> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare WAF

> Connect the Cloudflare WAF to Myrmex with an API token — create the token and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect the **Cloudflare WAF** so Myrmex can review your zone custom rules, rate limiting, managed rulesets, IP Lists, and Security Events — and, with approval, help you manage them. Myrmex reaches the **Cloudflare API** through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network, querying it in real time.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Rules & rate limiting" icon="shield-halved">
    Review zone custom rules and rate limiting, and propose adjustments.
  </Card>

  <Card title="Managed rulesets" icon="layer-group">
    Inspect deployed managed rulesets and their configuration.
  </Card>

  <Card title="IP Lists" icon="list">
    Review account IP Lists used across your rules.
  </Card>

  <Card title="Security Events" icon="magnifying-glass">
    Query Security Events during investigations, in real time.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach the Cloudflare API (`https://api.cloudflare.com`) over HTTPS. See [Deploying the agent](/documentation/agent-endpoint-security/installation).
* Your **Cloudflare Zone ID** (for zone WAF rules and events) and **Account ID** (for IP Lists and managed rulesets).
* Permission to create an **API token**.

## Step 1 — Create the API Token in Cloudflare

The credential Myrmex needs is an **API token**, used as a Bearer token, with WAF permissions.

<Steps>
  <Step title="Open API Tokens">
    In the Cloudflare dashboard, go to **My Profile → API Tokens → Create Token**, and start a custom token.
  </Step>

  <Step title="Grant WAF permissions">
    Add **Zone → Zone WAF** and **Zone → Firewall Services** (for custom rules, rate limiting, and Security Events), plus account-level permissions for **IP Lists** and **managed rulesets** — read-only for analysis, edit to allow changes.
  </Step>

  <Step title="Create and copy the token">
    Finish creating the token and **copy it now** — it is shown only once.
  </Step>

  <Step title="Find your Zone ID and Account ID">
    The **Zone ID** is on the zone's overview page; the **Account ID** is on your account home page.
  </Step>
</Steps>

<Tip>
  Prefer least privilege: grant read-only permissions first, and add edit scopes only when you want the agents to apply changes.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Cloudflare WAF**, then fill in:

| Field           | Description                                                                                                |
| --------------- | ---------------------------------------------------------------------------------------------------------- |
| **Name**        | A unique name for this Cloudflare WAF instance.                                                            |
| **Description** | Optional note to identify the zone or account.                                                             |
| **API Token**   | The Cloudflare API token (Bearer) from Step 1.                                                             |
| **Account ID**  | Your Cloudflare account ID (for account-scoped WAF ops: lists, managed rulesets).                          |
| **Zone ID**     | Your Cloudflare zone ID (required for zone WAF rules and events).                                          |
| **API URL**     | The Cloudflare API base URL (default `https://api.cloudflare.com/client/v4`).                              |
| **Collector**   | The [Collector](/documentation/agent-endpoint-security/collector-mode) that will reach the Cloudflare API. |
| **Auth Type**   | Authentication method (preset to `bearer` — do not change).                                                |

## Connect

Click **Connect** to validate the token and finish. The Cloudflare WAF then appears under **Environment → Integrations**, and you can start asking [Hydra](/documentation/multi-agent-system/integration-specialist-agent) about it in the Workspace.

<Note>
  Your API token is stored securely and resolved server-side — it never passes through the AI, and Myrmex queries Cloudflare on demand rather than storing its data.
</Note>