Integration Guide
Connect Cloudflare to Hermes Agent or OpenClaw with Composio
Give your agent access to Cloudflare DNS tools, check that it can read the right domain, and use the records from your website host to finish a custom-domain setup.
Which Cloudflare card should you connect?
For an agent that needs to list or edit DNS records, start with Cloudflare in Dashboard → Integrations. Search for cloudflare. Several similarly named results have different purposes:
| Integration | What it is for | Choose it for this setup? |
|---|---|---|
| Cloudflare | Zone discovery and DNS record operations. | Yes — this guide uses this toolkit. |
| Cloudflare Api Key | A separate toolkit with DNS and ruleset operations. | Also supports DNS; check its own fields and tool names. |
| Cloudflare Browser Rendering | Remote browser tasks such as screenshots and scraping. | Use it when you need browser rendering. |
| Cloudflare MCP | A separately listed connector. | If marked “Not available yet,” choose an available DNS toolkit above. |
Composio documents the available actions for Cloudflare, Cloudflare Api Key, and Browser Rendering. The names and availability above were checked on September 14, 2026. AWS CloudFront is a different service. Cloudflare AI Gateway is also a separate setup, used to route model requests.
1. Connect the Cloudflare account
These dashboard steps are the same for managed Hermes Agent and OpenClaw. Have a running instance and access to the Cloudflare account containing your domain. The managed connection uses the built-in Composio integration; you do not need to configure an MCP server in your instance just to use this dashboard flow.
- Open Integrations, search for Cloudflare, and click Connect on the Cloudflare card.
- Read the credential labels. The form checked for this guide asks for Cloudflare Global API Key and Cloudflare Account Email.
- In another tab, open Cloudflare → My Profile → API Tokens. Under API Keys, find Global API Key and select View.
- Complete the verification Cloudflare requests. If it sends an email code, enter that code on Cloudflare and then reveal the key.
- Copy the key into the connection form and enter the email you use for that Cloudflare login. Click Connect and wait for the card to show Connected.
The form submits your Cloudflare credentials to Composio to establish the connection. Keep them out of the conversation with your agent. An email verification code belongs in Cloudflare's verification prompt, not in the API key field.
2. Check access before changing DNS
Send your agent a request with a concrete domain and a read-only first step:
Use my connected Cloudflare integration. Find the zone for example.com and list its current DNS records. Show the record types, names, targets, and proxy status. Do not change any records yet.
Replace example.com with your domain. A successful result identifies the correct zone and returns its records; a new zone can legitimately have an empty list. The dashboard's Connected badge confirms the account connection, while this check verifies that your agent can actually use the required tools.
On managed instances, an agent can inspect the built-in integration with these commands. They are available on both managed frameworks; they are not commands you need to run in your phone browser.
composio connections
composio search cloudflare list zones
composio search cloudflare DNSThe Cloudflare toolkit includes CLOUDFLARE_LIST_ZONES and CLOUDFLARE_LIST_DNS_RECORDS. Have the agent read the current action schema before supplying parameters. If you connected Cloudflare Api Key, its toolkit slug is cloudflare_api_key and its actions have a different prefix.
3. If your goal is a custom website domain
Cloudflare controls DNS. Your website host controls which site answers for a hostname and provisions its certificate. Complete both sides. An existing address such as a provider's app subdomain does not tell the agent which A record or verification token your custom domain requires.
- Open the site in your hosting dashboard and add the custom domain. For an OpenClaw Launch website, use Website → the site's Domains control.
- Copy the DNS instructions generated for that site and domain. Use the actual record types, names, and values displayed there.
- Ask the agent to compare those instructions with existing Cloudflare records and show the proposed changes. Preserve unrelated mail and verification records.
- Apply the records, run the host's domain verification, and wait for its verified status.
- Open the custom domain over HTTPS and confirm that the intended website appears. Check
wwwseparately if you also configured it.
OpenClaw Launch: an apex domain uses the TXT + A option
For a root domain such as example.com, select TXT + A (for apex domains) in the custom-domain dialog. The example below shows where the dashboard's values go; it does not supply values you can reuse.
| Type | Name in Cloudflare | Value | Proxy / TTL |
|---|---|---|---|
| A | @ | The server IP shown for your site | DNS only / Auto |
| TXT | _openclaw-verify | The verification token shown for this domain | DNS only / Auto |
Cloudflare flattens an apex CNAME, so the TXT + A option provides a separate ownership check. For subdomains, follow the CNAME instructions in the dialog. Keep records DNS only for this setup and use the hostname and target provided by the dashboard. Other website hosts may require different records. See the custom-domain guide for the hosting flow and plan requirements.
Self-hosted: connect your own Composio MCP server
This is a separate route for installations you operate yourself. In your own Composio dashboard, configure a Cloudflare toolkit, connect the Cloudflare account for the intended user, and select the tools your MCP server exposes. Copy the generated URL for that user. The examples below use Composio Platform MCP, whose x-api-key header takes a Composio project API key. Do not put your Cloudflare Global API Key in that header.
Set COMPOSIO_API_KEY in the environment available to the process running your agent. Replace the URL placeholder with the complete dashboard-generated URL, including its user identifier. These examples assume MCP API-key authentication is enabled, as it is by default for new Composio organizations.
Hermes Agent
Add this entry to ~/.hermes/config.yaml, merging it with any existing mcp_servers mapping. Hermes can load the environment variable from ~/.hermes/.env.
mcp_servers:
composio:
url: "YOUR_DASHBOARD_GENERATED_COMPOSIO_MCP_URL"
headers:
x-api-key: "${COMPOSIO_API_KEY}"Run hermes mcp test composio to check discovery. In an active Hermes CLI session, use /reload-mcp to load changes, or start a new session. See the official Hermes MCP guide for the supported configuration and reload behavior.
OpenClaw
OpenClaw's native MCP registry, verified in release 2026.9.1, uses mcp.servers in ~/.openclaw/openclaw.json. Merge the entry with your existing configuration:
{
"mcp": {
"servers": {
"composio": {
"url": "YOUR_DASHBOARD_GENERATED_COMPOSIO_MCP_URL",
"transport": "streamable-http",
"headers": {
"x-api-key": "${COMPOSIO_API_KEY}"
}
}
}
}
}Run openclaw mcp doctor composio --probe to check the connection. Ensure the Gateway service receives the environment variable, then restart that service after changing its environment and begin a new agent session. If your installed version does not recognize openclaw mcp, update to a release that supports the native registry before using this configuration. Native MCP and the older mcporter configuration are separate. See the official OpenClaw MCP reference and release configuration schema.
Troubleshooting
| Symptom | What to check |
|---|---|
| Cannot reveal a Global API Key | Check that your Cloudflare account email is verified and complete the verification prompt on Cloudflare. |
| Connection rejected | Match the key type and account email to the form. Check for an incomplete copy, a changed key, or an error asking you to reconnect. |
| ACTIVE connection returns a Latin-1 encoding error | Check whether a credential field contains pasted non-Latin-1 characters. Re-enter the exact credential in the connection form. ACTIVE status alone does not verify that Cloudflare accepts it. |
| Two connections exist, but the same error keeps returning | Have the integration operator test each connection with an explicit connected-account ID in a read-only Composio request. Confirm that the agent's connection selector is actually forwarded. Once a working connection is verified, disable the broken duplicate and test the agent's normal route again. |
| Connected, but the agent cannot find DNS tools | Check the connected toolkit name and current connection list. Browser Rendering has no DNS tools. Ask the agent to search the DNS toolkit rather than invent a tool name. |
| The domain is missing from the zone list | Confirm that the connected Cloudflare user has access to the account containing that domain. |
| DNS exists, but domain verification fails | Compare record names and values with the hosting dialog, check proxy status, and confirm the domain uses the assigned Cloudflare nameservers. Allow DNS updates to propagate before verifying again. |
| The agent asks for the hosting dashboard login | A Cloudflare connection does not sign it in to your website host. Add the domain there yourself or provide access through the host's supported connection flow. |
Cloudflare connection FAQ
Does the Cloudflare Composio integration work on Hermes Agent?
Yes. Managed Hermes Agent and OpenClaw instances use the same OpenClaw Launch Integrations page to connect Cloudflare. Self-hosted installations need their own Composio connection and a compatible MCP client configuration.
Which Cloudflare integration should I choose for DNS?
Choose Cloudflare for the walkthrough below. Cloudflare Api Key is a separate toolkit that also offers DNS tools. Cloudflare Browser Rendering is for tasks such as screenshots and scraping, not managing DNS records. CloudFront is an AWS product and is not the Cloudflare integration.
Can I paste a scoped API token into the Global API Key field?
No. Use the credential type the connection form explicitly requests. The Cloudflare form checked for this guide asks for a Global API Key and the Cloudflare account email. A scoped API token uses a different authentication method; use a token-compatible integration if you need that route.
Does connecting Cloudflare automatically publish my custom domain?
No. The connection lets the agent call Cloudflare tools. You must also add the domain to your website host, create the exact DNS records supplied by that host, complete its verification, and check the website over HTTPS.
Do I send my Cloudflare key to the bot in chat?
Enter it in the connection form instead. Keep keys out of chat messages, screenshots, source code, and public pages. The Cloudflare credential authorizes Cloudflare access; a Composio project key, when required for self-hosted MCP, authenticates a different connection.