Features
Everything, by the job you came to do.
Seven jobs. Every tier gets all of them — no feature or integration is held back for a higher plan.
Ask
Questions in plain language, answered against Cloudflare's analytics API directly. The server injects the zone, so a question can never reach one outside your context.
- Arbitrary analytics. traffic, status codes, geography, ASNs, paths, user agents — the model writes the GraphQL, you read the answer
- Who is attacking this zone. with severity and a verdict per source
- Everything you've configured. DNS, WAF rules, cache rules, rate limits, managed rulesets, access rules, zone settings, and every edge and platform feature
- Everything Cloudflare knows about the zone. edge certificates and when they expire, DNSSEC down to the DS record, Tiered Cache, Cache Reserve, Argo, load balancers with pool health, Logpush jobs, Turnstile widgets, Workers routes, Access applications, Email Routing, Cloudflare's own notification policies and what they sent this week, Observatory results, and Radar's view of the week's attacks
- A question library. your own saved questions, one click to ask again — the Monday-morning checks, the client-call questions
- Plan-aware degradation. denied fields are dropped and retried, denied datasets isolated so one doesn't starve the rest, span caps clamped, sampling reversed so counts are real. Free zones degrade instead of failing
- Follow-ups start from evidence. an investigation's findings drop into the conversation, so the next question builds on data rather than memory
- A guided tour on first sign-in. two minutes, and it drives the product for you: asks a question, reads the globe, proposes a change, shows the gate
- Conversations kept indefinitely. nothing expires
See
Requests rendered live on a globe, from the client's geography to the Cloudflare colo that served them. Thirty-minute rolling window, ten-second poll.
- Render modes. pulse, flow, heat, trace, hex-binned bars
- All 157 points of presence. as a layer, scaled against camera distance to stay legible at any zoom
- Day/night terminator. following the real sun
- DVR. pause, scrub, 24-hour replay
- Fleet view. every zone on one globe, colour-coded per site, busiest first
- Filter the live stream. by country, status class or user agent, with autocomplete from the zone's own traffic
- Request log. a rolling sidebar of the actual requests — with URLs — behind whatever you've filtered to or the arc you clicked
- From alert to evidence in one click. open an alert and the live view arrives pre-filtered to the traffic behind it — the 5xx, the country, the paths
- Google Analytics beside the edge. active users right now, top pages, sessions, conversions and sources docked next to the live traffic — the human behaviour Cloudflare can't see
- Honest status semantics. 2xx served, 3xx redirected, 4xx–5xx rejected. A redirect is never counted as a hit
- A dashboard built for a wall. a widget grid you arrange and save, streaming live: status mix, requests, bandwidth, top paths, countries, networks, origin health, open incidents, the fleet globe, Google Analytics, and any graph from your library
- A chart for every answer. an instant chart from the shape of the result, then up to four views the model proposes, each with a one-line reason and offered only if the data fits. Nineteen kinds: number, bars, line, area, series, table, scatter, stacked bars, grouped bars, stacked area, pie and histogram, and in 3D a timeline, top-N, heatmap, globe, globe bars, an extruded country map and 3D bars
- Author with AI. describe a chart in a sentence; it writes the query, dry-runs it against the live zone, checks the chart fits the real result, then shows a preview with its explanation and the query. Refine the sentence, or save it
- A saved library. every chart you keep, pinned to the top or not, tied to the conversation that produced it — and one click adds any of them to the dashboard, where it re-queries every minute and can combine several sites
- Reports you can ask for. "send me a seven-day digest" returns traffic, 5xx rate, top countries, paths and networks, firewall activity, alerts that fired and every change made — highlights in prose, a printable page, and CSV for every table
- Incident reports. each incident rendered as its own page: what fired, the investigation, the fix, what changed
Investigate
Traffic classified into nine attack categories with a composite severity score per source — built to be right about what isn't an attack, not just what is.
- Nine categories. WordPress brute force, CMS and plugin probing, secrets and config scanning, admin panel probing, path traversal, SQLi/XSS, shell and upload probes, credential stuffing, scanner tooling
- False positives designed out. static assets, uploads, /cdn-cgi/, well-known files, recognised crawlers including AI crawlers, research scanners like Censys and Shodan, and anything that was requested and served — all excluded, and listed with the reason rather than silently dropped
- Per-attacker evidence. status mix, paths served, methods, hosts, user agents — a verdict you can act on, with the data under it
- Across your whole fleet. the same source checked against every zone you manage, so a scanner working through your client list is seen as one problem with one fix
- Blast radius preview. a proposed rule is run against your real traffic before it exists — the count by country, network, path and user agent, and a map on the approval card showing where it would bite
- Automatic mitigation, off by default. managed challenge only, never block; single IPs only, never a range; requires a corroborating pattern, not just volume; refuses anything the origin served; capped hourly; auto-expiring; every decision logged and revertable — and a dry-run mode that decides and records without touching Cloudflare
Operate
Every change through the same nine-step pipeline: propose, classify, preview, approve, drift-check, execute, read back, audit, revert.
- DNS. create, update, delete — admin only, with apex and wildcard detection
- WAF. custom rules, skips, rate limiting, managed rulesets, Super Bot Fight Mode
- Protections. IP access rules by IP, range, ASN or country; zone lockdowns for /wp-admin and friends; one-command blocking of AI scrapers by user agent
- Edge features. Tiered Cache, Cache Reserve, Argo, DNSSEC and the rest, toggled through the gate like everything else
- Cache and rules. cache rules, purge by URL / host / tag / everything; redirect, rewrite, header, configuration and origin rules
- Zone settings and lifecycle. SSL mode, minimum TLS, security level, HSTS; create, pause, activation checks
- Health checks and waiting rooms. create and manage both, through the same gate
- Zone lifecycle. add a zone to the account and get its nameservers back; pause and unpause (high impact, acknowledged); re-check activation for a zone stuck pending; run a Lighthouse test from a region of your choice
- Plan-aware before it proposes. rate-limit rules are validated against what the zone's plan allows before they're ever put on a card
- Bulk apply. one WAF rule, cache rule, rate limit, cache purge or AI-bot block across a named group of zones or all of them — up to fifty at a time, one approval card with a per-zone result, and a separate acknowledgement once it touches more than ten
- Guard rails on every write. impact classified on the server with an explicit acknowledgement for high; drift detection that refuses the change if reality moved since you looked; read-back verification from Cloudflare; rate limits per class of change with an audited break-glass override; one-click revert from the recorded before-state
Monitor
If the graph can show it, a sentence can watch it. Any number Cloudflare exposes about your zones can become an alert by describing it — no query language, no threshold maths.
- Alerts from any datapoint, in a sentence. "Tell me if any client site returns more than 2% 5xx over ten minutes, but only with real traffic." The model writes the rule: query, metric expression, comparator, threshold, window, minimum volume
- Dry-run before it's armed. the rule is executed against the live zone first; anything that errors or doesn't yield a number is refused, so a rule that can't fire correctly is never saved
- Explained in English, permanently. the preview shows what the rule does in plain words and keeps that explanation beside it, so the rules list never becomes a wall of formulas
- Presets to start from. error-rate spike, traffic spike, traffic drop, 404 surge, origin unreachable, path attack, geographic anomaly, firewall block surge, bot score surge, cache-hit ratio drop, latency — each tunable
- Incidents, not just alerts. an alert becomes an incident: deduplicated so a flapping detector is one event, acknowledged, resolved, with an AI investigation of probable cause and a suggested fix attached. The investigator may not propose DNS changes, deletes or WAF skips, so an injected investigation cannot suggest turning protection off
- Channels, by name. Email through Resend, SendGrid, Mailgun or any SMTP server · Slack incoming webhooks · Microsoft Teams via Power Automate workflows · PagerDuty events · SMS through Twilio · generic webhooks (JSON, signed) for anything else
- Per rule, per channel. each detector subscribes to the channels it should reach; a test send from the channel screen; a delivery log showing what went where and whether it arrived
- Live stream. alerts pushed to the browser as they happen
Connect
Everything Zonesteward reads from, writes to, or talks through. Bring your own accounts for all of it; credentials are stored encrypted and used only for your workspace.
- Cloudflare. any number of API tokens across any number of Cloudflare accounts; the connection wizard builds the exact token-creation link and tells you what the pasted token can do
- Your choice of model. Anthropic, OpenAI, or any OpenAI-compatible endpoint — including one you host, so your data never leaves your infrastructure. Your own key; usage billed to you by the provider, never marked up. A model per job, and a test on save that proves the model can return the structured output the composers need
- Google Analytics 4. OAuth into the GA4 properties you can already see, to put site analytics beside Cloudflare traffic on the same dashboard
- Email. Resend, SendGrid, Mailgun, or plain SMTP
- Chat. Slack, Microsoft Teams
- Paging. PagerDuty
- SMS. Twilio
- Anything else. signed JSON webhooks on every alert, so your own systems can react
- Several tokens, one zone. where more than one token reaches a zone, the most capable one is chosen for each job, and a 403 falls through to the next rather than failing
- Permissions learned, never assumed. what a token can do is learned from real responses and introspection; a denial goes stale and is retried, so granting a permission in Cloudflare takes effect without reconnecting
Govern
Multiple clients, multiple tokens, multiple people — and a record of every one of them.
- Built for many clients. one workspace for your agency; a zone group per client; share links scoped to a client's group, so a client sees their sites and nothing else
- Fleet roster. every zone across every token, with its plan tier
- Fleet audit. reconciles what the globe shows against what Cloudflare actually permits per zone, and flags every view, data and token mismatch
- Zone groups. named collections for bulk work and for scoping what a client sees
- Sign in with. Google, Microsoft or GitHub, or an emailed link — no passwords to hold. Only provider-verified addresses can create an account
- Who can get in. invitations and a domain allowlist decide who may join your workspace; public mailbox domains can never auto-provision an account
- Share links. hand a client a link to their zone, a group, a dashboard or a report — no login, read-only, expiring within 30 days, revocable at any time
- Roles. owner, admin, user, viewer, enforced at three layers
- Audit trail. every attempt, successful or not
- AI spend, itemised. every model call logged with tokens in and out and cost, by feature and by model, so you know what a question costs before Anthropic's invoice does
- Delivery log. every notification that went out, to which channel, and whether it arrived
- Cloudflare error log. every refusal classified and attributed, so plan limits become measured rather than assumed