# Cloudflare Stack

In the [AI Enablement Stack](/docs/introduction/ai-enablement-stack), **Blekline is Layer 4** and **Cloudflare is Layer 1** (Containers, Sandbox SDK, and edge Workers).

| Layer | Product | Role |
|-------|---------|------|
| **L4** | Blekline | Mask prompts, classify risk, govern MCP tool calls, audit |
| **L1** | Cloudflare | Sandbox SDK, Containers, Dynamic Workers, global edge |

## Wiring

1. Connect `@blekline/mcp-proxy` — [MCP proxy](/docs/mcp/proxy)
2. Use [Cloudflare Sandbox SDK](https://developers.cloudflare.com/sandbox/) or [Container MCP](https://containers.mcp.cloudflare.com/mcp) for agent environments
3. Provide `CLOUDFLARE_API_TOKEN` with appropriate scopes

```bash
export BLEKLINE_DOWNSTREAM_MCP_COMMAND="..."   # your Container MCP or custom bridge
export BLEKLINE_DOWNSTREAM_SERVER=cloudflare
export CLOUDFLARE_API_TOKEN=...
```

**Flow:** L5 Agent → L4 Blekline proxy → L1 Cloudflare sandbox / container MCP.

See [Cloudflare Sandboxes GA](https://developers.cloudflare.com/changelog/post/2026-04-13-containers-sandbox-ga/) and [Code Mode MCP](https://blog.cloudflare.com/code-mode/).

---

**Next steps:** [Sandbox providers](/docs/integrations/sandbox-providers) · [AI Enablement Stack](/docs/introduction/ai-enablement-stack) · [MCP Cursor setup](/docs/mcp/cursor) · [Open workspace](https://app.blekline.com)