Cloudflare open-sources Cloudflare OS, its internal agent platform
Every organization runs on a mission that gets passed down to its people through terminology, procedures, systems and standards. Coding agents have been able to lean on a built-in check for that work over the last couple of years: code either runs or it doesn't. Extending the same advantage to the rest of a company's work (documents and slides, relationships, outcomes in the physical world) is harder. An agent first has to understand how the company works, then needs a safe way to reach the systems people actually use to do their jobs.
Cloudflare's answer is Cloudflare OS, a workspace that gives each employee an agent built around their own company's context. Cloudflare gave every person at the company access to the first version this past May. Thousands of people across every function, many of them outside engineering, now use it daily to draft documents and slides, automate repeatable tasks and build small internal apps. The platform also holds a shared library of context and skills that teams at Cloudflare have written: when one person works out a better way to handle a recurring job, everyone else can reuse it instead of re-explaining the process to a model each time.
Today Cloudflare is open-sourcing a rebuilt version of that platform so any organization can deploy it, connect it to their own internal systems and customize it. The rebuild follows lessons from running the first version internally, which Cloudflare's CIO, Sam Rhea, covers in a separate post. That first version centered on private, individual workspaces. Its apps were static snapshots rather than live software wired into internal systems, and some deterministic jobs still had to rerun a whole agent skill, burning more model tokens than necessary.
A harder problem showed up once people started collaborating: access to an MCP server revealed which tools an agent was allowed to call, but not which underlying data it had actually observed. Once workspaces, apps and outputs started getting shared, Cloudflare needed a way to guarantee that collaboration itself could not expose information someone was not permitted to see. So the rebuilt version puts security into the platform itself, rather than leaving each app builder to implement it correctly on their own.
The rebuilt Cloudflare OS combines three parts: an agent workspace grounded in a company's own curated context and skills, with an isolated runtime where agents can write and run code; a new security and governance framework for safe access to internal data and services; and a platform for personal, modifiable apps that people can build, share and keep changing. A single conversation can turn into a document, an app, or a workflow that keeps doing the work on its own.
The agent workspace runs in the browser, so using it does not require being a developer or knowing a terminal. It bundles agent sessions, persistent state, outputs and files, resource access and an isolated code runtime, and it comes preloaded with whatever context and skills a team has curated. People can ask a workspace to research a question using company context and connected resources, with the agent writing code to search, filter, join and analyze information instead of pulling an entire dataset into the model's context window.
That research can become a document, presentation or spreadsheet that stays connected to live data and can still export to familiar formats or services such as Google Drive, or it can become a full collaborative app with its own interface, logic and state that a team shares. For jobs that are mostly a known sequence of steps with only a couple of places where judgment matters, a workspace can turn the job into a mostly deterministic workflow: code handles the predictable parts, a model is used only where it adds value, and the workflow can run on demand, on a schedule, or when an event fires in a connected system. Access to internal systems of record runs through what Cloudflare calls Gatekeepers, and the platform also plugs into an organization's existing Model Context Protocol servers through what it calls MCP Server Portals.
The security design starts from a practical complaint: once people begin experimenting with AI at work, one of the first things they usually ask for is API keys to company systems, and handing those out does not scale, because keys tend to grant broad, long-lived access that is hard to constrain, share safely or audit. An MCP server is a better fit, since it can hold the credential itself and expose only a defined set of tools rather than handing the key to the agent directly. But Cloudflare argues that controlling which tools an agent can call is only the first step: it says nothing about which underlying resources the agent has actually observed, and an agent can combine information across systems, forward it somewhere less restricted, or surface it through an app or output to someone who was never allowed to see the original resource. In Cloudflare's framing, authorization has to account for where data can go next.
Inside Cloudflare OS, agents and apps start with no access by default. An agent has to ask for access to a specific resource, which a person can grant or deny; once granted, generated code receives that resource as a typed capability, and the underlying credential never reaches the agent or its generated code. Server code runs inside a Dynamic Worker with outbound networking to the open internet disabled, and client code runs in a sandboxed browser frame; neither can reach the internet except through capabilities explicitly granted to it. A Gatekeeper is a service-specific Worker that sits between Cloudflare OS and an external service and understands that service's API, resources and operations. For GitHub, for example, a Gatekeeper can scope access to a single repository, allow reading issues while blocking source code, mask particular fields, apply rate limits and require approval before an agent can merge a pull request. The agent and its apps see only a small TypeScript API; the Gatekeeper itself handles OAuth, holds the credential, enforces policy, logs what was read and mediates anything with an externally visible side effect.
Cloudflare OS also records every resource an agent observes and keeps that observation log attached to the agent and its output, so when someone else opens a shared workspace, talks to the agent, or views what it produced, Gatekeepers check that person's own access against everything the agent has seen. That is meant to close a specific gap the company describes directly: an agent reads a sensitive table in a data warehouse to build a live dashboard, and sharing that dashboard must not become a way to hand the underlying table to someone who could not access it directly. The same observation log also feeds policy on when an agent can act outward at all. Having read sensitive data can block that agent from writing to certain destinations, inviting new collaborators, handing work to another agent, or making any outbound request.
The third piece lets people build and share their own software instead of picking from a fixed menu of documents, spreadsheets and presentations. In Cloudflare OS, each file can be its own full application, written by an agent for one person, one project or one team, and it does not need to be exported or redeployed elsewhere to become real. Apps are private by default but can be shared like a document. Building one gives the agent two jobs: client code that renders the app's interface in the browser, and server code that stores state and implements its behavior. The server loads on demand as a Dynamic Worker and runs as a Durable Object Facet, two pieces of infrastructure Cloudflare says it built specifically for this project. The facet gives each app its own SQLite database, kept separate from the Cloudflare OS runtime that manages it, and because Dynamic Workers use lightweight V8 isolates, every app gets its own isolated runtime without needing a dedicated server or container standing by.
The browser client talks to the server through Cap'n Web, Cloudflare's own open-source, object-capability RPC system, which lets a server method be called from the client like an ordinary JavaScript function. The agent can call that same method, so a tool someone builds for their own use becomes something the agent can operate on their behalf even when they are not around. There are two ways to share an app: sharing the live app lets other people collaborate on the same state in real time, while sharing a blueprint gives someone else their own independent copy, carrying over the original app's code but none of its SQLite data, conversation history, credentials or connected resources.
Key facts
- Cloudflare gave every employee access to the first version of Cloudflare OS this past May; thousands of people across every function, many of them outside engineering, now use it daily to write documents and slides, automate repeatable tasks, and build small apps.
- The rebuilt version, now open-sourced, combines three parts: an agent workspace built on a company's own curated context and skills, a new security and governance framework, and a platform for building and sharing modifiable apps.
- Every agent and app starts with zero access. An agent must request access to a specific resource, which is granted as a typed capability, and neither its server code (in a Dynamic Worker) nor its client code (in a sandboxed browser frame) can reach the internet except through capabilities explicitly granted.
- Service-specific Gatekeepers mediate every external system: a GitHub Gatekeeper, for example, can scope an agent to one repository, allow reading issues but not source code, mask fields, apply rate limits, and require approval before merging a pull request.
- Cloudflare OS logs every resource an agent has observed and checks that log before anyone else can view a shared workspace or its output, so a dashboard built from a sensitive database table cannot leak the table itself; apps can be shared live with shared state, or handed out as a blueprint that starts with independent data and no credentials.
Why it matters
AI coding agents have made rapid progress because code supplies a built-in feedback loop: it runs or it doesn't. Cloudflare's bet is that the same effect can extend to the rest of a company's work (documents, decisions, internal systems) if agents get durable context about how the company operates plus governed access to the tools people already use. Cloudflare says thousands of its own employees, most of them outside engineering, already work this way every day. The more interesting shift is architectural, not a matter of model quality. Cloudflare says the real problem it hit while scaling this internally was authorization: knowing which tools an agent could call said nothing about which data it had actually seen, and once outputs started getting shared between people, that gap could leak information nobody meant to expose. Making resource-observation tracking a first-class part of the platform, instead of something each app builder has to get right alone, is the idea being open-sourced today.
Who it affects
Organizations that want to deploy their own instance and connect it to internal systems, rather than individual consumers: Cloudflare is releasing this as infrastructure that other companies self-host and customize. Inside Cloudflare itself, thousands of employees across every function, not just engineers, already build on it daily to draft documents, automate tasks and build small internal apps. Engineering and platform teams evaluating it elsewhere would be the ones writing Gatekeepers for each internal service, such as GitHub or a data warehouse, or wiring in MCP servers they already run, and deciding what access to grant. People who build small internal tools are affected directly too: the model lets someone build an app for their own use that an agent can later operate on their behalf.
How to use it
Cloudflare is open-sourcing the rebuilt platform so any organization can deploy it, connect it to their own internal systems and customize the interface, though this material gives no license name, price, or hosting cost. In practice, a team would deploy Cloudflare OS, connect internal systems either through purpose-built Gatekeepers or through existing MCP servers via MCP Server Portals, and grant agents access resource by resource instead of handing out standing credentials. From there, people work through a browser conversation that can turn into a document, spreadsheet, presentation, a mostly deterministic workflow, or a full custom app that can be shared live or handed out as a reusable blueprint.
How solid is it
This account comes entirely from Cloudflare's own announcement of its own product, not an independent audit. The usage figure it gives is vague, thousands of employees rather than an exact headcount, covering roughly the period since this past May, with no year stated in the retrieved text. Cloudflare's CIO, Sam Rhea, is cited as having written a separate post on lessons from the first version, but that post is outside this text and was not checked here. The retrieved article is also cut off mid-sentence near the end, while still describing how shared apps can be modified, so any closing detail, a repository link, a license name, or availability terms, is not visible in what was reviewed. On Hacker News, the story reached 501 points and 252 comments within about 15 hours, a strong engagement signal, but that measures attention, not independent verification of how the system behaves in production.
Risks and caveats
The whole access model depends on Gatekeepers being written carefully for every connected service. A Gatekeeper is what actually enforces scoping, field masking, rate limits and approval steps, so a loosely built one for a given service reopens the broad-access problem Cloudflare built this to close, and the source gives no detail on how much work that takes per integration or how it gets tested. This material gives no pricing, licensing or support terms, so the cost and legal terms of self-hosting are unknown from what was reviewed. The account is also based only on Cloudflare's own internal use since this past May; how the system holds up once outside organizations connect their own, likely messier, mix of internal systems is untested by anything in this article. The piece does not name the other AI tools it implicitly compares itself to, so that framing should be read as Cloudflare's own positioning rather than a neutral comparison.
“Inside, every agent and app starts with access to nothing.”
— the Cloudflare OS announcement