·
Last changedVersion:
This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 12. Classified findings closed: 1. Classified findings remaining: 11. Unclassified scanner findings remaining: 0. Review findings closed: 1. Review findings remaining: 16.
4
8
4
7
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/configuration.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/webhooks-push.md | Supply Chain & Install-Time Trust | — | Medium | Open | |
references/codemode.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
SKILL.md | Excessive Agency & Rogue Autonomy | — | Medium | Open | |
references/codemode.md | Sensitive Data & Secret Exposure | Hardcoded secret | Low | Open | |
references/codemode.md | Prompt Injection | Third-party content as instructions | Low | Open | |
SKILL.md | Prompt Injection | Third-party content as instructions | Low | Closed | |
references/configuration.md | Prompt Injection | Third-party content as instructions | Low | Open |
12 findings
Your knowledge of the Agents SDK may be outdated. Prefer retrieval over pre-training for any Agents SDK task.
Cloudflare docs: https://developers.cloudflare.com/agents/index.md
| Topic | Docs URL | Use for |
|---|---|---|
Getting started | First agent, project setup | |
Adding to existing project | Install into existing Workers app | |
Configuration |
| |
Agent class | Agent lifecycle, patterns, pitfalls | |
State |
| |
Routing | URL patterns, | |
Callable methods |
| |
Scheduling |
| |
Workflows |
| |
HTTP/WebSockets | Lifecycle hooks, hibernation | |
Chat agents |
| |
Client SDK |
| |
Client tools | Client-side tools, | |
Server-driven messages |
| |
Resumable streaming | Stream recovery on disconnect | |
Email routing, secure reply resolver | ||
MCP client | Connecting to MCP servers | |
MCP server | Building MCP servers with | |
MCP transports | Streamable HTTP, SSE, RPC transport options | |
Securing MCP servers | OAuth, proxy MCP, hardening | |
Human-in-the-loop | Workflow approvals, elicitation, timeout handling | |
Durable execution |
| |
Queue | Built-in FIFO queue, | |
Retries |
| |
Observability | Diagnostics-channel events | |
Push notifications | Web Push + VAPID from agents | |
Webhooks | Receiving external webhooks | |
Cross-domain auth | WebSocket auth, tokens, CORS | |
Readonly connections |
| |
Voice | Experimental STT/TTS, | |
Browse the web | Experimental CDP browser automation | |
Think | Experimental higher-level chat agent class |
The Agents SDK provides:
setState@callable() methods invoked over WebSocketscheduleEvery), and cron tasksAgentWorkflowrunFiber() / stash() for work that survives DO evictionqueue()this.retry() with exponential backoff and jittercreateMcpHandlerAIChatAgent with resumable streams, message persistence, toolssaveMessages, waitUntilStable for proactive agent turnsuseAgent, useAgentChat for client appsdiagnostics_channel events for state, RPC, schedule, lifecycle@cloudflare/voiceagents/browser@cloudflare/thinkIf not installed:
For chat agents:
Gotchas:
experimentalDecorators in tsconfig (breaks @callable)"ai": { "binding": "AI" } for Workers AIRequests route to /agents/{agent-name}/{instance-name}:
| Class | URL |
|---|---|
|
|
|
|
Client: useAgent({ agent: "Counter", name: "user-123" })
Custom routing: use getAgentByName(env.MyAgent, "instance-id") then agent.fetch(request).
| Task | API |
|---|---|
Read state |
|
Write state |
|
SQL query |
|
Schedule (delay) |
|
Schedule (cron) |
|
Schedule (interval) |
|
RPC method |
|
Streaming RPC |
|
Start workflow |
|
Durable fiber |
|
Enqueue work |
|
Retry with backoff |
|
Broadcast to clients |
|
Get connections |
|
Read client-sdk.md for client selection and current connection examples. For chat UI and tools, also read streaming-chat.md.
getAgentByNameuseAgent, useAgentChat, AgentClientsaveMessagesneedsApprovalrunFiber, stash, surviving eviction@cloudflare/think higher-level chat agent@cloudflare/voice STT/TTSGet started with chainctlchainctl skill install public/cloudflare/agents-sdk:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/cloudflare/skills/agents-sdk:latest
Apache-2.0
HARDENING.md
LICENSE
SKILL.md
references/browse-the-web.md
references/callable.md
references/client-sdk.md
references/codemode.md
references/configuration.md
references/durable-execution.md
references/email.md
references/human-in-the-loop.md
references/mcp.md
references/observability.md
references/queue-retries.md
references/routing.md
references/server-driven-messages.md
references/state-scheduling.md
references/streaming-chat.md
references/think.md
references/voice.md
references/webhooks-push.md
references/workflows.md