Agent Feedback: Cloudflare account-scoped calls can mistake connection identity for account ID

[aryasaatvik]

Context

I was using Codex desktop with Executor MCP's execute tool while upgrading a self-hosted Executor Worker. The workflow needed to inspect the connected Cloudflare Worker before deployment.

What happened

1. Executor's connection inventory returned the Cloudflare connection cloudflare_api.org.connection with a health identity value like b722….
2. I used that value as account_id for workers.listWorkers.
3. Cloudflare returned HTTP 403 / error 10000 (authentication error) on repeated attempts, and the returned recovery guidance suggested reauthenticating or rotating the connection.
4. I then used the same Executor MCP connection to list accessible Cloudflare accounts. It returned one account with a different ID, like 210c….
5. Retrying the same Worker request with that account ID succeeded immediately.

Source of confusion

The connection-health identity field looked like a plausible account identifier, but it did not match the Cloudflare account ID accepted by account-scoped Worker calls. The failure presented as an authentication problem even though the same connection remained valid.

Impact

This delayed live Worker reconciliation and initially made credential rotation look necessary. Wrangler checks performed afterward could access the same Cloudflare account, its Worker, and its D1 database successfully.