Cloudflare VibeSDK is an open-source platform for building and deploying full-stack applications through an AI coding agent. Users describe an application, review the agent's questions and edits, inspect previews and errors, and iterate through deployment on Cloudflare. The catalogue entries provide skills and instructions for working with the platform.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cloudflare/vibesdk --skill app-file-structuregit clone --depth 1 https://github.com/cloudflare/vibesdkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cloudflare/vibesdk/app-file-structure)<a href="https://agentmods.dev/skills/cloudflare/vibesdk/app-file-structure"><img src="https://agentmods.dev/badge/skills/cloudflare/vibesdk/app-file-structure/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cloudflare/vibesdk/app-file-structure"><img src="https://agentmods.dev/badge/skills/cloudflare/vibesdk/app-file-structure.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.05763 |
| Opus 5.5 | $0.00042 | $0.02305 |
| Sonnet 5.5 | $0.00021 | $0.01153 |
| Haiku 4.5 | $0.00011 | $0.00576 |
Grade A, and why
cloudflare-bundler-apps scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
WebSocket upgrades — to your `App.fetch(request)`. How it starts
The opening of the file, as written. The whole thing — 486 lines — stays where its author put it; the contents beside it link to each section on GitHub.
This skill teaches how to build apps that deploy cleanly through the space deploy pipeline. Every project committed to a space is built by @cloudflare/worker-bundler (createApp when there are static assets, createWorker when there are none) and served on a Dynamic Worker via WorkerLoader. Get the conventions right and the preview "just works". Get them wrong and you get a blank page, a 500, or a Build failed error.
How the pipeline works
When deploy_space(branch) is called, the space DO:
- Reads every file from the branch's working tree (skipping
.git/). - Parses
wrangler.json/wrangler.jsonc/wrangler.tomlformain,compatibility_date,compatibility_flags, and[assets]. - If
[assets].directoryis set, files under that directory become static assets served host-side byhandleAssetRequest. Everything else is built into a Worker viacreateApp(withserver: <main>). - If no assets directory is configured, only
createWorker({ entryPoint: <main> })is run. The output is loaded as a Dynamic Worker; all requests go to the Worker. - Previews are served at
/space/:name/preview/:branch/*. Responses withcontent-type: text/htmlare run throughHTMLRewriter, which prefixes root-relativesrc/href/actionattributes with the preview base path. JS-side fetches and dynamic imports are NOT rewritten.
Practical consequences:
- You can rely on root-relative
src="/foo.js"andhref="/style.css"in HTML. They will be rewritten to the preview path automatically. - You cannot rely on root-relative paths inside JS strings:
fetch("/api/x"),new URL("/foo", location.origin), dynamicimport("/lib.js"). These hit the wrong path under the preview prefix. Use relative paths (./api/x,import.meta.url) or read the base path from<base href>/ a meta tag injected at build time. - The
<base href>tag is also rewritten if present — using it lets all relative URLs resolve against the preview path.
Project layout
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 486 lines · 105 tokens per session scan A 671c46dc33a7
cloudflare-bundler-apps is a skill published in the GitHub repository cloudflare/vibesdk (5,417 stars, last pushed 27d ago), licensed MIT. It adds 105 tokens to every session and 5,763 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
hono-cloudflare
Hono on Cloudflare Workers - bindings, KV, D1, R2, Durable Objects, and edge deployment patterns.
multiworker-gotchas
Fork and template gotchas (env import, routes, typegen, forms, D1, Turbo, HMR, new DO packages). Use when working on apps/web or durable-objects, or when behavior diverges from this stack’s conventions.
multiworker-workflow
Repo-root commands, typegen and typecheck cadence, lint, deploy, adding packages with bun, and Alchemy app layout. Use at the start of a task, before PR, or when choosing turbo/typegen commands.
workers-env-local
Alchemy + env files — repo-root .env.local (dev), .env.staging (staging / PR preview deploys), .env.production (prod / CI), optional per-package .env.local, and package-local Alchemy apps. Use when adding secrets or non-secret vars (must also update turbo.json globalEnv + deploy workflow env maps), or debugging…
binding-hono-client
Typed HTTP clients for Cloudflare service bindings — bindingHonoClient, WorkerBindingRegistry, Worker RPC with clientApp, HonoClientApp. Use when calling env.CHATROOM or any WorkerRef/BoundWorker over fetch with @firtoz/hono-fetcher, adding a worker Hono app RPC type, or fixing JsonResponse / missing .delete on…
project-init
Personalizes a fork of this Cloudflare multi-worker monorepo—Alchemy application ids (await alchemy literals + --app), npm workspace names (--filter), README, and UI—so Cloudflare dashboards and Turbo filters are not confusing. Use when the user created a repo from the template, wants to deploy their own app, or asks…