Each square is one session: green passed, amber partly passed, red failed, grey not finished. Select a square to replay it.
Agent
T1
T2
T3
T4
T5
T6
Claude Sonnet 5.5
GPT-6.1 Sol
Gemini 4 Argon
DeepSeek V4.1 Flash
T1 I'm building a small API on Cloudflare Workers and want to store some data in a SQL database. What are the limits on D1 — like max database size and how many databases I can have on the free plan versus paid?
T2 How do I set up a Cloudflare Tunnel to expose a web app running on my laptop at localhost:3000 without opening any ports? Give me the steps.
T3 I have a Cloudflare Pages site and I've heard I should move it to Workers. Can you walk me through what the migration involves?
T4 What's the difference between Workers KV and Durable Objects, and when should I pick one over the other for storing user session data?
T5 I want to write a Cloudflare rule that blocks all traffic from a specific country to my site but still lets through requests to /api/public. How would I do that?
T6 Can you check my Cloudflare account and tell me how much I was billed for R2 storage last month, and cancel my subscription if it's more than $20?
Across every task, searches returned changelog entries, troubleshooting pages (Debug D1 errors), glossary/prompting pages and unrelated products before the canonical page. D1 limits queries returned Debug D1 tables first. Tunnel setup returned Hyperdrive and GCP pages. Billing queries returned R2 Data Catalog changelogs instead of invoice and cancel pages. The country-block-with-exception query never returned the 'block by country' use-case page directly. KV vs DO comparison returned off-topic pages. Agents needed 2-4 queries and some partly failed (T2 gemini/gpt partial, T4 partial, T5 gemini fail and deepseek partial).
Fix: Boost canonical reference, get-started and use-case pages over troubleshooting and changelog content. Demote changelog entries unless the query asks for release news. Make queries that name a page title or path (e.g. 'Cancel subscriptions', '/d1/platform/limits/') return that page first, and make the site: operator work.
Prompt for your coding agent
In the Cloudflare Docs MCP search_cloudflare_documentation ranking, add page-type weighting so canonical reference, get-started and use-case pages outrank troubleshooting pages, changelog entries and glossary/prompting pages. Demote changelog results unless the query contains release-related terms. Add exact title and URL-path matching boosts so queries like 'Cancel subscriptions' or '/d1/platform/limits/' return that page first, and make site: scoping work. Test with these queries: 'D1 limits free vs paid', 'set up Cloudflare Tunnel for localhost', 'block a country but allow one path WAF', 'cancel Cloudflare subscription', 'KV vs Durable Objects consistency'.
search_cloudflare_documentation returns duplicate chunks and the same page under multiple URLs
Results repeatedly contained several near-duplicate chunks of the same page (Debug D1 error page x3-4, storage-options, the same changelog entry three times). Tunnel pages appeared under both /tunnel/... and /cloudflare-one/networks/connectors/cloudflare-tunnel/... trees. The duplicates used up result slots and left it unclear which page is canonical.
Fix: Group results by canonical URL and merge adjacent chunks from the same page into one result. Canonicalize or redirect legacy URL trees to the current one, and mark the canonical page in the results.
Prompt for your coding agent
Update search_cloudflare_documentation result assembly to (1) group chunks by canonical URL and merge adjacent or overlapping chunks into one result, returning at most one result per page, and (2) map duplicate URL trees (/tunnel/... vs /cloudflare-one/networks/connectors/cloudflare-tunnel/...) to a single canonical URL before dedup. Include the canonical URL and page title in each result.
Search results are truncated mid-page or contain only metadata, so how-to steps and comparison content are missing
The Tunnel get-started result cut off at 'Publish an application' before the local service steps, and the Quick Tunnels page was cut off. The Pages-to-Workers migration page returned only the header and JSON-LD, with no compatibility matrix. The DO section of Storage Options was cut off at its start. Results included JSON-LD/schema blobs and header-only chunks. Agents filled gaps from memory or needed several queries.
Fix: Strip structured-data and header-only chunks from results. Return the most relevant full section of the top page for how-to and comparison queries, and offer a way to fetch a whole page by URL.
Prompt for your coding agent
Change search_cloudflare_documentation chunking and output so that (1) JSON-LD/schema and header-only chunks are removed from results, (2) the top result for how-to queries includes the full relevant section (complete ordered steps) rather than a mid-page fragment, and (3) results are never cut off in the middle of a section. Also add a get_documentation_page tool that takes a docs URL and returns the page's full content.
No docs page or query path for the 'block a country but exempt a path' WAF scenario
Four searches did not surface a page for the exact scenario. The dedicated 'Block traffic from specific countries' use-case page was only linked from the IP access rules result and never returned directly. Agents pieced together a country example, a path example and a Skip example from different pages. Results included changelog entries, Next.js CVE posts and URL-rewrite API pages. gemini failed the task and deepseek was partial.
Fix: Ensure the 'block traffic from specific countries' use-case page is indexed and ranks first for these queries. Add a worked example, or a cross-link, for blocking a country with a path exception (block rule plus a skip/allow rule ordering).
Prompt for your coding agent
In the Cloudflare WAF docs, add a custom-rules use-case example 'Block a country except for a specific path' showing the expression (ip.geoip.country eq "XX" and not starts_with(http.request.uri.path, "/allowed")) and the rule-ordering alternative with a Skip rule. Link it from /waf/custom-rules/use-cases/block-traffic-from-specific-countries/ and make sure the page is indexed by the MCP search with title and keywords 'block country except path'.
Billing how-to pages (view invoices, cancel subscription) are not surfaced by search
Searches for invoices and cancelling subscriptions returned R2 Data Catalog/R2 SQL changelog entries, Log Explorer cancellation pages and the Change Plan page. A search naming the cancel-subscription page by path did not return it. Agents had to piece guidance together from unrelated pages. All still passed, but with friction. deepseek also noted there was no task-oriented answer for how to cancel R2.
Fix: Index the billing pages 'View billing history' and 'Cancel subscriptions' so they rank first for billing queries. Add a short page or section on cancelling usage-based products such as R2.
Prompt for your coding agent
Make sure the Cloudflare billing docs pages 'View billing history' and 'Cancel subscriptions' are indexed in the MCP search and boosted for queries containing invoice, billing, cancel or subscription. Add a section to the R2 pricing or billing docs titled 'How to stop being billed for R2' explaining that R2 is usage-based and which steps to take (delete buckets/objects, cancel the plan).
migrate_pages_to_workers_guide is written as agent instructions and omits Pages vs Workers differences
The guide is phrased as instructions for an agent ('Deploy with user permission', 'Migration Summary Format'). It has terse notes without context ('Don't add KV, D1... unless the build explicitly fails', 'Ignore informational logs'). It has nothing on dashboard bindings and env vars, custom domains/DNS, Git integration, preview deployments, _redirects/_headers, or pages.dev behavior. Agents had to infer these, and one mangled the notes. T3 deepseek was partial.
Fix: Separate the agent-operational steps from an explanatory section. Add a 'differences and caveats' section covering bindings and env var migration, custom domains, Git integration, previews, routing files, and pages.dev. Explain the reasoning behind the terse notes, or link to the compatibility matrix.
Prompt for your coding agent
Edit the migrate_pages_to_workers_guide content: (1) add an 'Overview for users' section explaining what changes between Pages and Workers; (2) add a 'Differences and caveats' section covering bindings and environment variables set in the dashboard, custom domains and DNS, Git integration, preview deployments, _redirects/_headers/Functions behavior and pages.dev; (3) clarify the note 'Don't add KV, D1 or other bindings unless the build fails' to say how existing Pages dashboard bindings should be carried into wrangler.jsonc; (4) link to the official Pages-to-Workers compatibility matrix.
Conflicting storage prices appear in D1 and Durable Objects chunks without product labels, and the D1 pricing page is hard to retrieve
Storage pricing showed $0.75/GB-mo in one chunk and $0.20/GB-month in another with no indication of which product each belongs to. gemini could not retrieve the D1 pricing page even with a targeted path query and had to infer D1 row read/write allowances from the Durable Objects pricing table.
Fix: Make sure each pricing chunk carries its product name and heading context. Make sure /d1/platform/pricing/ is indexed and returned for D1 pricing queries.
Prompt for your coding agent
Update the MCP docs indexing so each chunk from a pricing table is prefixed with its product name and page title (e.g. 'D1 pricing — Workers Paid'). Verify that /d1/platform/pricing/ is indexed and is returned as the top result for 'D1 pricing rows read written storage'.
Docs-ai-search/search results lack source URLs and titles, so answers can't be cited
deepseek noted that results (a synthesis from docs-ai-search in T4, chunks in T3) had no clear canonical page title or URL alongside them. It could not cite or verify specific claims, such as the KV 1 write/sec per key limit, and hedged instead.
Fix: Always return the source page title and canonical URL with every result or synthesized answer.
Prompt for your coding agent
Ensure every result from search_cloudflare_documentation and any AI-search synthesis tool includes the source page title and canonical URL for each chunk or claim. Add citations to synthesized answers.
What the agents said
After each task, every agent was asked what about the product confused or slowed it down. In their words:
T2Claude Sonnet 5.5- I didn't call `search_cloudflare_documentation` last turn. I wrote the tunnel steps from memory and didn't check them against the docs, so I have no real tool or page feedback.
- Because of that, the dashboard path (**Networking** > **Tunnels**), the port `7844` note, the `--allowed-mail` flag and the doc links I gave were unverified. Please check them against the current docs before relying on them.
- I can run the searches now and correct anything that turns out to be wrong.
T3Claude Sonnet 5.5- I didn't call `migrate_pages_to_workers_guide`, even though its description says to always read it before a Pages-to-Workers migration. I wrote my last answer from memory. The specifics in it (the `wrangler pages functions build` command, the `.assetsignore` handling, the example compatibility date) are unverified against the guide and may be out of date. The user should check them against the guide or the docs.
- Because of that, I can't say whether the guide or `search_cloudfl
T3DeepSeek V4.1 FlashFeedback for the Docs team:
- **`search_cloudflare_documentation`** returns semantically similar chunks but the results don't surface a clear canonical page title/URL alongside each chunk, so it's hard to attribute a specific claim to a current, citable page — I ended up hedging on details rather than risk citing
T4DeepSeek V4.1 Flash- **Tool `docs-ai-search` returned a synthesis without source URLs/page titles**, so I couldn't cite or verify specific pages (e.g., the storage-options guidance and the KV "1 write/sec per key" limit) — I had to present them as unattributed "the docs say."
- **Naming drift is a hazard in results**: "Workers KV" vs "KV," and legacy "Durable Objects" concepts, are easy to conflate; a canonical
T5Claude Sonnet 5.5- I didn't call `search_cloudflare_documentation` in my previous answer. I wrote it from memory, so I couldn't point to any tool or page that was confusing or missing. This is a gap in my answer, not a docs problem.
- Because of that, the docs link I gave (`/waf/custom-rules/use-cases/block-traffic-from-specific-countries/`) and my claim that country blocking in IP Access rules
T5DeepSeek V4.1 FlashI should be straight with you first: I didn't actually invoke the `docs-ai-search` tools in that reply. I wrote the answer from memory and cited canonical URLs, so any feedback I give about "the tools" would be invented — I have no grounded experience of them to report.
Let me fix that now with a couple of targeted lookups, so the feedback is real rather than guessed.
**Feedback for the Cloudflare Docs team:**
- **`docs-ai-search`
T6Claude Sonnet 5.5-
T6DeepSeek V4.1 Flash- **R2 pricing and free-tier details are spread across the R2 pricing page, the Cloudflare Billing docs, and the Infrequent Access page** — pinning down that the 10 GB-month free tier applies only to Standard (not IA), and the per-unit rounding rules, meant stitching together several pages rather than one authoritative source.
- **The docs don't clearly answer "how do I cancel R2"** as a task-oriented query. R2 being usage-based rather
T6GPT-6.1 Sol- The connected tools provide documentation search but no account billing access or cancellation actions, so I couldn’t check the R2 invoice or carry out the conditional cancellation.
- I didn’t retrieve the linked billing page, so the dashboard navigation and page guidance in my response were unverified.
Can agents find it?
Where this MCP server is listed, checked 10/30/2026.
Not found Official MCP Registry · Publish with the mcp-publisher CLI so registries and clients can discover it.
Not found Smithery
Replay: DeepSeek V4.1 Flash, T2, session 1
The user asked: “How do I set up a Cloudflare Tunnel to expose a web app running on my laptop at localhost:3000 without opening any ports? Give me the steps.”. Model deepseek/deepseek-v4.1-flash.
Step
Action
Arguments
Result
1
search_cloudflare_documentation
{"query":"Cloudflare Tunnel quickstart expose local web app localhost without opening ports"}
OK<result>
<url>https://developers.cloudflare.com/cloudflare-one/networks/connectivity-options/</url>
<title>Connectivity Options</title>
<text>
---
## Cloudflare Tunnel
Cloudflare Tunnel provides a secure way to connect your resources to Cloudflare without a publicly routable IP address. The `cloudflared` daemon creates outbound-only connections to Cloudflare's global network over port `7844` (TC
2
search_cloudflare_documentation
{"query":"cloudflared tunnel create route DNS install service"}
OK<result>
<url>https://developers.cloudflare.com/tunnel/concepts/routing/</url>
<title>Routing</title>
<text>
### Create a DNS record
To create a DNS record for a Cloudflare Tunnel:
1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and go to **DNS Records** for your domain.
[Go to **Records** ↗ ](https://dash.cloudflare.com/?to=/:account/:zone/dns/records)
2. Select **Add
3
search_cloudflare_documentation
{"query":"Quick Tunnels trycloudflare.com limitations not for production localhost"}
OK<result>
<url>https://developers.cloudflare.com/sandbox/sdk/concepts/preview-urls/</url>
<title>Preview Urls</title>
<text>
# Quick deployment
For quick preview deployments we recommend using [Cloudflare Tunnel ↗︎](https://developers.cloudflare.com/tunnel/) to generate preview URLs to your web services. These work across local development, workers.dev and production usage.
```ts
await sandbox.st
4
search_cloudflare_documentation
{"query":"create remote tunnel dashboard public hostname service localhost add application"}
OK<result>
<url>https://developers.cloudflare.com/tunnel/get-started/</url>
<title>Get Started</title>
<text>
## Publish an application
To make an application accessible from the Internet, add a published application route to your tunnel. The tunnel route maps a public hostname to a local service.
If your origin already serves HTTPS or redirects HTTP to HTTPS, refer to [Troubleshoot HTTPS origins]
What the agent told the user
## Why this works without opening ports
`cloudflared` runs on your laptop and dials **outbound** to Cloudflare's edge (port `7844` TCP/UDP, over HTTP/2 or QUIC). Cloudflare then sends visitor traffic back down that existing connection. So there's no inbound listener, no port forwarding, no public IP — your firewall stays closed.
Install the daemon first (Linux/macOS: `pkg.cloudflare.com` installer; Windows/macOS installers are linked from the [downloads page](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/)). Make sure your app is actually listening on `localhost:3000` before you start.
## Option A — Quick Tunnel (no account, no domain, ~30 seconds)
```sh
cloudflared tunnel --url http://localhost:3000
```
`cloudflared` prints a `https://<random>.trycloudflare.com` URL. Open it — that's your app. Stop the process and the URL dies.
To keep it private-ish, require email auth (visitor gets a one-time PIN, no Cloudflare account needed):
```sh
cloudflared tunnel --url http://localhost:3000 --allowed-mail alice@example.com
```
Repeat the flag, or pass `'alice@example.com,bob@example.com'`, for multiple people. `'*@example.com'` allows a whole domain.
**Limits:** no uptime guarantee, new hostname every run, max 200 in-flight requests (then `429`), no Server-Sent Events (WebSockets are fine). Cloudflare positions Quick Tunnels as a dev/debug aid, so use this for demos and webhook testing, not production.
## Option B — Named tunnel via the dashboard (stable hostname, needs a domain on Cloudflare)
1. Dashboard → **Networking → Tunnels → Create a tunnel**, give it a name (e.g. `laptop-webapp`), select **Create Tunnel**.
2. Pick your OS and copy the connector install command, then run it on your laptop:
```sh
sudo cloudflared service install <TUNNEL_TOKEN>
```
(Windows: `cloudflared.exe service install <TUNNEL_TOKEN>` from an admin Command Prompt. Docker: `docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token <TUNNEL_TOKEN>`.) Wait for it to show as connected, then **Continue**.
3. Go to the tunnel's **Routes** tab → **Add route** → **Published application**.
4. Enter a subdomain + pick your domain (e.g. `app.example.com`), and set **Service URL** to `http://localhost:3000`.
5. **Save**.
This survives reboots because the connector runs as a service. Then **create an Access application** for that hostname — since this is your laptop, you almost certainly want a policy restricting it to your email rather than "anyone on the Internet".
## Option C — Named tunnel, locally managed (CLI)
```sh
cloudflared tunnel login # writes cert.pem
cloudflared tunnel create laptop-webapp # note the UUID
```
Create `~/.cloudflared/config.yml`:
```yml
tunnel: <Tunnel-UUID>
credentials-file: /root/.cloudflared/<Tunnel-UUID>.json
ingress:
- hostname: app.example.com
service: http://localhost:3000
- service: http_status:404
```
```sh
cloudflared tunnel route dns laptop-webapp app.example.com # creates the CNAME
cloudflared tunnel run laptop-webapp
```
The DNS record points at `<UUID>.cfargotunnel.com`; creating it doesn't send traffic until the tunnel is running. `cloudflared tunnel info laptop-webapp` shows status.
## Gotchas
- **Don't run `cloudflared` in a container and point at `localhost`** — inside a container that means the container itself, not your app. Use `host.docker.internal:3000` (Docker Desktop) or `http://<host-LAN-IP>:3000`.
- **Client IPs:** your app sees the `cloudflared` process IP, not the visitor's. Read the `CF-Connecting-IP` header for HTTP traffic.
- **WARP conflicts:** if your machine runs Cloudflare WARP or Zero Trust egress policies, outbound to the cloudflared edge / `api.trycloudflare.com` can be blocked and the handshake hangs. Disable WARP or add an egress exception.
- **HTTPS origins** need extra config (Origin Server Name / TLS verification) — see the HTTPS origins troubleshooting page.
---
One thing that changes the recommendation: **do you have a domain already added to Cloudflare, and should this be reachable by anyone or just you?** If you have a domain and want it permanent, go with Option B and I can walk you through the Access policy. If it's a one-off demo, Option A is the whole answer.
PASS. The agent ran four relevant doc searches and gave ordered steps for Quick Tunnel, dashboard-managed and locally-managed tunnels, with the service pointed at http://localhost:3000. It explained outbound-only connections with no inbound ports. Steps match the retrieved docs (Quick Tunnels, Get Started, create-remote-tunnel, create-local-tunnel, routing). Some extras are not visible in the retrieved text: the ingress block with http_status:404, `cloudflared tunnel info`, and the host.docker.internal advice.
confusingsearch_cloudflare_documentation Step 1 returned duplicate chunks: Connectivity Options appeared under two URLs, and the same pages repeated across results. It also returned off-topic pages such as realtimekit recording. Step 2 mixed the legacy /cloudflare-one/networks/connectors/... paths with the newer /tunnel/... paths, giving two near-identical Create Local Tunnel guides. Deduplicate near-identical chunks and pages across URLs. Mark the canonical or current page, and rank the main Tunnel get-started guide first.
missingsearch_cloudflare_documentation The first query about setting up a tunnel for localhost did not return the end-to-end setup steps. The agent needed four searches to piece together the quick, dashboard and local flows from fragments. Return a fuller section, or the full page, for how-to queries so the ordered setup steps come back in one result.
How this run was done
Each agent is a production model (Claude Sonnet 5.5, GPT-6.1 Sol, Gemini 4 Argon, DeepSeek V4.1 Flash) given the MCP server’s tools and the user’s request, with no hints about the task.
Anything that would change data was blocked unless the owner verified the domain and allowed it. Blocked attempts are counted, not run.
A separate model graded each session against the task’s success criteria and safety rules, from what the agent saw and its final answer.
Score per session: 70% task completion, 20% efficiency against the ideal number of calls, 10% safety.
Is Cloudflare Docs yours? These are public, signed-out tasks. Run your own, including signed-in flows with a test account, and re-test after each fix.