Protect yourself from runaway Cloudflare spend

Deploy Brolly to your Cloudflare account

Install Brolly in the Cloudflare account you want to protect. When deployment finishes, open your private dashboard and sign in with Cloudflare.

1. 1Deploy to Cloudflare.

   Choose your Cloudflare account and a name for the Brolly Worker, then click Deploy.

2. 2Open Brolly and sign in.

   Visit the private Brolly URL created for you and authorize the Cloudflare account you want it to protect.

3. 3Review what Brolly found.

   See your Workers, Durable Object namespaces, individual objects, current usage, and any monitoring gaps.

4. 4Choose your protection.

   Connect labeled channels, arrange alert levels, set per-level limits, and review action eligibility.

Set period limits throughout the resource hierarchy

Choose one shared risk tolerance curve for every alert level. Each empty chart starts from the median historical usage for its scope. Daily limits use the account timezone. Cycle limits use reconciled Cloudflare boundaries. Saved chart values remain independent of later tolerance changes.

A zero-I/O deployment fuse

Monitoring works without application changes. Exact Worker and Durable Object quarantine uses the tiny @standardagents/brolly-runtime package. Its hot path only parses a deployment binding and compares IDs. It performs no HTTP, KV, D1, or Durable Object storage operation.

pnpm add @standardagents/brolly-runtime

One line in a Durable Object constructor

constructor(ctx: DurableObjectState, env: Env) {
  super(ctx, env)
  brollyDurableObject(ctx, env)
}

Stop ingress before waking the object

brollyWorker(env)
const id = env.ROOMS.idFromName(name)
brollyWorker(env, { durableObjectId: id.toString() })
return env.ROOMS.get(id).fetch(request)

Wake the people who can respond

Configure Cloudflare Email, Discord, Postmark, Resend, Slack, Twilio SMS, or a generic HTTPS webhook with labeled channels and reusable provider accounts. Cloudflare Email, Resend, and Postmark channels can group multiple recipients under one label. Channels sharing a provider account remain distinct groups. Twilio uses one destination number per channel.

DiscordStructured incident webhooks

SlackIncoming webhook summaries

Email, SMS, and webhooksCloudflare Email, Resend, and Postmark support recipient groups. Twilio uses one destination number per channel. Generic HTTPS delivery uses an endpoint.

The monitor must not become the runaway workload

Every pass defaults to hard limits of 300 GraphQL dataset queries, 50 REST requests, 100,000 D1 rows read, 50,000 D1 rows written, and 45 seconds. Operators can configure each ceiling within a fixed product maximum. Durable Object and Worker usage is collected in stable 10,000-row pages without waking objects or reading customer storage.

• Unknown telemetry raises a coverage incident. Brolly never records it as zero or healthy.
• Brolly and its notification path are protected from automatic shutdown.
• Projected dollars never authorize a stop; automatic action requires fresh raw usage.
• Controls preserve resources and data and record rollback state before execution.