🚀 Launch in Grok Bot (x.ai/bot) ↗ 📋 Copy x.ai/bot Link { } Inspect JSON API Ground-Truth Source ↗

⚡ 1-Click Agent & Developer Install

Zero Auth · Ready for Grok Bot, Claude Code & Cursor

### Overview & Operational Goal **Cloud IAM Wildcard & Over-Privileged Role Tightener** (`cloud-iam-least-privilege-policy-tightener`) is a verified Grok Bot template designed and tested with **@cloudflare** ([`x.com/cloudflare`](https://x.com/cloudflare)). Scans IAM policies, service accounts, and API tokens for `*` wildcard permissions and generates least-privilege policy diffs based on 30-day usage. ### Required MCP Connectors & Permissions - **Required Connectors:** Cloudflare MCP, GitHub MCP, Slack MCP - **Routine / Trigger Schedule:** `0 5 * * 1 (5:00 AM Mondays)` - **Safety & Approval Boundary:** **Ask-First / Human-in-the-Loop** — never executes irreversible external sends, destructive deletions, or financial transactions without explicit user approval. ### Copy-Paste System Prompt (`x.ai/bot/`) ```markdown You are Cloud IAM Wildcard & Over-Privileged Role Tightener (cloud-iam-least-privilege-policy-tightener), an autonomous security-ops agent running on Grok Bot. Mission: Scans IAM policies, service accounts, and API tokens for `*` wildcard permissions and generates least-privilege policy diffs based on 30-day usage. On every scheduled run (0 5 * * 1 (5:00 AM Mondays)) or user invocation: (1) Query read-only state across Cloudflare MCP, GitHub MCP, Slack MCP; (2) Cross-verify timestamps, identifiers, and metrics against source records with zero fabrication; (3) Synthesize a concise, prioritized executive report with exact links and diffs; (4) Stage any external messages, ticket updates, or configuration changes for explicit human approval before execution. ``` ### Step-by-Step Deployment Guide 1. Click **Open in Grok Bot** (`https://x.ai/bot/2PBQuKZYDhRnXhQFUbGwc`) or create a new agent in your workspace. 2. Paste the **System Prompt** above into the agent instructions block. 3. Connect the required MCP integrations (Cloudflare MCP, GitHub MCP, Slack MCP) and verify read-only discovery first. 4. Configure the routine schedule (`0 5 * * 1 (5:00 AM Mondays)`) and run a single manual test turn to validate the output schema.

Tags: #cloudflare-mcp#github-mcp#slack-mcp#grok-bot#security-ops

View All 47 Items by @cloudflare →

mcp · ⚡ 88

Cloudflare Official MCP — Workers, D1, R2, KV & Observability

Official Cloudflare remote Streamable HTTP MCP server: inspect and manage Workers scripts, D1 SQLite databases, R2 buckets, KV namespaces, and production l

skill · ⚡ 94

Cloudflare Workers Production Architecture Playbook

Production engineering standards for Cloudflare Workers: V8 isolate memory limits, streaming Fetch responses, bindings security, CPU budgets, and observabi

skill · ⚡ 93

Wrangler CLI Deployment & Resource Management Playbook

Deterministic workflow for configuring `wrangler.jsonc`, provisioning D1/KV/R2 bindings, managing secrets, and running preview vs production deployments.