Eval directory · Security Operations

Evals for Cloudflare

Eval coverage for Cloudflare, mapped from its public product surface.

About Cloudflare

Cloudflare is a unified platform of 60+ cloud services running on a global network for building, securing, and scaling applications, AI agents, and workforce access. Its developer platform includes serverless compute (Workers, Durable Objects, Containers), storage (R2, D1, KV, Queues), and AI services (Workers AI, AI Gateway, Vectorize, AI Search). Its security side spans CDN, DDoS protection, WAF, bot management, and the Cloudflare One SASE/Zero Trust platform.

Industry

connectivity cloud: serverless developer platform, CDN/network, and SASE security

Website

www.cloudflare.com

Use the eval library for Cloudflare

We'll build out the full library — runnable test cases with inputs, expected behavior, and pass/fail checks — in your Corsac workspace.

Related in Security Operations

All evals →

More Security Operations eval libraries

Coverage map

What would you measure for Cloudflare?

6 scoring areas · 24 capabilities mapped · grounded in 8 cited pages

Every eval set is graded on

Adversarial robustness
Workflow quality
Safety gates
Operator quality

Pass/Fail + LLM judge 1–5 · critical severity flags · negative controls

Developer Compute & Runtime

Serverless and stateful execution primitives on the global network: Workers, Durable Objects, Containers, Workflows, Pages, Sandboxes, and Browser Rendering, including the isolate-based execution model and CPU-time billing.

“CPU-time based billing, not wall-clock time” www.cloudflare.com

Mapped capabilities

4 capabilities

Workers execution model and billing
V8 isolates, zero cold starts, CPU-time (not wall-clock) billing, supported languages (JavaScript, TypeScript, Python, Rust, WASM)
Stateful and long-running compute
Durable Objects for stateful coordination, Workflows for process orchestration, Containers for arbitrary language workloads
Placement and global deployment
Deploy-once-run-in-330+-cities model, Smart Placement moving a Worker closer to its backend data
Frontend and platform hosting
Cloudflare Pages for frontend sites, Workers for Platforms for multi-tenant programmable platforms, Sandboxes for secure code execution

Illustrative example

Input: Does Workers bill me for wall-clock time while my function awaits a slow upstream API, and will the first request after an idle period hit a cold start?
Expected behavior: Explains that Workers bills CPU time rather than wall-clock, so time spent awaiting the upstream call is not billed as compute, and that V8 isolates mean the first request does not incur a cold start.

Data & Storage Primitives

The storage layer paired with Workers: object, relational, key-value, queueing, and database-acceleration services, and the selection tradeoffs among them.

Mapped capabilities

4 capabilities

Object storage and egress economics
R2 egress-free object storage, Cache Reserve for persistent static content caching
Structured and key-value data
D1 serverless SQL, KV ultra-fast key-value storage, and when each fits
Asynchronous messaging
Queues for message processing and decoupled workloads
External database access
Hyperdrive for accelerating connections to existing global databases; Data Platform ingest, catalog, and query

AI & Agent Infrastructure

Services for building, serving, and observing AI applications and agents: inference, retrieval, vector search, model-call gateways, and agent state.

Mapped capabilities

4 capabilities

Inference on the network
Workers AI edge model execution and its relationship to Workers-based applications
Model-call gateway and observability
AI Gateway for caching, routing, and visibility into model traffic
Retrieval and vector search
Vectorize vector database and AI Search instant retrieval
Agent state and orchestration
Agents for stateful AI agents, composed with Durable Objects and Workflows

Illustrative example

Input: Our AI agent needs per-user session state that persists across requests, plus caching and visibility on its model calls. Which Cloudflare primitives cover each need?
Expected behavior: Maps per-user persistent session state to Durable Objects and model-call caching plus observability to AI Gateway, and may mention Workers AI for running inference. Does not invent products or promise capabilities beyond those services.

Application Security & Abuse Defense

Protection for web properties and APIs: DDoS mitigation, WAF, bot management, human verification, and API-layer controls on a network that blocks a stated 234B daily threats.

“234B Daily cyber threats blocked.” www.cloudflare.com

Mapped capabilities

4 capabilities

DDoS mitigation across layers
DDoS for web, Magic Transit for network-layer protection, Network Firewall for enterprise WAN
WAF and rate limiting
Web Application Firewall rules and Rate Limiting for abuse prevention
Bot and human verification
Bot Management for blocking bad bots, Turnstile as a CAPTCHA replacement
API and client-side protection
API Shield security and monitoring, Client-Side Security against browser supply-chain attacks

Network Delivery, DNS & Certificates

Traffic delivery and reliability: CDN caching, DNS, routing optimization, load balancing, TLS/certificate management, and observability over network logs.

Mapped capabilities

4 capabilities

CDN and cache behavior
Faster delivery and caching, plus China Network for high-performance delivery in China
DNS and email routing
Fast DNS and Email Routing for custom addresses
Routing and availability
Argo Smart Routing for accelerated web apps, Load Balancing for zero-downtime failover
TLS and certificate lifecycle
SSL, Keyless SSL, Advanced Certificate Manager, Custom Domain Protection

Cloudflare One: Workforce & Zero Trust Access

The SASE platform connecting and protecting employees, contractors, AI agents, and infrastructure — identity-first access, SaaS/app protection, and branch and data-center connectivity delivered from 300+ cities.

“Security, connectivity, and code run in 335+ cities around the world” www.cloudflare.com

Mapped capabilities

4 capabilities

Identity-first access without VPN
ZTNA for employees, contractors, and AI agents; blocking lateral movement
SaaS and app protection
CASB coverage of SaaS and internal apps, browser isolation of risky links, web filtering
Network connectivity for sites
Magic WAN linking data centers and branches to the Cloudflare backbone without MPLS; quantum-safe/post-quantum encryption posture
AI agent and MCP governance
Securing connections to MCP servers and governing AI agents as identities; email security

Coverage is mapped from Cloudflare's public pages (8 crawled). Examples are illustrative, not real test cases. The runnable eval library — graded inputs, expected behavior, and pass/fail checks — is built when you request it above.

Frequently asked questions

What do the Corsac evals for Cloudflare test?+

The coverage map is generated from Cloudflare's own public product surface (connectivity cloud: serverless developer platform, CDN/network, and SASE security): 6 scoring areas — Developer Compute & Runtime, Data & Storage Primitives, and AI & Agent Infrastructure, and more — spanning 24 mapped capabilities, each graded on adversarial robustness, workflow quality, safety gates, and operator quality once the library is built.

How are the Cloudflare evals scored?+

Every case generated for Cloudflare — across Developer Compute & Runtime and Data & Storage Primitives and the other mapped areas — is graded with pass/fail checks plus an LLM judge scoring 1–5 against its expected behavior, with critical-severity flags and negative controls. Only judge-passed evals are published.

How many test cases does the Cloudflare library include?+

The full Cloudflare library is built on request. The coverage map spans 6 areas and 24 capabilities (for example, Workers execution model and billing and Stateful and long-running compute under Developer Compute & Runtime); each becomes graded test cases — inputs, expected behavior, pass/fail checks — in your Corsac workspace.

How do I run these evals against Cloudflare or my own agent?+

Request the library with your work email above. We'll build out all 6 mapped Cloudflare areas and set them up in a Corsac workspace, where you can run every test case against Cloudflare or your own agent with your own data.