Cloudflare OS: Here’s What’s Inside the Open-Source AI Agent Platform

Cloudflare built the first version of Cloudflare OS for itself. In May, the company gave every one of its thousands of employees access, CEO Matthew Prince wrote, and people outside engineering started using it to draft documents, build slides, and automate repeatable work. Now Cloudflare is open sourcing a rebuilt version that any organization can deploy and connect to its own internal systems.

“The security had to be part of the platform, not something every person building an app or using an agent has to implement correctly,” the company said in its announcement. That’s the real product.

What’s actually inside

Cloudflare OS combines three parts. First, there’s an agent workspace that grounds each conversation in your company’s curated context and skills, with an isolated runtime where the agent can write and run code. There’s also a security and governance framework, new in this version, which sits between agents and your systems of record. And, lastly, there’s a layer for personal, modifiable apps that lets a workspace turn a chat into a document, a workflow, or a small full-stack app.

Cloudflare’s CIO Sam Rhea laid out how the company approached security in this agentic-powered experiment: handing API keys to people and agents is dangerous and doesn’t scale, because keys give broad, long-lived access that’s hard to constrain or audit. Instead, agents start with access to nothing. So they request a specific resource, and a Gatekeeper — a service-specific Cloudflare Worker — mediates. The credential never touches the agent or its code.

That’s a cleaner model than MCP alone. Model Context Protocol tells an agent which tools it can call, but not which underlying resources it has actually seen. Cloudflare OS logs every observation and checks a person’s access before they can open a workspace or view what an agent produced.

Each app an agent builds is a real Cloudflare Worker, riding on Dynamic Workers and Durable Object Facets the company built for this project, talking to the client over Cap’n Web, its open-source object-capability RPC system. “If you can build a tool to do a job yourself, agents can use your tool to do the job when you’re not there,” the post notes.

It’s a strong vision, but some users may still be skeptical: Cloudflare OS is a Cloudflare product, so the agents, apps, and governance it sells you to run all live on Cloudflare’s edge. The “open” in open source gets you the code; the runtime still is controlled by a central entity.