Cloudflare Zero Trust and a PSA ticket are two different systems. An Access policy can deny a user, a Gateway rule can block a destination, or a Tunnel can drop while the client still has no ticket. Or the opposite: a ticket is open and Cloudflare is already clean. If you auto-open from the first deny event you will duplicate work and thrash DNS, WAF, or Access policies you did not mean to touch.
Live totals from stackjack.io today: 83 connectors / 23,165 tools / 12,593 free forever. Cloudflare is 3,453 tools (1,757 free). Auth is a scoped API token (bearer) in the tenant vault. That is not per-user OAuth PKCE on Cloudflare itself. Per-user PKCE on downstream MSP platforms is still only HaloPSA and NinjaRMM. StackJack member OAuth is on every plan.
HaloPSA on the site today is 1,475 tools. ConnectWise PSA and Autotask work the same way for the ticket side of this.
This is not a connector launch post. This is how I check an Access/Gateway signal against the PSA without inventing a ticket or mutating Zero Trust.
Dry-run first
Agent Runner dry-run is a runtime constraint: write/mutate tools are blocked even if they are in the catalog. Roll the runner with:
- Cloudflare: read Access apps/policies/groups, identity providers, Gateway rules/categories, zones, Tunnel status, analytics where you need them. Deny create/update/delete on Access apps, policies, IdPs, Gateway rules, DNS records, WAF custom rules, certificates, Workers, R2, Magic, and anything that changes production edge config.
- PSA: read tickets, clients, assets. Deny create/update until you promote.
If the runner cannot open a ticket or flip an Access policy in dry-run, that is the point. Cloudflare’s catalog is huge. You do not need 3,453 tools for this workflow.
The query (plain English, then pin tools)
Ask something like:
For client Acme, list recent Cloudflare Access denials and Gateway block events for the last 24 hours (user email, app name, rule id, action, destination if present). For each distinct user or app, search Halo (or CWM / Autotask) for an open ticket that mentions that email, app hostname, rule id, or the same device name. Do not create or update Access policies, Gateway rules, DNS, or tickets. Return event summary, whether a matching ticket exists (ticket id or none), and stop if the zone or account mapping is ambiguous.
Pin a handful of reads. Compact/minimal catalog modes exist if the harness drops tools under a client cap.
Do not invent a client from a zone name that maps to three tenants. Stop and ask. Do not treat a single 403 on an Access app as “break glass and disable the policy.” Read the policy and the ticket first.
Promote only after a human looks
When you promote:
- Required: only the write you intend (create this one ticket, or update this one Access policy / Gateway rule), not bulk edge changes by default.
- Denied: DNS record churn, WAF rule mass edits, certificate replacement, Workers deploys, R2 deletes, and any “open a ticket for every deny in the last hour” loop.
Scoped API tokens matter. Keep the Cloudflare token least-privilege for the accounts you mean. Multiple connections are live, so lab and prod Cloudflare accounts can be separate connections without a per-connection fee. Scope the runner to the connection you mean.
Audit is metadata only (who called which tool, when, success/fail, duration). Access emails and deny reasons pass through. They are not stored.
What this is not
Not “Cloudflare is live, 3,453 tools.” This is Access/Gateway signal vs ticket, dry-run reads, no invent-ticket and no edge mutate until a human says so.
Source: r/StackJack · by /u/stackjack_ceej