on Sandbox, verify which skill loaded before acting on its output.

How cloudflare/skills differs from a documentation MCP server alone

The obvious alternative is to skip the skills and connect only an MCP server that exposes Cloudflare documentation and API access. That is a real difference in approach, not a cosmetic one. An MCP server answers queries: the agent asks, the server returns current docs or performs an API call. The skills in this repository are pre-written guidance that shapes how the agent approaches a task before it asks anything, which is why the repository can ship opinionated material like workers-best-practices and a web-perf skill that walks Core Web Vitals metrics (FCP, LCP, TBT, CLS), render-blocking resources and network chains.

You can run both. In fact the plugin does, which is the point: the README frames the native plugin as installing "both Cloudflare guidance and the Cloudflare MCP server." The manual copy route is the documentation-only-plus-skills case, and connecting only the MCP server is the guidance-free case. Which one you want depends on whether your problem is that the agent does not know Cloudflare's current APIs, or that it knows them but makes poor architectural choices. The skills target the second problem; the MCP server targets the first.

Maintenance, licence and what to verify before adopting

The repository is not archived, and the last push was on 2026-09-08. That is recent enough that the skills should reflect current Cloudflare guidance, but there are no releases in the retrieved metadata, so there is no changelog to read and no version number to pin. Upgrading means pulling the current state of main and re-installing or re-copying. Budget for that as an ongoing task rather than a one-time setup, especially if you use the manual copy route where the MCP server is not included.

The licence is Apache-2.0, which permits commercial use and modification and includes a patent grant. Note the practical consequence for the copy route: you are redistributing and possibly editing skill files inside your own environment, so keep the LICENSE and any attribution intact. That is a description of the licence terms, not legal advice; if you plan to fork the skills and ship them inside a product, have counsel look at it.

Before adopting, three things are worth checking directly in the repository. Open skills/ and confirm the specific skill you need exists and matches your package versions, particularly across the three Sandbox skills. Check the per-agent plugin directories to see whether your agent is actually supported by a manifest or only by the copy route. And read the CONTRIBUTING.md and CODEOWNERS files if you intend to send changes upstream, since the repository is maintained by Cloudflare and the review path is theirs, not yours.

Editorial conclusion

Adopt cloudflare/skills if your agent already writes Workers, Durable Objects or Agents SDK code and you want it to reach for current Cloudflare docs instead of stale training data; the plugin route also brings the Cloudflare remote MCP server along. Skip it if your agent has no Agent Skills support and you are not willing to hand-copy folders, and skip it entirely if you are not building on Cloudflare. Before trusting it, open skills/ and confirm the skills you need actually exist: there is no release history to diff against, so the last push on 2026-09-08 is your only freshness signal.

Frequently asked questions

Official sources

1. cloudflare/skills on GitHub
2. Issues
3. License: Apache-2.0
4. README