01 / COMPARE
Normalize the fleet
Cloudflare resource shapes become stable facets with explicit identity and equality rules, so genuine differences stand apart from server metadata.
Self-hosted Cloudflare operations
See the fleet. Define intent. Review every change.
Cloudflare Fleet turns configuration from many zones into one comparable matrix, then keeps every supported mutation behind a fresh read, an exact plan, human confirmation, and scoped verification.
TOKEN STAYS SERVER-SIDE
READ-ONLY BY DEFAULT
NO THIRD-PARTY CONTROL PLANE
One operational workspace
Start with posture, move into evidence
Fleet opens with a decision-oriented review surface, then lets operators move from differences to expected state and finally to supported change paths.
Designed for careful operators
Visibility without surrendering control
02 / GOVERN
Define expected state
Presence and value intent compose across all zones and fixed scopes. Exact acknowledgements stay tied to one observed value, while supported drift exposes a direct alignment review.
03 / CHANGE
Plan before execution
Cell, row, policy, and workflow changes reread their dependencies, produce endpoint-specific plans, save a pending journal entry, execute in order, and verify the smallest authoritative surface.
04 / ASSIST
Give agents bounded tools
The installed CLI and local stdio MCP server expose redacted first-run diagnosis, audit, complete intent persistence, intent alignment, bounded direct changes, activity, and guarded undo through exact plan digests, fresh replanning, and confirmation-gated writes instead of a raw API passthrough.
Everyday configuration
Record good state and reuse rules
Accept current values for one facet or a selected batch, keeping deliberate differences between zones. Assign a saved expectation to several groups in one save. Copy a rule by choosing its source and destinations directly, then review the proposed changes.
From intent to action
Review a complete convergence plan
Exact and forbidden intent can produce first-class alignment actions on a policy, matrix row, or individual drifting cell. Supported adapters include zone settings, Email Routing subaddressing and wizard preferences, DNS, DNSSEC, API-managed routes, redirects, rules, strict canonical domain passthroughs, and paired hostname-scoped rate limits. Fleet refreshes the latest intent and the relevant facet across the account, then blocks the whole selected scope if any drift cell is conflicting, ambiguous, or unsupported.
Compatibility without accumulation
Keep alias zones as passthroughs
The typed canonical passthrough facet compares redirect status, canonical owner, path, query, and subdomain behavior together with required serving DNS and an exact empty accumulation envelope. It allows mail, ownership, DNSSEC, TLS, settings, and shared security posture while identifying each independent web attachment.
Strict by construction
Alias intent is always required and exact. Unread relevant surfaces block convergence, supported cleanup cannot remove serving DNS or the canonical redirect as collateral, and every write still passes through fresh planning, explicit confirmation, durable activity, verification, and guarded recovery.
One scarce rule, one complete meaning
Keep a Free rate limit inside its hostname boundary
The typed rate-limit facet treats the zone's one path-based rate rule and the earlier custom WAF skip that excludes every other hostname as one required-and-exact value. An extra or missing skip is drift because it changes where the rule can act.
Fail safe across phases
Cloudflare custom WAF rules execute before rate limiting. Fleet therefore creates the skip first, disables the rate rule before a hostname change, enables it last, and removes it before deleting the skip. A failed partial transition leaves the rule disabled or more broadly skipped, not active on an unintended host.
Deploy it your way
One interface, two protected transports
The browser application is shared. Run it behind Cloudflare Access and a Worker for durable anywhere access, or launch it through an ephemeral loopback broker on macOS. Credentials stay in the backend either way.
The complete operating model
Hosted continuity, local independence
CLOUDFLARE WORKER
Access-protected and durable
- Cloudflare Access gates every asset and API request
- The Worker validates the JWT audience and issuer again
- D1 stores intent, activity, and inventory snapshots
- A constrained proxy keeps the API token out of the browser
LOCAL LOOPBACK
Ephemeral and full-featured
- A random session capability protects a loopback-only broker
- Ignored local files hold fleet state and policy
- The regular browser profile needs no weakened security flags
- Local capabilities remain available without hosted infrastructure
Desktop depth, mobile reach
The same controls adapt to the viewport
Intent management remains a focused workspace, while narrow screens expose the complete filter model without shrinking the configuration matrix into an unreadable card list.
Turn drift into policy
Review ungoverned drift, worst first
Guided adoption leads with the coverage gaps that matter and the zones most often out of line, then keeps each suggestion scannable and its policy controls one disclosure away.
Start safely
Install, diagnose, and audit before enabling writes.
The local dashboard and generated hosted configuration both default to read-only.