A steward for your Cloudflare fleet.
Forty zones, six clients, one support queue. Ask in plain language, approve the fix, read the audit. Nothing writes without you.
Your keys, at cost.
Your Cloudflare token and your model key. Usage is billed to you by the provider, never marked up. A busy month is a few dollars.
TimeAnswers in a sentence.
“Why is client.com slow in Germany?” comes back as prose and a chart, not an afternoon of GraphQL.
RiskNothing writes without you.
Every change is a card: impact class, blast radius against real traffic, read-back, one-click revert.
ClientsSomething to send the client.
A share link to their sites, a printable seven-day digest, an incident report.
TrustEverything on the record.
Every proposal, approval and revert in the audit trail. Sign in with Google, Microsoft, GitHub or an emailed link.
Every role that touches a zone has its own page. Pick yours.
Structurally unable to touch your zones.
Not a policy, not a system prompt. Every function that can change Cloudflare is reachable from the execution core alone, so a prompt injected through a request path or a user agent cannot cause a write.
- Impact classified before you see it
Low, medium or high, decided on the server. A lockdown or an apex DNS deletion needs an acknowledgement, not a click.
- Blast radius against real traffic
The rule is run against your last 24 hours before it exists — paths, networks, countries, user agents — so you see what it would have matched.
- Read back from Cloudflare
“Applied” means the server asked Cloudflare what the setting is now and got the answer it expected.
- Reversible, with the payload stored
Every change lands in the audit trail with the instructions to undo it. One click.
Six things an agency does with it, on real screens.
Every screen below is the product as it runs. Click any plate to see it full size.
Ask the question the client asked you.
- “Is it down?”, “Why is it slow?”, “Who is attacking us?” — answered from Cloudflare’s own analytics, as prose with a chart.
- The query sits beside the answer: Viz, Table, GraphQL, JSON. Nothing is hidden behind the summary.
- Save it, and ask it again Monday. Every answer shows what it cost, under the answer.
Ranked, categorised, one click from a challenge.
- Every source scored and sorted into nine categories, with its country and network beside the address.
- Block or challenge is a proposal — it goes through the approval card like everything else, with the blast radius counted.
- Auto-mitigation exists, and is off until you turn it on.
Describe what would worry you. It writes the rule.
- Query, threshold, window and minimum volume, written from one sentence and explained back to you in English.
- Dry-run against live traffic before it’s armed — a rule that errors or yields no number is refused.
- Email, Slack, Microsoft Teams, PagerDuty, SMS and signed webhooks.
A dashboard for the wall. A chart for any question.
- Status mix, countries, networks, bandwidth, open incidents and the fleet globe — live, on one screen.
- Nineteen chart kinds — twelve flat (bars, lines, areas, pies, scatter, histograms, tables, big numbers and more) and seven in 3D, including a globe and a country map. The model proposes up to four for each answer, each with its reason; switch with a click, or ask for fresh ones.
- Saved charts become dashboard widgets that re-query every minute. Arrange them once and leave it on a screen.
One card for a whole client group. One link per client.
- Group zones by client. A purge, a WAF rule or a rate limit goes to the whole group on one approval card, applied and audited zone by zone.
- A share link per client — read-only, all their sites or just one, expiring within 30 days — revocable the moment you need it to be.
- A seven-day digest and incident reports, printable, with CSV for every table.
Your token. Your model key. Nothing marked up.
- A wizard scopes the Cloudflare token to exactly what you allow. Anthropic, OpenAI or an OpenAI-compatible endpoint for the model. Both stored encrypted.
- Every model call itemised — feature, model, tokens in and out, cost — and the cost shown under each answer.
- Billed to you by the provider, at cost. We don’t sell tokens and we don’t mark them up. A busy month is a few dollars.
What it can read, what it can change, what it connects to.
What it can read — everything Cloudflare knows about a zone, not just traffic
- Edge certificates and expiry
- DNSSEC, down to the DS record
- Universal SSL
- Tiered Cache
- Cache Reserve
- Argo Smart Routing
- Health checks and why they failed
- Load balancers with pool and origin health
- Logpush jobs, last push, errors
- Web Analytics (RUM) setup
- Cloudflare’s own notification policies
- Zone status, nameservers, zone hold
- Waiting rooms with live queue
- Observatory results
- Turnstile widgets
- Workers routes
- Access applications
- Email Routing rules
What it can change — always through an approval card, never on its own
- WAF custom rules, cache rules and rate limits
- DNS records
- Zone settings and features
- IP access rules and lockdowns
- Managed rulesets
- Health checks and waiting rooms
- Cache purge, by URL
- Pausing a zone
- Any of the above across a zone group, on one card
What it connects to — your accounts, your keys, your channels
- Cloudflare — any number of tokens, any number of accounts
- Google Analytics 4
- Anthropic, OpenAI, or an OpenAI-compatible endpoint you host — your own key, billed to you at cost
- Email: Resend, SendGrid, Mailgun or SMTP
- Slack
- Microsoft Teams
- PagerDuty
- SMS via Twilio
- Signed JSON webhooks
- Microsoft
- GitHub
- An emailed link
Every credential is stored encrypted and used only for your workspace. Security →
Priced per workspace, by zones.
Every tier includes everything. No security feature is held back for a higher plan.
| Plan | From general availability | Included |
|---|---|---|
| Studioup to 25 zones | $49/mo | 3 members. Chat, globe, investigation, approvals, audit, alerts. |
| Agencyup to 100 zones | $149/mo | 10 members. Everything in Studio, plus client share links. |
| Fleet100+ zones | Talk to us | Unlimited members. Everything, plus priority support. |
Free during the beta, then 50% off your first year, locked. Runs on your own Cloudflare token and model key — Anthropic, OpenAI or a compatible endpoint — billed to you by the provider at cost. We do not mark it up.
The beta: free for you, honest feedback for us.
Zonesteward is built and in daily use, but unfinished — no public sign-up, no billing, parts still being reworked. Twenty agencies with real fleets get it free and help finish it. Here's the trade.
- Free for the whole beta
- Half price for your first year, locked
- A direct line to the person building it
- Three questions a month, in the app
- Two twenty-minute calls: month one, month three
- Your honest feedback