Cloudflare Ecosystem

Cloudflare is the edge-cloud route when work involves Workers, Pages, KV, R2, D1, Queues, Workflows, Workers AI, tunnels, bindings, or edge deployment behavior. Source: Ecosystem Capability Coverage, 2026-06-27; Skill Resolver, 2026-06-27

When To Use This

Use Cloudflare when the runtime is edge-first or the task names Workers, wrangler, R2, D1, KV, Queues, or cloudflared. Use Vercel for Vercel-hosted Next apps unless Cloudflare is the target runtime. Source: Skill Resolver, 2026-06-27

Decision Matrix

Core Model

Cloudflare combines edge compute, storage, networking, and deployment config. The key safety boundary is account/resource confirmation before writes, because small CLI commands can touch real edge infrastructure. Source: Frontend and Design Skills, 2026-06-27

A 2026 bookmark frames the practical small-product stack as Workers, D1, Better Auth, KV, R2, Queues, Hyperdrive, email routing, WAF, and DDoS protection around a roughly $5/month account floor. An earlier @ibocodes variant states the minimum version more bluntly: many projects can start with Workers + D1 instead of VPS + Postgres or Supabase + Vercel. Treat both as stack-shape evidence: good for edge-first apps and predictable-cost experiments, but not an automatic replacement for Vercel-hosted Next apps. Source: X/@ibocodes, 2026-06-21; Source: X/@ibocodes, 2026-06-28

The follow-up "no reason to use Vercel + Supabase anymore" image is market-sentiment evidence, not migration advice. The reviewed visual crosses out Vercel and Supabase while presenting Cloudflare plus PlanetScale as the alternative app-platform pair. The durable signal is that Cloudflare's Workers/D1/Hyperdrive/runtime story and PlanetScale's relational-data route are being perceived as a coherent replacement stack for some small apps. Keep the route workload-specific: Cloudflare + PlanetScale is strongest when the app wants Workers execution and centralized relational data, while Vercel + Supabase remains reasonable for Vercel-native Next apps or teams already standardized on Supabase. Source: X/@ibocodes and local image review, 2026-07-04

A wider solo-developer map adds R2, D1, KV, Durable Objects, Cron Triggers, Queues, Workflows, email, rate limiting, Workers AI, Vectorize, browser automation, Images, feature flags, Cache API, Hono, and full-stack frameworks. Use it as product-surface discovery, not proof that every workload is free or that the post's product names are current. Source: X/@yusukebe 2079825908547060206, reviewed 2026-08-05

Startup credits

Cloudflare for Startups is a current infrastructure-subsidy route for early-stage technology startups, not a separate runtime. As of 2026-07-04, the program offers one-year credits in three tiers: $10k for bootstrapped/self-funded companies under $1M raised, $100k for companies under $5M raised and funded by an affiliated partner, and $350k for companies with $5M+ raised and an affiliated partner. Source: Cloudflare Startups, 2026-07-04

Credits cover usage-based developer platform services including Workers, Workers for Platforms, Durable Objects, Workflows, Workers AI, KV, D1, Queues, Vectorize, R2, Pages, Images, Stream, Cache Reserve, and Argo Smart Routing. R2 has a $10k cap; Workers AI caps vary by tier ($2.5k / $25k / $50k); AI Gateway is temporarily excluded. Core security/networking benefits include three enterprise domains, unlimited Business/Pro plans, DDoS and bot protection, WAF custom rules, SSL, CDN/DNS, two-origin load balancing, one rate-limit rule, and 100% SLA. Source: Cloudflare Startups, 2026-07-04

Qualification requires an incorporated company no more than 10 years old, funded up to Series B within the last 12 months, a technology product, a public website, public social presence, first-time program approval, and a domain-matching business email. The practical caveat: credits are tracked on invoices, not directly in the Cloudflare dashboard, and they expire after the original one-year cohort window even if a tier upgrade is approved. Source: Cloudflare Startups, 2026-07-04

Lunora is an alpha reference for a Convex-style Cloudflare backend: schema-defined TypeScript functions, realtime state through Durable Objects, D1, R2, Queues, and a typed ctx surface. Use it as design reference only until a pinned release is audited; normal Cloudflare work still starts with wrangler, Cloudflare Workers, and Security and Review Skills. Source: X/@prisis, 2026-06-26; Source: GitHub anolilab/lunora, 2026-06-30

PlanetScale Billing Route

Cloudflare now exposes PlanetScale Postgres and MySQL creation from the Cloudflare dashboard for Workers apps, with pay-as-you-go usage billed through the Cloudflare account. The integration routes Workers to regional PlanetScale databases through Hyperdrive, which provides connection pooling and query caching while keeping existing drivers, ORMs, and SQL tooling. This strengthens Cloudflare as a full app platform for centralized relational data that does not fit D1/edge SQLite, while keeping the default Cloudflare path target-specific rather than a blanket Vercel replacement. Source: Cloudflare changelog, 2026-06-18; Source: Hyperdrive PlanetScale docs, 2026-06-18

Agent guidance and starter-source boundary

Cloudflare's official cloudflare/skills repository is the current agent-instruction source for Cloudflare work. The captured Apache-2.0 tree at commit f96bff754e428838818017f75817f0f9428acd48 contains 13 SKILL.md files and one workflow. Route a named Cloudflare job to the relevant source skill, then keep wrangler whoami, target-resource readback, preview/local execution, and rollback proof as the authority. Repository freshness improves framework and product recall; it does not grant account mutation authority. Source: cloudflare/skills repository evidence, captured 2026-08-12

Two saved starter sources remain useful but have different roles. crafter-station/elements@91d08421 is an MIT source of full-stack shadcn/ui blocks with 12 skill files and 12 test files; consume one reviewed block rather than importing a second application architecture. ifindev/fullstack-next-cloudflare@c29231c3 is an MIT Next.js 15 + Workers/D1/R2/Better Auth template, but its captured head was last pushed in December 2025 and exposes no test files in the repository tree. Use it as an implementation reference only after refreshing dependency, binding, auth, secret, deployment, and compatibility proof against current Cloudflare/Next contracts. Source: commit-pinned repository evidence, captured 2026-08-12

VPS Front Door / Edge Sidecar

In Modern Web VPS Stack, Cloudflare is the public edge and selective service layer around a TanStack/Tailwind/Vite app. The app can run on Hetzner/Coolify/Node while Cloudflare owns DNS, CDN, WAF/DDoS, Access, Tunnel, and edge services; or the same TanStack Start app can target Workers when the runtime constraints fit. Cloudflare's Workers docs list TanStack Start as a supported full-stack framework, and the Cloudflare Vite plugin supports TanStack Start SSR while running Worker code inside workerd. Source: Cloudflare TanStack Start and Vite plugin docs, 2026-07-06

For VPS origins, Cloudflare Tunnel is useful when the origin should initiate outbound connections and avoid exposing inbound ports directly. The safety model is still explicit: verify the zone/account, named tunnel, DNS route, origin service, Access policy, and rollback path before changing production routing. Source: Cloudflare Tunnel docs, 2026-07-06

Version Snapshot

Checked 2026-07-06 against the npm registry:

Before changing Cloudflare resources, verify both tool version and account state: wrangler --version, wrangler whoami, then read/list target resources. Source: npm registry packument, 2026-07-06

Routing Summary

Preferred order: Frontend and Design Skills skill plus wrangler CLI for Cloudflare resources, Security and Review Skills for code review, cloudflared for tunnels, and service CLI registry for unknown products. Source: Skill Resolver, 2026-06-27; config/capability-harvest-seeds.json

Failure Modes

• Deploying to the wrong account or environment.
• Missing bindings in local vs production config.
• Treating Workers runtime as Node.js.
• Forgetting rollback or route impact.

Verification Path

Run wrangler whoami, read/list target resources, and use preview/local dev before production deploy. For tunnels, verify active config and target origin. Source: config/capability-harvest-seeds.json; Skill Resolver, 2026-06-27

Durable Object cost at scale

Cloudflare bills every awake Durable Object as if it used 128 MB of memory. In workerd one used about 200 KB, so Robert Chandler packed them by the hundred into Cloudflare Containers: 1,000 always-awake objects fell from $4,050 to $22 a month, with objects moved between containers mid-write and no writes lost in the test. The trade is durability: a real Durable Object acknowledges a write only after replication, while a pooled one can lose up to 30 seconds of writes if a container crashes. Use pooling for cursors, presence, game state and agent scratchpads; keep real Durable Objects for money. Pooling wins only when objects stay awake more than about two hours a month. The same work found that the official containers library relays each WebSocket frame through JavaScript, which caps it near 1,000 messages a second; a one-line passthrough fixed it. Source: X/@bertie_ai thread, 2026-10-15; Source: nyacg/do-on-container

Ryan Dahl's celld goes the other way: it runs a Workers and Durable Objects app unchanged on your own machines, from the existing wrangler.json. Each object is a cell built on V8, SQLite and S3 with LTX files; writes are durable before acknowledgment, the only dependency is an S3-compatible bucket, and a hibernated cell costs only its storage. Dahl credits deterministic simulation testing for making the design work. Source: X/@rough__sea thread, 2026-08-05; Source: celld.dev

Versions checked 2026-11-03: denoland/celld v0.6.3 (2026-10-21); nyacg/do-on-container has no releases, last push 2026-10-19. Source: gh release list; gh api, 2026-11-03

Security audit skill

Cloudflare's security-audit-skill runs a multi-phase audit through isolated agents: reconnaissance, coverage-led hunting, candidate validation, structured output, independent verification of each record, and a neutral report. It works in any harness and with free models, and it finds more even after another model already audited the code. Kevin runs it on the projects; see private page and Princeton Powerlifting. MIT; no releases, last push 2026-09-14. Source: X/@jurbed, 2026-10-21; Source: cloudflare/security-audit-skill

Quick Tunnels for agents

cloudflared tunnel --url http://localhost:8000 gives anything on localhost a public HTTPS URL with no account, DNS record or open port. Quick Tunnels are not new, but the relaunch at try.cloudflare.com targets coding agents: the URL comes back as JSON, so an agent can read it instead of scraping logs. Source: X/@suganthan thread, 2026-09-20; Source: try.cloudflare.com

One Worker for the whole app

A full app can run on one Worker for about $5 a month: TanStack Start or vinext for the framework, D1 (SQLite) for the database in place of Postgres, Better Auth on D1 for auth, R2 for storage, Durable Objects for realtime, KV for cache and Queues plus Cron Triggers for background jobs. The limit to plan for is D1's 10 GB per database; a team that outgrew it wrote up what they tried next. Source: X/@ibothinks thread, 2026-10-24; Source: Sushidata, "Why We Outgrew Cloudflare D1"

Cloudflare's pay-per-crawl lets sites charge AI agents for access: the start of an internet where agents are customers and sites are paid resources. Source: X/@gregisenberg, 2026-08-10

Cloudflare Wallets hold stablecoins so agents can buy services and receive funds without a human login, payment method or key setup, the other half of charging agents for access. Source: X/@Cloudflare, 2026-08-04; Source: Cloudflare blog

Yusuke Wada's summer 2026 list of what Cloudflare covers for a solo project: Workers, R2, D1, KV, Durable Objects, Cron Triggers, Queues, Workflows, Email, Rate Limiting, Workers AI, Vectorize, Browser Run, Images, Flagship flags, Cache, with Hono or Astro, TanStack or vinext on top; nearly all free to start. Source: X/@yusukebe, 2026-07-22

Browser Run gained WebMCP support, session recordings, live view with human-in-the-loop takeover, higher concurrency and Workers bindings. Source: X/@ritakozlov, 2026-07-16; Source: X/@fayazara, 2026-07-16

Cloudflare's official agent skills cover almost every Cloudflare service and update often; check them before wiring a new service, and use the MCP for deeper work. Source: X/@vikingmute, 2026-07-18

---

Timeline

• 2026-08-12 | Pinned the official Cloudflare agent-skill source and retained the shadcn full-stack block source plus Next.js/Cloudflare starter as bounded references. Skills still require resource readback and previews; templates require current dependency, binding, auth, secret, test, and deployment proof. Source: cloudflare/skills@f96bff75, crafter-station/elements@91d08421, ifindev/fullstack-next-cloudflare@c29231c3
• 2026-07-06 | Added Cloudflare's role in Modern Web VPS Stack: DNS/CDN/WAF/Tunnel/Access as the VPS front door, Workers/bindings as optional edge sidecars, and first-party TanStack Start/Vite plugin support when the app targets Workers. Refreshed @cloudflare/workers-types to 5.20260706.1. private page
• 2026-07-04 | Deep-reviewed the CloudflareDev and CFchangelog PlanetScale billing bookmarks. Added the Cloudflare-dashboard creation and billing route for PlanetScale Postgres/MySQL, with Hyperdrive as the Workers connection-pooling/query-cache layer. Source: X/@CloudflareDev, 2026-06-19; Source: X/@CFchangelog, 2026-06-19; Source: Cloudflare changelog and Hyperdrive docs, 2026-07-04
• 2026-07-04 | Deep-reviewed the @ibocodes Cloudflare + PlanetScale replacement-stack image. Preserved it as sentiment evidence for the Cloudflare/PlanetScale pairing, not as blanket advice to leave Vercel + Supabase; refreshed @cloudflare/workers-types to 5.20260704.1. Source: X/@ibocodes, 2026-06-20; Source: npm registry, 2026-07-04
• 2026-07-01 | Refreshed npm registry snapshot: wrangler advanced to 4.106.0; @cloudflare/workers-types advanced to 4.20260701.1. Source: npm registry packument, 2026-07-01
• 2026-07-04 | Added Cloudflare for Startups as the current credits/subsidy route for early-stage teams building on Workers, storage, networking, and security products; recorded the $10k / $100k / $350k tiers, major caps, AI Gateway exclusion, and eligibility constraints. Source: Cloudflare Startups, 2026-07-04
• 2026-07-03 | Deep-reviewed the earlier @ibocodes Workers + D1 minimum-stack bookmark and refreshed tooling: wrangler advanced to 4.107.0; @cloudflare/workers-types advanced to 5.20260703.1. Source: raw/x-bookmarks/enriched/2068652359194992778.json; npm registry, 2026-07-03
• 2026-06-30 | Deep review refreshed versioning: wrangler remains 4.105.0; @cloudflare/workers-types advanced to 4.20260630.1; no new skill was created because skills/engineering/cloudflare/ already owns this stack. Source: npm registry, 2026-06-30
• 2026-06-30 | Added Lunora as an alpha/reference route for Convex-style realtime DX on Cloudflare; default Cloudflare execution still routes through wrangler and Workers best practices. Source: X bookmark artifact audit, 2026-06-30
• 2026-06-29 | Added the small-product Cloudflare stack signal: Workers, D1, Better Auth, KV, R2, Queues, Hyperdrive, email routing, WAF, and DDoS protection as a predictable-cost route. Source: X/@ibocodes, 2026-06-28
• 2026-06-29 | Recorded tooling version snapshot: wrangler 4.105.0 and @cloudflare/workers-types 4.20260629.1. Source: npm registry via npm view, 2026-06-29
• 2026-06-27 | Canonical ecosystem page created so Cloudflare has a platform-level page beyond Wrangler and Workers-specific skills. Source: User request, 2026-06-27; Ecosystem Capability Coverage