Agents In Use
What’s new todayLast update
18 additions

Claude Code adjusts a live Cloudflare search challenge

Willison used Claude Code to narrow a Cloudflare challenge to multi-parameter searches. When the MCP interface could not edit the relevant rules, the agent switched to the API.

Added til.simonwillison.netAgent: Claudevia Claude Code
TRY A BOUNDED VERSION

Prompt to try

Editorial adaptation, not the source author’s exact prompt. Replace bracketed inputs and review tool permissions first.

Using read-only access, inspect [site] WAF rules and identify the rule affecting [request pattern]. Propose the exact expression and a rollback. Stop before any PATCH request. After explicit approval, change only that rule and verify both the allowed and challenged request patterns.

What happened

Willison documents the API update and reports ordinary single-term searches no longer trigger the challenge.

Reported by Simon Willison

How the agent did it

  1. Set up Cloudflare MCP access in a dedicated project folder.
  2. Identify the missing rule-editing capability and switch to the Cloudflare API.
  3. Inspect the zone and ruleset, then patch the challenge expression to require an ampersand.

Where a person stepped in

Willison chose the rule behavior and created an expiring token with Zone WAF edit permission.

A person approved each step before the agent continued.

More details

About this account

Claude adapted its tool strategy after the MCP route failed and located the identifiers needed for the API change.

Firsthand operational account includes commands and permission scope. Do not infer that all API credentials were minimally scoped.

Credit: Simon Willison

Source published 15 Jun 2026

Source checked 14 Oct 2026

Tools and topics

Claude Code · Cloudflare MCP · Cloudflare API · curl · jq

Operations · Checkpoints

Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.

Related use cases