Cloudflare — zone analytics via the dashboard

CLI tool for querying Cloudflare's GraphQL Analytics API for a zone you own. Uses the active dash.cloudflare.com browser tab to issue same-origin fetch calls, so it inherits the user's logged-in session — no CLOUDFLARE_API_TOKEN required.

Prerequisites

1. A Cloudflare dashboard tab must be open and authenticated. Either:
   • Visit https://dash.cloudflare.com in any tab, or
   • Run wrangler open and complete the login if prompted.
2. The signed-in user must have access to the zone you query.

Quick start

# List zones the current dash session can see
wrangler zones

# Quick traffic snapshot for the last N hours (default: 3h)
wrangler status sliccy.com
wrangler status sliccy.com --hours=24

# Hourly time-series of requests / pageViews / uniques / threats
wrangler timeseries sliccy.com --hours=72

# Status-code breakdown per hour (great for spotting 404 storms)
wrangler statuscodes sliccy.com --hours=24

# Top URL paths in a window, sorted by sampled request count
wrangler top-paths sliccy.com --hours=6 --limit=30

# Top user agents in a window
wrangler top-uas sliccy.com --hours=6 --limit=20

# Top countries in a window
wrangler top-countries sliccy.com --hours=24

# Free-form GraphQL — useful for one-off queries
wrangler query --zone=sliccy.com --file=/tmp/q.graphql
echo '{ viewer { zones { httpRequests1hGroups(limit:1, filter:{...}){ count } } } }' | wrangler query --zone=sliccy.com

Available commands

Common flags

Architecture

• Endpoint: POST /api/v4/graphql on dash.cloudflare.com, same-origin fetch with credentials: 'include'.
• Transport: A Playwright eval-file against the Cloudflare tab, which serializes the GraphQL response and saves it to a temp file the shell script then parses.
• Auth model: None of our own — we ride the dashboard cookies.
• Plan limits: Free zones cap httpRequests1hGroups queries at 3 days and reject some dimensions (clientRefererHost, botManagementVerifiedBot). The CLI auto-clamps the window to 3 days for free zones and sticks to free-tier-allowed dimensions.

Sampling

httpRequestsAdaptiveGroups (used by top-paths / top-uas) returns a sampled view. Counts are not absolute — they are proportional. For absolute hourly totals use timeseries (httpRequests1hGroups), which is unsampled.

Combining both is the right move for incident investigation:

1. timeseries to confirm a spike exists and locate the start hour.
2. statuscodes to see whether it's real users (mostly 200) or a scan (mostly 404 / 301).
3. top-paths and top-uas in a narrow window around the spike to identify the actor and intent.

Known limitations

• Free plan only exposes a 3-day window for httpRequests1hGroups. Wider ranges return a quota error.
• clientRefererHost is gated to paid plans. This skill avoids it by default.
• Bot-management dimensions (botManagementVerifiedBot, clientIPClass) may not be available on free plans; the CLI degrades gracefully.
• Same-origin only. If dash.cloudflare.com is not open and authenticated, every command fails. Run wrangler open first.

Don't

• Don't try to use CLOUDFLARE_API_TOKEN env vars — this skill ignores them. Tokens with Zone:Analytics:Read are a fine alternative path but a separate tool.
• Don't expect referrer data on free zones; if you need it, mint a paid token and use the Cloudflare REST API directly.
• Don't query windows wider than 3 days on free zones — the API rejects it.