AMH Cloudflare Ops MCP by WT

Register an upstream MCP server so its tools appear in THIS catalog under a namespace (namespace__tool) and calls proxy to it. Args: namespace (a-z0-9_-), url (https MCP endpoint), auth (optional Bearer token/connector key).

List registered upstream MCP servers (namespace, url, whether authed).

Unregister an upstream MCP server by namespace.

Mark an inbox task done (or failed=true) with a short result: what you did, links, deployment ids. Pings Austin on WhatsApp if the task asked for it.

The whole agent board: every task, optionally by status (open/claimed/done/failed) or by who it's for.

List API tokens on the connected user: id, name, status, expiry, and whether cfops minted them. NEVER returns token values (Cloudflare only shows those once, at mint). Read-only.

Mint a narrow, auto-expiring Cloudflare API token for ONE zone (presets: zone-read, dns-zone, cache-purge; default 1h TTL). The vending machine for least-privilege agent work: hand a cheap agent a key that can't hurt anything and dies on its own. DRY-RUN by default — returns the exact policy JSON; mints nothing unless apply=true. Needs a bootstrap token with 'API Tokens Write'. There is deliberately NO super/account-wide preset.

List the Cloudflare Pages sites your token can see (all your accounts): project, production branch, domains, last deploy. Start here.

Check your inbox: open tasks for you (or for 'any'). Run this when Austin says 'check your inbox'. Then claim_task → do the work → finish_task.

Attach a custom domain (e.g. tacos.com or www.tacos.com) to a Pages project, or show the status of its domains. If the domain's zone is on the same Cloudflare account, Cloudflare sets up DNS itself; otherwise the result says what record to add. Dry-run unless apply=true.

Compare a Pages project's production branch against the branch you're about to deploy — catches the silent 'git says master, project says main, every deploy lands on a preview' failure. Read-only.

Create a NEW Cloudflare Pages project (empty site at <name>.pages.dev). Dry-run unless apply=true. Then use pages_deploy to put files on it and pages_add_domain for a custom domain.

Plan or apply a Cloudflare Pages DNS cutover. Deletes only conflicting apex/www A/AAAA/CNAME records and www NS delegations, then creates proxied CNAMEs to the Pages target. DRY-RUN by default; writes only when apply=true.

Deploy a COMPLETE built static site to a Cloudflare Pages project through the API (like `wrangler pages deploy`, no PC needed). Dry-run by default; apply=true uploads and deploys. branch = production branch goes LIVE; any other branch is a preview URL. A deploy replaces the whole site, so send every file. Static only (no functions/). artificialmindhive production is refused.

Details of one Pages deployment: url, branch, stages, commit message. Read-only.

List recent deployments of a Pages project, marking the one serving production. Read-only.

Change ONLY a few files on a live Pages site (no PC, no full file set). Best: edits [{path, find, replace}] — the hub fetches the live file, replaces the exact text (must match once), and deploys. Or files [{path, content}] for whole changed files. The hub copies the live deployment's file list, swaps in the changes (and removes any in delete), keeps _redirects/_headers, and deploys. Every other file stays exactly as live. Dry-run by default; apply=true deploys. branch = production branch goes LIVE, any other = preview. Returns rollback_hint. Sites with server code (artificialmindhive) re-atta…

Read the RAW text of one file exactly as the live production deployment serves it (no summarizer, no proxy). Use find to get the exact snippet(s) around a string; else returns content in chunks (offset/length). Read-only.

Put a past production deployment back live. Dry-run by default; apply=true rolls back. artificialmindhive needs force=true plus a note.

Read (no args besides account/project) or save the hub's copy of a project's _redirects/_headers, which pages_patch re-sends on every patch.

Analyze a domain's email authentication (SPF/DKIM/DMARC/BIMI/routing) and report what is missing or misconfigured, with the exact records to add. Never writes.

List all non-default tool policies.

Set governance policy for any tool (native or federated namespace__tool): allow | approve | block. Default is allow. 'approve' refuses the call unless it carries "_approved": true.

Give a task to another agent (or yourself later) on the shared AMH agent board. to: grok | claude | jubber | codex | owner (Austin) | any.

Purge Cloudflare's cache for a zone — the whole zone (default) or specific URLs. DRY-RUN by default: returns the scope and purges NOTHING unless apply=true. Needs a token with Zone > Cache Purge.

Commit to a grok/<name> (or agent/<name>) branch on GitHub in ONE commit, no PC. Branch is created from the default branch if new. files [{path, content, encoding?:'base64', delete?:true}] and/or edits [{path, find, replace}] applied to the branch's current file. Never touches the default branch, never force-pushes, never writes .github/.

List Austin's GitHub repos (pain2hustle/* and pain2hustle1/*): default branch, last push, private flag. Optional q filters by name/description. No PC needed.

Merge an open grok/* or agent/* pull request into the default branch (normal merge commit, history kept, no force). Refused if the PR touches .github/.

Open (or find) a pull request from a grok/<name> branch into the default branch so Austin can review and merge.

Read a file (raw text) or list a folder from a pain2hustle repo at a branch/ref. Use find (+around) to get exact snippets, or offset/length for big files. No PC needed.

Search code inside one pain2hustle repo (GitHub code search). Returns matching file paths.

Revoke an API token by id (e.g. a minted task-token you're done with early). DRY-RUN by default; deletes nothing unless apply=true.

Read-only snapshot of a domain's Cloudflare zone: all DNS records plus parsed SPF, DMARC, BIMI, and Email Routing status. Never writes.

Change the _dmarc policy (none|quarantine|reject), preserving other tags. DRY-RUN by default — returns the before/after diff and writes nothing unless apply=true.

Create/update the default._bimi TXT record pointing at a logo SVG. REFUSES to write when DMARC is p=none (unless force=true) because BIMI won't be honored without enforced DMARC. DRY-RUN by default.

Enable Cloudflare Email Routing and create forward rules (+ optional catch-all). Cloudflare auto-adds the MX/SPF records. DRY-RUN by default. Destination addresses must be verified by their owner via Cloudflare's email.

One-time setup for sites with server code (Functions/_worker), or any site you keep in GitHub: deploys the repo to a Cloudflare Pages project on every push via GitHub Actions — no PC. Sets the repo secrets and opens a pull request adding the workflow; the user taps Merge to turn it on. Dry-run by default; apply=true does it. After that, change the site with repo_commit_push + repo_open_pr + repo_merge_pr.

Latest Walrus Tusk deploy runs for a repo (queued / running / success / failure, with links).

READ-ONLY traffic for one of Austin's domains from Cloudflare analytics: requests, page views and unique visitors for today, the last 7 days or the last 30 days, plus the period before it to compare, and a per-day list. Counts include bots unless noted. Use it for 'how many views on X'.

Submit the complete evidence-backed job result. Always call this tool exactly once.

Read or change the token auditor: unused_days = how long a hub-minted (cfops) token may sit unused before it is revoked (default 7). Admin keys can change it.

Re-scan a domain and return a pass/fail checklist: SPF, DMARC present + enforced, MX, Email Routing, BIMI, DKIM count. Never writes.

Answer 'what is ACTUALLY serving this domain?': zone → Worker routes, Worker custom domains, and Pages projects that claim it, with a warning when multiple products fight over it. Read-only.

Deploy a small Cloudflare Worker (one ES-module file, export default { fetch }) next to a site, e.g. an AI chat endpoint or a form handler. Optional bindings: ai=true gives env.AI (Workers AI, e.g. env.AI.run('@cf/moonshotai/kimi-k2.6', {messages})), d1=[{binding, database_id}] gives env.<binding>, vars={NAME:'value'}. Publishes at <name>.<account>.workers.dev. Refuses to overwrite any Worker the hub didn't create (Austin's existing workers are safe). Dry-run unless apply=true. Remember the account's free AI allowance is shared: add a rate limit to anything public.

Step 2: land the patch. dry_run:true shows what would change and uses nothing. Live code must equal the latest version and the repo file, or it refuses. Checks the new version on its preview URL, goes live, checks live, rolls back by itself on failure, syncs the repo. Same request_id again returns the first receipt.

Description is built at runtime.

Receipt for a worker_patch request id (state, versions, checks, rollback, repo commit).

Owner: put the repo's main file for an allow-listed Worker live exactly as written (preview check, live check, rollback). Needed once, or after someone deployed another way. dry_run defaults to true.

One-call health check: Pages projects (with production branch + domains) and Workers on both accounts, plus live vs latest deployment for one project. Read-only.

Show what this Walrus Tusk key is connected to (Cloudflare accounts, GitHub login). Tokens are never shown.