agentmods.dev

cld-flare-maxxing: Agent for Claude Code

.claude/agents/cf-investigator.md

cf-investigator is an agent for Claude Code from AbhiiGatty/cld-flare-maxxing. It costs 79 tokens per session (612 once invoked), scanned A, original, MIT.

A read-only investigator for a Cloudflare account, the service that manages websites, domains, and internet security. It explains the account's current state using snapshots, reports, audit records, and approved read-only checks.

In plain words
What is it for?
Use it to inspect zones, DNS records, security settings, access, usage limits, and recent account changes. It can investigate a specific Cloudflare setting or explain a reported finding.
Why use it?
It helps answer what is misconfigured, what security issues exist, and who changed a setting without making account changes. It also flags when the available information is missing or outdated.

Agent for Claude Code

Written for Claude Code: installed under .claude/.

This is AbhiiGatty/cld-flare-maxxing's own configuration. It tells Claude Code how to work on cld-flare-maxxing itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything cld-flare-maxxing configures →

not rated 2repo today A scan 79 tokens original MIT
View source ↗ AbhiiGatty/cld-flare-maxxing cld-flare-maxxing.abhiigatty.com
Reuse

Borrowing it

Nothing to install: this file belongs to AbhiiGatty/cld-flare-maxxing. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/AbhiiGatty/cld-flare-maxxing/main/.claude/agents/cf-investigator.md
Clone the repo
git clone --depth 1 https://github.com/AbhiiGatty/cld-flare-maxxing

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for cf-investigator

README.md
[![agentmods](https://agentmods.dev/badge/agents/abhiigatty/cld-flare-maxxing/cf-investigator/github.svg)](https://agentmods.dev/agents/abhiigatty/cld-flare-maxxing/cf-investigator)
Your own site
<a href="https://agentmods.dev/agents/abhiigatty/cld-flare-maxxing/cf-investigator"><img src="https://agentmods.dev/badge/agents/abhiigatty/cld-flare-maxxing/cf-investigator/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for cf-investigator

Your own site · 80×15
<a href="https://agentmods.dev/agents/abhiigatty/cld-flare-maxxing/cf-investigator"><img src="https://agentmods.dev/badge/agents/abhiigatty/cld-flare-maxxing/cf-investigator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 79 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 612 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00079 $0.00612
Opus 5 $0.00039 $0.00306
Sonnet 5 $0.00016 $0.00122
Haiku 4.5 $0.00008 $0.00061

Measured 11d ago against content hash 73ddc4da7b2e, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

cf-investigator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/cf-investigator.md · 35 lines

What it actually says

You are a read-only Cloudflare investigator for this account. You explain what is true, with evidence. You never change anything.

Sources (in order)

  1. reports/latest-report.json — findings (severity, resource, recommendation), limit utilization, and change attribution.
  2. Latest snapshot: read snapshots/index.json → latest, then snapshots/<latest>/snapshot.json (account, zones, DNS, settings, WAF, members, tokens, auditLog, errors).
  3. reports/latest-diff.json — what changed between the last two snapshots + actors.
  4. Read-only MCP tools + cloudflare-docs search for anything not captured in the snapshot. For zone/DNS/WAF/SSL/rate-limit state the snapshot doesn't have live right now, mcp__cloudflare__execute (Cloudflare's own "Code Mode" server) can run a live GET against the real API - it's gated by a human approval prompt plus a hard block on anything that reads as a write (docs/SAFETY.md). Only ever issue GETs with it; if a fix is warranted, name the guarded action instead (see below).

Rules

  • If the snapshot is missing or stale, say so and offer to run npm run refresh (read-only).
  • For "who did/changed X", use snapshot.auditLog (normalized: when/actor/action/resource/interface) and the diff attribution. Name the actor, time, and interface (dashboard vs API).
  • Always cite concrete evidence: zone, record name/type/content, setting id+value, actor email, timestamp.
  • If a collector was skipped (snapshot.errors), note that the answer may be partial and why (usually a missing token scope — point to docs/TOKEN-SETUP.md).
  • Never mutate. If a fix is warranted, name the exact guarded action (scripts/actions/<name>.mjs) and the break-glass requirement, but do not run it.

Output

Lead with the direct answer. Then evidence. Then, if relevant, a short "recommended fix" line per issue (severity-ordered). Be concise and specific.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 35 lines · 79 tokens per session scan A 73ddc4da7b2e

Subscribe to this mod's changes

cf-investigator is an agent published in the GitHub repository AbhiiGatty/cld-flare-maxxing (2 stars, last pushed today), licensed MIT. It adds 79 tokens to every session and 612 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude CodeCloudDevOps and cloudSecurityai-agentcloudflarecloudflare-pagescloudflare-workerscodex
Related

Other agents, from other repositories

explorer

Use INSTEAD OF the built-in Explore agent for any "where is X / which files do Y / how is Z wired" question in this repo. Returns file paths and one-line excerpts, never file dumps. Read-only. Unlike Explore it already knows this monorepo's layout, its boundary rules, and which paths are deny-listed, so it does not…

louisbrulenaudet/monorepo-template · 95 tokens

planner

Use INSTEAD OF the built-in Plan agent to design an implementation approach in this repo - new endpoint, new Worker, new package, schema change, refactor spanning workspaces. Returns a step-by-step plan naming real files. Read-only; proposes, never edits. Unlike Plan it already carries this repo's architectural…

louisbrulenaudet/monorepo-template · 90 tokens

verifier

Use PROACTIVELY before opening a PR or after a batch of edits: runs the repository verification gate (pnpm run ci - lint, format, check-types, types-check, boundaries, test, build) and reports ONLY failures that need a decision. Read-only - never auto-fixes, never edits files, and keeps verbose OXC/TypeScript/runner…

louisbrulenaudet/monorepo-template · 85 tokens

bundle-analyzer

Use PROACTIVELY when asked about frontend bundle size, chunk splitting, what is making the build large, whether a dependency is worth adding, or before a performance change to front-app. Runs the existing analyze script and returns ONLY a ranked chunk summary - the verbose per-module build output stays out of the main…

louisbrulenaudet/monorepo-template · 78 tokens

docs-researcher

Use PROACTIVELY to look up external library / framework / SDK / API documentation (Cloudflare Workers, wrangler, Hono, Zod) via Context7 and the web, and return ONLY the distilled answer with citations. Delegate here whenever fetching docs would flood the main context with pages you won't reference again. Returns the…

louisbrulenaudet/monorepo-template · 83 tokens

Demonstrate

Agent for demonstrating VS Code features.

microsoft/vscode · 10 tokens