{ "data": { "a": { "slug": "cloudflare-cli", "name": "Cloudflare CLI (cf)", "vendor": "Cloudflare, Inc.", "vendorUrl": "https://www.cloudflare.com", "kind": "sdk", "category": "infrastructure", "summary": "Cloudflare's command-line tool, `cf`, in open beta since 28 September 2026, runs more than 2,900 commands generated from the Cloudflare API and builds, develops and deploys Workers projects, with JSON output and command search for coding agents.", "url": "https://www.anchorterminal.com/tools/cloudflare-cli", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-cli.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-cli.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-cli.json", "dns": "cloudflare-cli.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/cf", "license": "MIT OR Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "cf" } ], "auth": "mixed", "authNotes": "`cf auth login` signs in with OAuth (device authorisation, or a localhost callback with `--no-device`), which a person approves in a browser, with `--scopes` to request a subset and named profiles bound to a directory. Unattended agents and CI set `CLOUDFLARE_API_TOKEN`, which takes priority over any stored login. The Global API Key is not supported. `cf cli search`, `cf docs search` and `--dry-run` need no credentials.", "pricing": "byo-plan", "pricingNotes": "Free under MIT OR Apache-2.0 with nothing to buy. Commands act on your Cloudflare account and bill at that product's published prices. Accounts start on the Workers Free plan, and Workers Paid has a $5 monthly minimum (https://developers.cloudflare.com/workers/platform/pricing/, checked 2026-10-17).", "priceSummary": "Your plan", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the cf docs, README or source (checked 2026-10-17). The CLI calls the Cloudflare API with an OAuth grant or API token.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 292384, "pypiWeekly": null, "asOf": "2026-10-17" }, "docsUrl": "https://developers.cloudflare.com/cf/", "llmsTxt": "https://developers.cloudflare.com/cf/llms.txt", "capabilities": [ "infra.cloudflare", "code.deploy", "code.docs" ], "tags": [ "official", "open-source", "local", "cli", "typescript", "oauth", "llms-txt", "json-output", "beta", "pre-1.0" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 65.1, "grade": "B", "agentReady": false, "rank": 394, "ranked": true, "rankOf": 1349, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 68, "payments": 50, "reliability": 48, "schema": 81, "security": 79, "transparency": 88 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -2, "negativeNotes": [ "Misleading claim, -2. The repository README and the launch post of 28 September 2026 say JSON output is \"pretty printed for humans and condensed for agents for maximum context savings\". The source has printed every result with `JSON.stringify(data, null, 2)` since the first public commit of 28 September, and the agents docs say JSON output is indented whether or not stdout is a terminal. Checked first-hand on 17 October 2026 and again on 2 November 2026, when the README line and the formatter were unchanged (https://github.com/cloudflare/cf/blob/main/README.md, https://github.com/cloudflare/cf/blob/main/packages/cli/src/lib/output.ts, https://blog.cloudflare.com/cloudflare-cf-cli-launch/, https://developers.cloudflare.com/cf/agents/)." ], "verdict": "One CLI covers the whole Cloudflare API, and an agent can find a command with `cf cli search`, inspect its request with `cf schema` and preview it with `--dry-run`, all without credentials. It is a beta (1.0.0-beta.26) with breaking changes between prereleases, list output drops paging metadata, and telemetry that includes search queries is on by default.", "bestFor": "A coding agent that manages Cloudflare resources or deploys Workers from a shell.", "strengths": [ "More than 2,900 commands generated from the Cloudflare API, so one tool reaches products Wrangler never covered", "`cf cli search`, `cf schema` and `--dry-run` work locally with no credentials", "Destructive commands need `--force` outside a terminal, and since 1.0.0-beta.15 exit 1 when it's missing", "OAuth with selectable scopes, OS keychain storage since 1.0.0-beta.19, scoped API tokens and per-directory profiles. The Global API Key is refused", "Dual MIT and Apache-2.0 licence, npm provenance attestations since 1.0.0-beta.4, and a documented telemetry policy" ], "weaknesses": [ "Beta at 1.0.0-beta.26, with output moved from stdout to stderr in 1.0.0-beta.20 and 1.0.0-beta.21 and other breaking changes between prereleases", "List output strips the API's `result_info`, so an agent can't see whether more pages exist", "Telemetry is on by default and records the text of `cf cli search` and `cf docs search` queries", "No automatic retry on 429 or 5xx (the API client sets `maxRetries: 0`), and no backoff guidance in the docs", "The agents docs still describe the old exit status 0 for an aborted delete" ], "agentNotes": [ "Run `cf cli search \"\u003ctask\u003e\"` with the task in quotes, then `cf schema \u003ccommand\u003e`, before guessing a command name", "Add `--dry-run` to any write first. It prints the request as JSON and needs no credentials", "Use `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` when no person is present. `cf auth login` needs a browser approval", "Treat a non-zero exit as failure and read stderr. Pass `--page` and `--per-page` yourself, since list output carries no paging metadata", "Keep search queries free of account IDs, domains and tokens, or set `CF_SEND_TELEMETRY=false`, because queries are sent in telemetry" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.1 } ], "editorialScores": { "ergonomics": 65, "maintenance": 68, "payments": 50, "reliability": 48, "schema": 81, "security": 79, "transparency": 80 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install --global cf", "headless": { "auth": "CLOUDFLARE_API_TOKEN=\u003ctoken\u003e CLOUDFLARE_ACCOUNT_ID=\u003caccount_id\u003e cf zones list", "docs": "cf docs search \"proxy a DNS record\"", "find": "cf cli search \"create D1 database\"", "inspect": "cf schema d1 create", "preview": "cf d1 create --name my-database --dry-run" } }, "letme": { "capability": "https://letme.dev/infra.cloudflare", "tool": "https://letme.dev/cloudflare-cli" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "developer", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/cf/blob/main/packages/cli/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-02", "notes": [ "Legal entity, domain date, terms and privacy follow the other Cloudflare listings' checks. We didn't re-read the terms or privacy policy for this listing.", "www.cloudflare.com/.well-known/security.txt, re-read on 2 November 2026, names HackerOne and a disclosure policy and carries no Expires field.", "The repository's .github/SECURITY.md holds only a beta warning, with no reporting route of its own.", "The software runs on the owner's machine and calls api.cloudflare.com. Telemetry goes to sparrow.cloudflare.com and `cf docs search` to ai-search.developers.cloudflare.com, per the source." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-cli.json", "live": { "slug": "cloudflare-cli", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-04T20:38:48.748468058Z" }, "versions": [ { "registry": "github", "name": "cloudflare/cf", "version": "cf@1.0.0-beta.27", "released": "2026-11-02", "seenAt": "2026-11-04T20:07:07.990845974Z" }, { "registry": "npm", "name": "cf", "version": "1.0.0-beta.27", "seenAt": "2026-11-04T20:07:05.92280647Z" } ], "githubStars": 995, "npmWeekly": 717327, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-04T15:53:57.155727072Z" }, "llmsTxt": { "url": "https://developers.cloudflare.com/cf/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:28.92895002Z" }, "domain": { "domain": "cloudflare.com", "registered": "2009-02-17", "source": "https://rdap.verisign.com/com/v1/domain/cloudflare.com", "checkedAt": "2026-11-01T14:18:56.122446983Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/cf/main/packages/cli/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-04T08:33:06.118412864Z", "changedAt": "2026-11-03T07:59:05.05784598Z", "fingerprint": "4d0199c3bd62" }, { "url": "https://developers.cloudflare.com/workers/platform/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-04T08:19:17.44033886Z", "changedAt": "2026-11-04T08:19:17.44033886Z", "fingerprint": "2dd58bf86869" } ], "github": { "repo": "cloudflare/cf", "checkedAt": "2026-11-02T08:39:50.277434199Z", "stars": 984, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T03:22:37Z", "openIssues": 83, "openPRs": 16, "issuesOpened90d": 141, "issuesClosed90d": 58, "prsMerged90d": 249, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-11-01T17:00:37Z" }, "replies": { "sampled": 25, "unanswered": 14, "medianDays": 5.5 } }, "updatedAt": "2026-11-04T20:38:48.748468058Z" } }, "answer": "Netlify API + MCP scores 69.4 (B) on agent readiness against Cloudflare CLI (cf)'s 65.1 (B), and leads in 4 of 7 scored categories. Cloudflare CLI (cf) leads on security \u0026 auth and transparency \u0026 trust.", "b": { "slug": "netlify", "name": "Netlify API + MCP", "vendor": "Netlify, Inc.", "vendorUrl": "https://www.netlify.com", "kind": "http-api", "category": "infrastructure", "summary": "Netlify's platform for deploying and running web projects, reached through a REST API with a public OpenAPI spec, the netlify-cli command line tool and an official MCP server, hosted at netlify-mcp.netlify.app or run locally from npm.", "url": "https://www.anchorterminal.com/tools/netlify", "markdownUrl": "https://www.anchorterminal.com/tools/netlify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/netlify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/netlify.json", "dns": "netlify.grade.anchorterminal.com", "repo": "https://github.com/netlify/netlify-mcp", "license": "ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.netlify.com/api/v1", "packages": [ { "registry": "npm", "name": "@netlify/mcp" }, { "registry": "npm", "name": "netlify-cli" } ], "auth": "mixed", "authNotes": "Personal access tokens from Applications \u003e Personal access tokens, named, given an expiry date at creation and sent as `Authorization: Bearer`; no scopes are documented, SAML teams need an opt-in at creation, and a password reset invalidates every token. Public integrations use OAuth2 apps registered at app.netlify.com/applications (the spec declares an implicit flow with no scopes). The CLI stores a token from `netlify login` in config.json or reads `NETLIFY_AUTH_TOKEN`. The hosted MCP server signs in with OAuth 2.1 (PKCE, dynamic client registration) and advertises the scopes offline_access, read, write and claudeai; the local server reads the CLI's token or `NETLIFY_PERSONAL_ACCESS_TOKEN`.", "pricing": "freemium", "pricingNotes": "Free plan at $0 with 300 credits a month, deploys from the API, functions, Blobs, Database and custom domains. Personal $9 a month with 1,000 credits, Pro $20 a month with unlimited members and 3,000 credits, Enterprise custom with a 99.99 per cent SLA. Usage is metered in credits, about $0.00667 each at the Pro pack rate (1,500 for $10; Personal 500 for $5). A production deploy is 15 credits, bandwidth 20 a GB, compute 10 a GB-hour and web requests 2 per 10,000. Whether a card is needed is not stated. `netlify deploy --allow-anonymous` publishes without an account, to be claimed within an hour.", "priceSummary": "$9 / mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the OpenAPI spec (no 402 response), the API guide, the MCP source or the pricing page (checked 2026-11-03).", "endpoints": [] }, "toolCount": 11, "popularity": { "githubStars": null, "npmWeekly": 58373, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/", "llmsTxt": "https://docs.netlify.com/llms.txt", "openapi": "https://raw.githubusercontent.com/netlify/open-api/master/swagger.yml", "capabilities": [ "infra.cloud", "code.deploy", "observability.logs" ], "tags": [ "hosted", "freemium", "free-tier", "mcp", "remote-mcp", "cli", "oauth", "pat", "llms-txt", "openapi", "status-page", "bug-bounty", "soc2", "iso27001", "sla", "typescript", "go", "agent-skills", "enterprise" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 69.4, "grade": "B", "agentReady": false, "rank": 226, "ranked": true, "rankOf": 1349, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 87, "payments": 55, "reliability": 67, "schema": 79, "security": 59, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.", "bestFor": "An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.", "strengths": [ "OpenAPI spec (Swagger 2.0, version 2.63.1) with 188 operations, llms.txt and a Markdown twin of every docs page", "Rate limits published (500 a minute, 3 deploys a minute, 100 a day) with X-RateLimit headers on every response", "`netlify deploy --allow-anonymous` publishes a project without an account, claimable within an hour", "MCP server with OAuth 2.1 and PKCE, every tool hint declared since v1.18.0 (7 October 2026), and six tagged releases between 25 September and 26 October", "Public HackerOne bug bounty, SOC 2 Type II, ISO 27001 and 27018, and a trust centre with a downloadable DPA and subprocessor list" ], "weaknesses": [ "Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to", "The hosted MCP server advertises read and write scopes but its source enforces none on tool calls", "No idempotency keys for deploys or site creation, and no documented 429 retry guidance beyond the headers", "19 incidents in the status feed from 18 August to 2 November 2026, including errors reaching hosted sites for about 85 minutes on 21 September", "No entry in the official MCP registry, and the privacy statement contradicts itself on AI training (opt-in in one section, never in another)" ], "agentNotes": [ "Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day", "Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour", "Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `\"async\": true`", "Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel=\"next\"`", "Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.4 } ], "editorialScores": { "ergonomics": 69, "maintenance": 87, "payments": 55, "reliability": 67, "schema": 79, "security": 59, "transparency": 73 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g netlify-cli", "http": "curl -H \"User-Agent: MyApp (you@example.com)\" -H \"Authorization: Bearer $NETLIFY_AUTH_TOKEN\" https://api.netlify.com/api/v1/sites", "claudeCode": "claude mcp add --transport http netlify https://netlify-mcp.netlify.app/mcp", "config": { "mcpServers": { "netlify": { "url": "https://netlify-mcp.netlify.app/mcp" } } } }, "letme": { "capability": "https://letme.dev/infra.cloud", "tool": "https://letme.dev/netlify" }, "area": "developer", "unitPrices": [ { "item": "Personal", "unit": "month", "usd": 9, "note": "1,000 credits a month" }, { "item": "Pro", "unit": "month", "usd": 20, "note": "Unlimited members, 3,000 credits a month" }, { "item": "Credit (Pro pack)", "unit": "credit", "usd": 0.00667, "note": "1,500 credits for $10. A production deploy is 15 credits, bandwidth 20 a GB, compute 10 a GB-hour" }, { "item": "Bandwidth", "unit": "gb", "usd": 0.13, "note": "20 credits a GB at the Pro pack rate" } ], "provenance": { "legalEntity": "Netlify, Inc.", "domain": "netlify.com", "domainRegistered": "2014-06-09", "endpointOnVendorDomain": true, "terms": "https://www.netlify.com/legal/terms-of-use/", "privacy": "https://www.netlify.com/privacy/", "statusPage": "https://www.netlifystatus.com", "changelog": "https://www.netlify.com/changelog/", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "The terms of use (last updated 14 October 2026) name Netlify, Inc. under California law and contain no clause on automated access or scraping; the services run under separate self-serve and enterprise subscription agreements, the self-serve one served as a PDF our reader could not extract.", "The privacy statement (last updated 10 April 2026) names Netlify, Inc. and affiliates, a DPA for enterprise customers, and says in one place that content is not used to train AI models unless the user opts in and in another that Customer Content is never used for training.", "www.netlify.com and docs.netlify.com robots.txt allow every crawler, name ClaudeBot and Claude-Web among allowed AI crawlers, and set Content-Signal search=yes, ai-input=yes, ai-train=yes. www.netlifystatus.com disallows /api/ and /embed/, so the status history was read from /history.atom.", "RDAP gives netlify.com a registration date of 9 June 2014.", "www.netlify.com/.well-known/security.txt returns 404. Vulnerability reports go to the public HackerOne programme per the security transparency post.", "The trust centre at netlify.com/trust-center lists subprocessors (all US) with CSV and PDF downloads and an RSS feed, and the DPA as a direct download." ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/netlify.json", "live": { "slug": "netlify", "probe": { "target": "https://api.netlify.com/api/v1", "method": "get", "lastAt": "2026-11-04T20:47:02.5486596Z", "lastOk": true, "lastStatus": 401, "lastMs": 511, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 457, "p95ms24h": 548, "samples24h": 55, "samples30d": 55, "days": [ { "date": "2026-11-04", "probes": 55, "ok": 55 } ] }, "vendorStatus": { "page": "https://www.netlifystatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:39:30.739538782Z" }, "versions": [ { "registry": "github", "name": "netlify/netlify-mcp", "version": "mcp-v1.21.0", "released": "2026-10-26", "seenAt": "2026-11-04T20:39:31.488292719Z" }, { "registry": "npm", "name": "@netlify/mcp", "version": "1.21.0", "seenAt": "2026-11-04T20:39:29.42118318Z" }, { "registry": "npm", "name": "netlify-cli", "version": "27.16.2", "seenAt": "2026-11-04T20:39:30.256102488Z" } ], "githubStars": 69, "npmWeekly": 54818, "securityTxt": { "url": "https://netlify.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:05.436387975Z" }, "updatedAt": "2026-11-04T20:47:02.5486596Z" } }, "edges": [ { "by": 20, "category": "security", "leads": "cloudflare-cli", "name": "Security \u0026 auth", "reasons": { "a": "OAuth sign-in that a person approves, with `--scopes` to request a subset and, since 1.0.0-beta.25, `cf auth scopes` to list granted permissions by product, or a scoped and revocable API token in `CLOUDFLARE_API_TOKEN`. The Global API Key is not supported and no flag takes a token. Since 1.0.0-beta.19 (20 October) `cf auth login --use-keyring` encrypts OAuth credentials with the OS keychain, which the 17 October check found only as future work; the default comes from a shared package we didn't read (30). All DELETE operations and those the schema marks destructive need confirmation, and outside a terminal only `--force` bypasses it. 1.0.0-beta.21 notes that some confirmations in `cf deploy` and `cf workers triggers deploy` still go ahead without asking when stdout isn't a terminal. Named profiles can be bound to one directory, so an agent can hold separate credentials. No read-only mode was found, and the docs warn that `--force` is also an API parameter on some commands, as with `cf workers delete --force` (15 of 20). Output is the account's own API data and Cloudflare's docs search results, which can include text other people wrote, such as logs or form submissions. The docs give privacy guidance for search queries but none on untrusted content (6 of 15). Cloudflare account audit logs record API changes, per the Cloudflare MCP listing's check, and cf's requests carry its version, execution mode and the detected agent harness in headers. `--dry-run` shows each request before it is sent (10 of 15). security.txt, re-read on 2 November, names HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 2 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2, cloudflare-workers-ai and cloudflare-sandbox-sdk read the same evidence. The repository's SECURITY.md is only a beta warning with no route of its own, Actions are pinned by SHA, zizmor checks the workflows, and OSV lists no advisory for the npm package `cf` (18). 30 + 15 + 6 + 10 + 18 = 79.", "b": "Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59." }, "scores": { "a": 79, "b": 59 } }, { "by": 19, "category": "reliability", "leads": "netlify", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, since the owner runs the CLI on their own machine; Cloudflare's status page and incident record aren't scored on these lines. Official npm package `cf`, with Node.js 22.23.0, 24.22.0 or 26.12.0 or later within each major stated since 1.0.0-beta.20 (20). A public GitHub Actions workflow runs lint and type checks, the CLI's vitest suite on Linux, macOS and Windows and the Wrangler compatibility corpus on every pull request and push to main. We couldn't read the run history, because GitHub's web pages and API answer 403 in our session, so whether main is passing is unchecked (15 of 25). The open issue list was unreadable for the same reason, so crash and regression reports are scored absent (0, unchecked). Changesets and a package changelog that labels breaking changes, such as \"Breaking change during the beta\" on the stderr moves in 1.0.0-beta.20 and 1.0.0-beta.21. Breaking changes ship between prereleases, which semver allows for a beta (13 of 15). 1.0.0-beta.26, still declared beta in the docs and SECURITY.md (0). 20 + 15 + 0 + 13 + 0 = 48.", "b": "Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67." }, "scores": { "a": 48, "b": 67 } }, { "by": 19, "category": "maintenance", "leads": "netlify", "name": "Maintenance \u0026 community", "reasons": { "a": "1.0.0-beta.26 tagged on 29 October 2026 (30). 27 prereleases from 1.0.0-beta.0 (25 September, per the 17 October check) to 1.0.0-beta.26, eight of them since 17 October (beta.19 to beta.26), by the repository's tags (20). Issues and pull requests weren't readable, so responsiveness is scored absent. During the beta, a workflow closes outside pull requests that weren't coordinated with the team in advance (0, unchecked). Cloudflare's official CLI, current and published from GitHub Actions with provenance, but in no registry (10 of 15). Renovate and Dependabot update dependencies, and CI runs on three operating systems. Run results unchecked (8 of 10). 30 + 20 + 0 + 10 + 8 = 68.", "b": "@netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87." }, "scores": { "a": 68, "b": 87 } }, { "by": 7, "category": "transparency", "leads": "cloudflare-cli", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT OR Apache-2.0, with both licence files in the repository and the package (30). telemetry.md lists what command telemetry contains and what is never collected, and says the IP address is handled under Cloudflare's privacy policy. No retention period for telemetry is given. Worker deploys upload npm dependency metadata unless `CLOUDFLARE_DEPENDENCIES_INSTRUMENTATION=false`, which the changelog records but the environment variables page doesn't list. The privacy policy wasn't re-read this run (20 of 30). The docs warn that commands, configuration and Build Output can change before the stable release, the changelog names each breaking change, and the launch post commits to 18 months of Wrangler maintenance after the beta ends. No dated deprecation for cf commands (12 of 20). Telemetry is on by default and fully disclosed, with `cf cli telemetry disable`, `CF_SEND_TELEMETRY=false`, `DO_NOT_TRACK=1` and a `DEBUG=1` view of each payload. Search query text and a hashed agent session ID are part of it, and since 1.0.0-beta.21 sanitised detail about unrecognised commands, which telemetry.md documents (18 of 20). 30 + 20 + 12 + 18 = 80.", "b": "The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73." }, "scores": { "a": 88, "b": 81 } }, { "by": 5, "category": "payments", "leads": "netlify", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). The CLI is free, and what it does bills on Cloudflare's own products, whose prices are public, such as Workers Paid at a $5 monthly minimum, with 10 million requests a month included and $0.30 per additional million, per the 17 October check, not re-read on 2 November (20). New accounts start on the Workers Free plan, per the pricing page. We didn't sign up to confirm that no card is asked for (20). `cf cli search`, `cf docs search`, `cf schema` and `--dry-run` work with no account. Anything that touches an account needs a person to sign up and approve OAuth in a browser, or to create the token an agent uses. 1.0.0-beta.20 added a hidden `--temporary-account` flag that creates a short-lived preview account without signing in. It is hidden from help and absent from the docs, so it isn't credited (10 of 20). 0 + 20 + 20 + 10 = 50.", "b": "No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). `netlify deploy --allow-anonymous` publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55." }, "scores": { "a": 50, "b": 55 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare, Inc.", "b": "Netlify, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.netlify.com/api/v1", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, Streamable HTTP, stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Your plan", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT OR Apache-2.0", "b": "ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms", "name": "Licence" }, { "a": "none", "b": "11", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-29", "b": "2026-10-26", "name": "Last release" }, { "a": "2025-09-12", "b": "2026-10-14", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-04-10", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "292k npm/wk", "b": "58k npm/wk", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Netlify API + MCP scores 69.4 (B) on agent readiness against Cloudflare CLI (cf)'s 65.1 (B), and leads in 4 of 7 scored categories. Cloudflare CLI (cf) leads on security \u0026 auth and transparency \u0026 trust.", "question": "Which is better for AI agents, Cloudflare CLI (cf) or Netlify API + MCP?" }, { "answer": "No hosted endpoint is listed for Cloudflare CLI (cf). Netlify API + MCP has a hosted endpoint at https://api.netlify.com/api/v1.", "question": "Can an agent call Cloudflare CLI (cf) and Netlify API + MCP without installing anything?" }, { "answer": "Cloudflare CLI (cf) is open source (MIT OR Apache-2.0). No open-source release is listed for Netlify API + MCP.", "question": "Are Cloudflare CLI (cf) and Netlify API + MCP open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 79 against 59", "Transparency \u0026 trust, 88 against 81" ], "also": [ "Open source" ], "goodFor": "A coding agent that manages Cloudflare resources or deploys Workers from a shell.", "slug": "cloudflare-cli", "watchFor": "Beta at 1.0.0-beta.26, with output moved from stdout to stderr in 1.0.0-beta.20 and 1.0.0-beta.21 and other breaking changes between prereleases" }, { "aheadOn": [ "Reliability, 67 against 48", "Payments \u0026 pricing, 55 against 50", "Maintenance \u0026 community, 87 against 68" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine" ], "goodFor": "An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.", "slug": "netlify", "watchFor": "Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to" } ], "history": { "cloudflare-cli": [ { "causes": [ "evidence" ], "date": "2026-11-02", "delta": 1.3, "from": 63.8, "fromGrade": "B", "to": 65.1, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-28", "delta": 0.1, "from": 63.7, "fromGrade": "B", "to": 63.8, "toGrade": "B" } ], "netlify": null }, "job": { "capability": "code.deploy", "name": "Deployment" }, "others": [ { "json": "https://www.anchorterminal.com/compare/azure-mcp-vs-netlify.json", "title": "Azure MCP Server vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/azure-mcp-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.json", "title": "DigitalOcean MCP Server vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify.json", "title": "neckbeard vs Netlify API + MCP", "url": "https://www.anchorterminal.com/compare/neckbeard-vs-netlify" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server.json", "title": "Netlify API + MCP vs Railway MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server.json", "title": "Netlify API + MCP vs Render MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp.json", "title": "Netlify API + MCP vs Terraform MCP Server", "url": "https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-digitalocean-mcp.json", "title": "Cloudflare CLI (cf) vs DigitalOcean MCP Server", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-digitalocean-mcp" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-railway-mcp-server.json", "title": "Cloudflare CLI (cf) vs Railway MCP Server", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-railway-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-render-mcp-server.json", "title": "Cloudflare CLI (cf) vs Render MCP Server", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-render-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/aws-mcp-servers-vs-cloudflare-cli.json", "title": "AWS MCP Servers vs Cloudflare CLI (cf)", "url": "https://www.anchorterminal.com/compare/aws-mcp-servers-vs-cloudflare-cli" }, { "json": "https://www.anchorterminal.com/compare/azure-mcp-vs-cloudflare-cli.json", "title": "Azure MCP Server vs Cloudflare CLI (cf)", "url": "https://www.anchorterminal.com/compare/azure-mcp-vs-cloudflare-cli" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-cloudflare-mcp.json", "title": "Cloudflare CLI (cf) vs Cloudflare MCP Servers", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-cloudflare-mcp" } ], "panel": null, "scores": [ { "by": 19, "cloudflare-cli": 48, "edge": "netlify", "key": "reliability", "name": "Reliability", "netlify": 67, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "cloudflare-cli": 81, "edge": "cloudflare-cli", "key": "schema", "name": "Schema \u0026 documentation", "netlify": 79, "weight": 13 }, { "by": 4, "cloudflare-cli": 65, "edge": "netlify", "key": "ergonomics", "name": "Agent ergonomics", "netlify": 69, "weight": 13 }, { "by": 20, "cloudflare-cli": 79, "edge": "cloudflare-cli", "key": "security", "name": "Security \u0026 auth", "netlify": 59, "weight": 14 }, { "by": 5, "cloudflare-cli": 50, "edge": "netlify", "key": "payments", "name": "Payments \u0026 pricing", "netlify": 55, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 19, "cloudflare-cli": 68, "edge": "netlify", "key": "maintenance", "name": "Maintenance \u0026 community", "netlify": 87, "weight": 7 }, { "by": 7, "cloudflare-cli": 88, "edge": "cloudflare-cli", "key": "transparency", "name": "Transparency \u0026 trust", "netlify": 81, "weight": 7 } ], "summary": "Netlify API + MCP scores 69.4 (B) on agent readiness against Cloudflare CLI (cf)'s 65.1 (B), and leads in 4 of 7 scored categories. Cloudflare CLI (cf) leads on security \u0026 auth and transparency \u0026 trust. Both do deployment.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-cli": "One CLI covers the whole Cloudflare API, and an agent can find a command with `cf cli search`, inspect its request with `cf schema` and preview it with `--dry-run`, all without credentials. It is a beta (1.0.0-beta.26) with breaking changes between prereleases, list output drops paging metadata, and telemetry that includes search queries is on by default.", "netlify": "A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify", "json": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.min.md" }, "markdown": "Netlify API + MCP scores 69.4 (B) on agent readiness against Cloudflare CLI (cf)'s 65.1 (B), and leads in 4 of 7 scored categories. Cloudflare CLI (cf) leads on security \u0026 auth and transparency \u0026 trust. Both do deployment.\n\n- Cloudflare CLI (cf): grade B, 65.1/100, rank #394 of 1349. Markdown https://www.anchorterminal.com/tools/cloudflare-cli.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-cli.json\n- Netlify API + MCP: grade B, 69.4/100, rank #226 of 1349. Markdown https://www.anchorterminal.com/tools/netlify.md · JSON https://www.anchorterminal.com/api/v1/tools/netlify.json\n- Best cloud infrastructure tools for AI agents: https://www.anchorterminal.com/best/infrastructure/index.md\n- All 31 infra comparisons: https://www.anchorterminal.com/compare/infrastructure/index.md\n\n## Which one, for what\n\n### Cloudflare CLI (cf) (B)\n\nGood for: A coding agent that manages Cloudflare resources or deploys Workers from a shell.\n\nAhead on:\n- Security \u0026 auth, 79 against 59\n- Transparency \u0026 trust, 88 against 81\n\nAlso in its favour:\n- Open source\n\nWatch for: Beta at 1.0.0-beta.26, with output moved from stdout to stderr in 1.0.0-beta.20 and 1.0.0-beta.21 and other breaking changes between prereleases\n\n### Netlify API + MCP (B)\n\nGood for: An agent that builds and deploys web projects, sets environment variables and reads forms or logs on a team's Netlify account, including with no account through anonymous deploys.\n\nAhead on:\n- Reliability, 67 against 48\n- Payments \u0026 pricing, 55 against 50\n- Maintenance \u0026 community, 87 against 68\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n\nWatch for: Personal access tokens and OAuth apps have no scopes, so a token reaches every team its owner belongs to\n\n\n## Why the edge\n\n### Security \u0026 auth: Cloudflare CLI (cf) +20\n\n- Cloudflare CLI (cf) (79): OAuth sign-in that a person approves, with `--scopes` to request a subset and, since 1.0.0-beta.25, `cf auth scopes` to list granted permissions by product, or a scoped and revocable API token in `CLOUDFLARE_API_TOKEN`. The Global API Key is not supported and no flag takes a token. Since 1.0.0-beta.19 (20 October) `cf auth login --use-keyring` encrypts OAuth credentials with the OS keychain, which the 17 October check found only as future work; the default comes from a shared package we didn't read (30). All DELETE operations and those the schema marks destructive need confirmation, and outside a terminal only `--force` bypasses it. 1.0.0-beta.21 notes that some confirmations in `cf deploy` and `cf workers triggers deploy` still go ahead without asking when stdout isn't a terminal. Named profiles can be bound to one directory, so an agent can hold separate credentials. No read-only mode was found, and the docs warn that `--force` is also an API parameter on some commands, as with `cf workers delete --force` (15 of 20). Output is the account's own API data and Cloudflare's docs search results, which can include text other people wrote, such as logs or form submissions. The docs give privacy guidance for search queries but none on untrusted content (6 of 15). Cloudflare account audit logs record API changes, per the Cloudflare MCP listing's check, and cf's requests carry its version, execution mode and the detected agent harness in headers. `--dry-run` shows each request before it is sent (10 of 15). security.txt, re-read on 2 November, names HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 2 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2, cloudflare-workers-ai and cloudflare-sandbox-sdk read the same evidence. The repository's SECURITY.md is only a beta warning with no route of its own, Actions are pinned by SHA, zizmor checks the workflows, and OSV lists no advisory for the npm package `cf` (18). 30 + 15 + 6 + 10 + 18 = 79.\n- Netlify API + MCP (59): Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.\n\n### Reliability: Netlify API + MCP +19\n\n- Cloudflare CLI (cf) (48): Read with the local-software lines, since the owner runs the CLI on their own machine; Cloudflare's status page and incident record aren't scored on these lines. Official npm package `cf`, with Node.js 22.23.0, 24.22.0 or 26.12.0 or later within each major stated since 1.0.0-beta.20 (20). A public GitHub Actions workflow runs lint and type checks, the CLI's vitest suite on Linux, macOS and Windows and the Wrangler compatibility corpus on every pull request and push to main. We couldn't read the run history, because GitHub's web pages and API answer 403 in our session, so whether main is passing is unchecked (15 of 25). The open issue list was unreadable for the same reason, so crash and regression reports are scored absent (0, unchecked). Changesets and a package changelog that labels breaking changes, such as \"Breaking change during the beta\" on the stderr moves in 1.0.0-beta.20 and 1.0.0-beta.21. Breaking changes ship between prereleases, which semver allows for a beta (13 of 15). 1.0.0-beta.26, still declared beta in the docs and SECURITY.md (0). 20 + 15 + 0 + 13 + 0 = 48.\n- Netlify API + MCP (67): Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67.\n\n### Maintenance \u0026 community: Netlify API + MCP +19\n\n- Cloudflare CLI (cf) (68): 1.0.0-beta.26 tagged on 29 October 2026 (30). 27 prereleases from 1.0.0-beta.0 (25 September, per the 17 October check) to 1.0.0-beta.26, eight of them since 17 October (beta.19 to beta.26), by the repository's tags (20). Issues and pull requests weren't readable, so responsiveness is scored absent. During the beta, a workflow closes outside pull requests that weren't coordinated with the team in advance (0, unchecked). Cloudflare's official CLI, current and published from GitHub Actions with provenance, but in no registry (10 of 15). Renovate and Dependabot update dependencies, and CI runs on three operating systems. Run results unchecked (8 of 10). 30 + 20 + 0 + 10 + 8 = 68.\n- Netlify API + MCP (87): @netlify/mcp 1.21.0 tagged on 26 October 2026 (changelog 23 October), a commit on 28 October, the spec at 2.63.1 and changelog entries to 26 October (30). Six MCP tags between 25 September and 26 October 2026 (20). Issue and pull request responsiveness could not be read (github.com refuses our reader and the API answered empty), while the changelog, the answers.netlify.com forum, Discord and a support hub exist and the MCP changelog cites numbered pull requests (12 of 25). Current official SDKs, a Go client, a JS client and netlify-cli 27.16.2, though the server card names com.netlify/mcp and no such entry is in the official MCP registry (15). CI runs typecheck, build and 31 tests on pinned actions, releases through release-please with npm provenance, and the server runs on @modelcontextprotocol/server 2.2.0 (10). 30 + 20 + 12 + 15 + 10 = 87.\n\n### Transparency \u0026 trust: Cloudflare CLI (cf) +7\n\n- Cloudflare CLI (cf) (88): MIT OR Apache-2.0, with both licence files in the repository and the package (30). telemetry.md lists what command telemetry contains and what is never collected, and says the IP address is handled under Cloudflare's privacy policy. No retention period for telemetry is given. Worker deploys upload npm dependency metadata unless `CLOUDFLARE_DEPENDENCIES_INSTRUMENTATION=false`, which the changelog records but the environment variables page doesn't list. The privacy policy wasn't re-read this run (20 of 30). The docs warn that commands, configuration and Build Output can change before the stable release, the changelog names each breaking change, and the launch post commits to 18 months of Wrangler maintenance after the beta ends. No dated deprecation for cf commands (12 of 20). Telemetry is on by default and fully disclosed, with `cf cli telemetry disable`, `CF_SEND_TELEMETRY=false`, `DO_NOT_TRACK=1` and a `DEBUG=1` view of each payload. Search query text and a hashed agent session ID are part of it, and since 1.0.0-beta.21 sanitised detail about unrecognised commands, which telemetry.md documents (18 of 20). 30 + 20 + 12 + 18 = 80.\n- Netlify API + MCP (81): The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73.\n\n### Payments \u0026 pricing: Netlify API + MCP +5\n\n- Cloudflare CLI (cf) (50): No x402, MPP or L402 (0). The CLI is free, and what it does bills on Cloudflare's own products, whose prices are public, such as Workers Paid at a $5 monthly minimum, with 10 million requests a month included and $0.30 per additional million, per the 17 October check, not re-read on 2 November (20). New accounts start on the Workers Free plan, per the pricing page. We didn't sign up to confirm that no card is asked for (20). `cf cli search`, `cf docs search`, `cf schema` and `--dry-run` work with no account. Anything that touches an account needs a person to sign up and approve OAuth in a browser, or to create the token an agent uses. 1.0.0-beta.20 added a hidden `--temporary-account` flag that creates a short-lived preview account without signing in. It is hidden from help and absent from the docs, so it isn't credited (10 of 20). 0 + 20 + 20 + 10 = 50.\n- Netlify API + MCP (55): No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). `netlify deploy --allow-anonymous` publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.\n\n## Score by category\n\n| Category | Weight | Cloudflare CLI (cf) | Netlify API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 48 | 67 | Netlify API + MCP +19 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 81 | 79 | Cloudflare CLI (cf) +2 |\n| Agent ergonomics | 13% (16.2 this run) | 65 | 69 | Netlify API + MCP +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 79 | 59 | Cloudflare CLI (cf) +20 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 55 | Netlify API + MCP +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 68 | 87 | Netlify API + MCP +19 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 88 | 81 | Cloudflare CLI (cf) +7 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **65.1 · B** | **69.4 · B** | |\n\n## Facts side by side\n\n| Fact | Cloudflare CLI (cf) | Netlify API + MCP |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare, Inc. | Netlify, Inc. |\n| Hosted endpoint | no (local only) | `https://api.netlify.com/api/v1` |\n| Transports | | HTTP, Streamable HTTP, stdio |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Your plan | Freemium |\n| x402 | no | no |\n| Licence | MIT OR Apache-2.0 | ISC for the MCP server (@netlify/mcp) and MIT for the CLI (netlify-cli). The Netlify platform they act on is a proprietary service under Netlify's terms |\n| Tools exposed | none | 11 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-29 | 2026-10-26 |\n| Terms last updated | 2025-09-12 | 2026-10-14 |\n| Privacy policy last updated | no date given | 2026-04-10 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 292k npm/wk | 58k npm/wk |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### Cloudflare CLI (cf)\n\n- +1.3 on 2 November 2026: new evidence\n- +0.1 on 28 October 2026: checklist\n\n### Netlify API + MCP\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Cloudflare CLI (cf).** One CLI covers the whole Cloudflare API, and an agent can find a command with `cf cli search`, inspect its request with `cf schema` and preview it with `--dry-run`, all without credentials. It is a beta (1.0.0-beta.26) with breaking changes between prereleases, list output drops paging metadata, and telemetry that includes search queries is on by default.\n\n**Netlify API + MCP.** A public OpenAPI spec with 188 operations, documented rate limits, an anonymous deploy route and an MCP server released weekly through October 2026 with complete tool annotations. Personal access tokens and the OAuth flows carry no scopes, the hosted MCP enforces none on tool calls, and the status feed shows several site-serving incidents in the 90 days to 3 November.\n\n## Before you call either\n\n### Cloudflare CLI (cf)\n\n1. Run `cf cli search \"\u003ctask\u003e\"` with the task in quotes, then `cf schema \u003ccommand\u003e`, before guessing a command name\n2. Add `--dry-run` to any write first. It prints the request as JSON and needs no credentials\n3. Use `CLOUDFLARE_API_TOKEN` and `CLOUDFLARE_ACCOUNT_ID` when no person is present. `cf auth login` needs a browser approval\n4. Treat a non-zero exit as failure and read stderr. Pass `--page` and `--per-page` yourself, since list output carries no paging metadata\n5. Keep search queries free of account IDs, domains and tokens, or set `CF_SEND_TELEMETRY=false`, because queries are sent in telemetry\n\n### Netlify API + MCP\n\n1. Send a `User-Agent` naming your app and `Authorization: Bearer $NETLIFY_AUTH_TOKEN`; watch X-RateLimit-Remaining and stop before 3 deploys a minute or 100 a day\n2. Deploy with `netlify deploy --allow-anonymous` when the person has no account yet, and tell them to claim the project within an hour\n3. Poll GET /api/v1/deploys/{deploy_id} until `state` is `ready`; a deploy call that runs over 30 seconds is cut off, so send large deploys with `\"async\": true`\n4. Page lists with `page` and `per_page` (100 at most) and follow the `Link` header's `rel=\"next\"`\n5. Expect the hosted MCP's deploy tool to hand back a CLI command for the person to run; the local server deploys from the working directory itself\n\n## Questions\n\n### Which is better for AI agents, Cloudflare CLI (cf) or Netlify API + MCP?\n\nNetlify API + MCP scores 69.4 (B) on agent readiness against Cloudflare CLI (cf)'s 65.1 (B), and leads in 4 of 7 scored categories. Cloudflare CLI (cf) leads on security \u0026 auth and transparency \u0026 trust.\n\n### Can an agent call Cloudflare CLI (cf) and Netlify API + MCP without installing anything?\n\nNo hosted endpoint is listed for Cloudflare CLI (cf). Netlify API + MCP has a hosted endpoint at https://api.netlify.com/api/v1.\n\n### Are Cloudflare CLI (cf) and Netlify API + MCP open source?\n\nCloudflare CLI (cf) is open source (MIT OR Apache-2.0). No open-source release is listed for Netlify API + MCP.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-cli\", \"b\": \"netlify\"}`. From a terminal: `anchor compare cloudflare-cli netlify`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-cli.json and https://www.anchorterminal.com/api/v1/tools/netlify.json\n\n## Other comparisons with Cloudflare CLI (cf) or Netlify API + MCP\n\n- [Azure MCP Server vs Netlify API + MCP](https://www.anchorterminal.com/compare/azure-mcp-vs-netlify.md)\n- [DigitalOcean MCP Server vs Netlify API + MCP](https://www.anchorterminal.com/compare/digitalocean-mcp-vs-netlify.md)\n- [neckbeard vs Netlify API + MCP](https://www.anchorterminal.com/compare/neckbeard-vs-netlify.md)\n- [Netlify API + MCP vs Railway MCP Server](https://www.anchorterminal.com/compare/netlify-vs-railway-mcp-server.md)\n- [Netlify API + MCP vs Render MCP Server](https://www.anchorterminal.com/compare/netlify-vs-render-mcp-server.md)\n- [Netlify API + MCP vs Terraform MCP Server](https://www.anchorterminal.com/compare/netlify-vs-terraform-mcp.md)\n- [Cloudflare CLI (cf) vs DigitalOcean MCP Server](https://www.anchorterminal.com/compare/cloudflare-cli-vs-digitalocean-mcp.md)\n- [Cloudflare CLI (cf) vs Railway MCP Server](https://www.anchorterminal.com/compare/cloudflare-cli-vs-railway-mcp-server.md)\n- [Cloudflare CLI (cf) vs Render MCP Server](https://www.anchorterminal.com/compare/cloudflare-cli-vs-render-mcp-server.md)\n- [AWS MCP Servers vs Cloudflare CLI (cf)](https://www.anchorterminal.com/compare/aws-mcp-servers-vs-cloudflare-cli.md)\n- [Azure MCP Server vs Cloudflare CLI (cf)](https://www.anchorterminal.com/compare/azure-mcp-vs-cloudflare-cli.md)\n- [Cloudflare CLI (cf) vs Cloudflare MCP Servers](https://www.anchorterminal.com/compare/cloudflare-cli-vs-cloudflare-mcp.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare CLI (cf) vs Netlify API + MCP", "url": "" } ], "description": "Netlify scores 69.4 (B) to Cloudflare CLI's 65.1 (B) for deployment. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare CLI (cf) B 65.1", "Netlify API + MCP B 69.4", "scores" ], "h1": "Cloudflare CLI (cf) vs Netlify API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-cli-vs-netlify", "published": "2026-10-01", "section": "tools", "title": "Cloudflare CLI vs Netlify for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/cloudflare-cli-vs-netlify" }, "tokens": { "markdown": 5100, "slim": 3380 }, "version": 1 }