Claude Code adjusts a live Cloudflare search challenge
Willison used Claude Code to narrow a Cloudflare challenge to multi-parameter searches. When the MCP interface could not edit the relevant rules, the agent switched to the API.
til.simonwillison.netWhat happened
Willison documents the API update and reports ordinary single-term searches no longer trigger the challenge.
Reported by Simon WillisonHow the agent did it
- Set up Cloudflare MCP access in a dedicated project folder.
- Identify the missing rule-editing capability and switch to the Cloudflare API.
- Inspect the zone and ruleset, then patch the challenge expression to require an ampersand.
Where a person stepped in
Willison chose the rule behavior and created an expiring token with Zone WAF edit permission.
A person approved each step before the agent continued.
More details
About this account
Claude adapted its tool strategy after the MCP route failed and located the identifiers needed for the API change.
Firsthand operational account includes commands and permission scope. Do not infer that all API credentials were minimally scoped.
Credit: Simon Willison
Added 14 Oct 2026
Source published 15 Jun 2026
Source checked 14 Oct 2026
Tools and topics
Claude Code · Cloudflare MCP · Cloudflare API · curl · jq
Operations · Checkpoints
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.
Prompt to try
Editorial adaptation, not the source author’s exact prompt. Replace bracketed inputs and review tool permissions first.
Using read-only access, inspect [site] WAF rules and identify the rule affecting [request pattern]. Propose the exact expression and a rollback. Stop before any PATCH request. After explicit approval, change only that rule and verify both the allowed and challenged request patterns.