What can AI agents do with Cloudflare Observability through Ferentin?

Through Ferentin, agents can use Cloudflare Observability for log query, event search, telemetry field discovery, application debugging, worker introspection, worker source read and documentation search. Every call is checked against your Ferentin policies first.

How is Cloudflare Observability access secured?

Requests through the Cloudflare Observability integration are covered by OAuth 2.0 consent, per user authorization, dynamic client registration, PKCE and audit logging. These controls are applied by Ferentin, not by Cloudflare Observability, so they hold across every connected agent.

How do I connect Cloudflare Observability to Ferentin?

Open the Ferentin admin console, add Cloudflare Observability as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.

Is the Cloudflare Observability integration generally available?

Yes. The Cloudflare Observability integration is generally available on Ferentin, including the free tier.

Cloudflare Observability

Generally Available

With OAuth2 authorization granted, an AI agent can discover which telemetry fields exist, see their observed values, run filtered queries over Workers logs, and read the Worker's source — turning 'why is this Worker erroring?' into a concrete answer.

Cloudflare
Workers
Observability

Configure Cloudflare Observability Browse the 8 tools

Authentication: OAuth 2.0
Hosting: Vendor-hosted endpoint
Data actions: Read only
MCP tools: 8

How it works

Every agent request passes through Ferentin policy before it reaches Cloudflare Observability.

AI agentAsks for something
Ferentin policies
- OAuth 2.0 consent
- Per user authorization
- Dynamic client registration
- PKCE
Cloudflare Observability MCP serverAuthorized connection
Governed resultMasked, logged, returned

What agents can do

8 tools · you choose which ones agents may call

Every tool this server exposes. You choose which ones agents may call.

workers_list
workers_get_worker
workers_get_worker_code
query_worker_observability
observability_keys
observability_values
search_cloudflare_documentation
migrate_pages_to_workers_guide

Before you connect

OAuth (user mode) only — unlike the main Cloudflare API server, this endpoint does not accept a Cloudflare API token as a bearer credential.
Ferentin registers automatically via Dynamic Client Registration (RFC 7591) against https://observability.mcp.cloudflare.com/register; PKCE S256 and refresh tokens are supported.
Read-oriented: the server queries observability data, enumerates telemetry keys and values, and reads Worker source; it does not modify Workers or their configuration.
This server can read Worker SOURCE CODE (workers_get_worker_code). Treat its output as sensitive — Worker source routinely embeds internal hostnames, route logic, and occasionally inline secrets. Keep DLP inspection enabled.

4 more technical notes

Also bundles the two public Documentation tools (search_cloudflare_documentation, migrate_pages_to_workers_guide) and the 'workers-prompt-full' prompt, so a tenant connecting this server does not additionally need cloudflare-docs.
Worker logs frequently contain request data — headers, URLs, user identifiers, and anything the Worker logs itself. Keep DLP inspection enabled on this server and prefer narrow time ranges.
Requires Workers Logs to be enabled on the Worker being queried; a Worker with observability turned off returns no events.
Tool catalog captured live from the upstream on 2026-08-08 (8 tools, 1 prompt).

About Cloudflare Observability

Workers Observability is Cloudflare's built-in telemetry for Workers, capturing invocation logs and events that can be filtered and aggregated over a time range.

Website Developer docs

Frequently asked about Cloudflare Observability

What can AI agents do with Cloudflare Observability through Ferentin?: Through Ferentin, agents can use Cloudflare Observability for log query, event search, telemetry field discovery, application debugging, worker introspection, worker source read and documentation search. Every call is checked against your Ferentin policies first.
How is Cloudflare Observability access secured?: Requests through the Cloudflare Observability integration are covered by OAuth 2.0 consent, per user authorization, dynamic client registration, PKCE and audit logging. These controls are applied by Ferentin, not by Cloudflare Observability, so they hold across every connected agent.
How do I connect Cloudflare Observability to Ferentin?: Open the Ferentin admin console, add Cloudflare Observability as a new connection and authenticate with OAuth 2.0. You then choose which permissions and which tools your agents may use, and the connection goes live for everyone covered by your policies.
Is the Cloudflare Observability integration generally available?: Yes. The Cloudflare Observability integration is generally available on Ferentin, including the free tier.