Agents that know the company, not just the prompt
Organizations pass down their mission, terminology, procedures, and systems to their people. Those people combine that context with their own judgment to do work. Until recently, AI agents replicated only the narrowest slice of this: code that either runs or doesn't. But most work — documents, slides, spreadsheets, dashboards, and shared responsibilities — doesn't come with a compiler to validate it.
Cloudflare OS is Cloudflare's answer to bringing agent leverage to the rest of the organization. It gives each person an agent and workspace built around how the company works, what it knows, and the systems it relies on. Since May, thousands of Cloudflare employees across every function have used it to create documents, automate repeatable jobs, and build small data apps.
The version being open sourced today is a rewrite based on what that internal rollout taught Cloudflare. The first version was built around individuals in private workspaces using static apps and deterministic skills that consumed model tokens on every run. Collaboration exposed a deeper issue: an MCP server reveals which tools an agent can call but not which underlying resources it has actually observed. Sharing a workspace, app, or output could silently leak data someone wasn't permitted to see.
Cloudflare rebuilt the platform on a new foundation where authorization is handled by the platform rather than by each app or prompt author. The goal is software that belongs to the company running it — customize the interface, connect internal tools, add company-specific context and skills.
Cloudflare OS combines an agent workspace, a security framework, and a platform for building modifiable apps.
The workspace
Each user gets a browser-based workspace, so no terminal or developer background is required. The workspace bundles agent sessions, persistent state, output files, resource access, and an isolated runtime for generated code. It comes loaded with the context and skills the organization has curated, meaning workers no longer explain their procedures and terminology anew for each task.
The workspace handles several classes of work:
- Research: an agent writes code to search, filter, and analyze data rather than pulling entire datasets into a context window.
- Documents and more: research turns into docs, slides, or spreadsheets that remain connected to live sources and can be exported to formats or services such as Google Drive.
- Collaborative apps: when a static file isn't enough, the agent builds an app with its own interface, state, and logic that supports multiple users.
- Deterministic workflows: recurring jobs run as code with a model called only at the steps needing judgment, either on demand or on a schedule.
Apps and agents reach systems of record through Gatekeepers. Existing MCP servers are also supported via MCP Server Portals.
Security built into the platform
The natural first request from someone experimenting with AI at work is an API key. That is a bad idea: keys grant broad, durable access that resists fine-grained control and auditing. MCP improves this by holding credentials server-side and exposing only defined tools, but tool-level control is insufficient. No part of MCP tracks which resources an agent actually observed, and those observations can be exfiltrated through sharing or less restricted agents.
Cloudflare OS therefore starts every agent and app with access to nothing. Cloudflare Access gates who reaches the OS itself. An agent can request access to a resource, and a human decides. Once granted, generated code receives that resource as a typed capability binding — env.PROJECT, in the example block — without ever seeing the underlying credential.
Unrestricted outbound networking is disabled: server code runs in a Dynamic Worker, and client code in a sandboxed browser frame. Neither reaches the Internet except through explicitly provided capabilities.
Between the OS and external services sits a Gatekeeper, a service-specific Worker. Given a service API, it understands resources, permissible operations, and policy. Rather than granting access to an entire GitHub account, a Gatekeeper might allow access to a single repo, permit reading issues without source code, mask fields, and require approval for pull request merges. It also handles OAuth, holds credentials, logs reads, and mediates observable side effects.
Read-time policy is insufficient, though. Cloudflare OS logs every resource any agent observes and keeps that observation log attached to the agents and their work. If another user opens the workspace, chats with the agent, or views a produced dashboard, the platform checks that user's access to the observed resources. Agents that have read sensitive data can also be prevented from writing to risky sources, adding collaborators, handing off to other agents, or making external requests.
Apps with their own state, shareable by blueprint
Traditional productivity suites offer a fixed menu: docs, sheets, slides. In Cloudflare OS, each file can be its own full-stack application written for one person, team, or project. Each lives with its own SQL materialized, scoped client and server code — an app without a dedicated server or container.
The server half is loaded as a Dynamic Worker and instantiated as a Durable Object Facet, giving the app SQLite storage separate from the runtime that hosts it. Callable client traffic flows with object-capability RPC via Cap'n Web. That gives these apps much of the same reachability as Cloudflare's core platform.
Agents can also invoke these methods. When an agent writes such an app, it can register callable hooks between it and anything the user has.
App sharing works two ways. Sharing the running app lets collaborators work together in real time over the same state. Sharing a blueprint gives collaborators a code template and schema for their own copy — no conversation history, credentials, live resources, or data move. Those fresh apps can then be modified with AI by their new owners, eschewing the feature-request queue.
Self-service means that when a teammate finds a better workflow, the platform itself creates that resource for others.
Model routing and cost control built in
Cloudflare OS is model-agnostic. Every inference request passes through Cloudflare AI Gateway, which gives administrators a single control point for deciding which models are permitted and which model should handle a particular task.
The rationale is straightforward: summarizing a batch of unread emails does not require a frontier model. AI Gateway enables policies that reserve expensive models for the most demanding workloads, so cost scales with task complexity rather than defaulting to the biggest option available.
Every request is traced back to the person, team, or workspace that issued it. That attribution lets administrators monitor inference spend, establish budgets and rate limits, and define the behavior when any of those thresholds is hit.
Built to be forked, not patched
Cloudflare OS is open source and available now in the cloudflare-os GitHub repository. You can deploy it into your own Cloudflare account, connecting it to your existing Access policies, AI Gateway configuration, data, and integrations.
Cloudflare's internal deployment is shaped by Cloudflare's own systems, terminology, and workflows. The project is designed so your deployment can reflect your organization in the same way—without maintaining a fork of the core.
Two repositories are released together. The Cloudflare OS core contains the product itself, while the example deployment mirrors how Cloudflare runs it internally. The deployment repository consumes the core without patching it, providing a dedicated space for configuration, custom UI, internal integrations, analytics, and deployment pipelines.
Customizing the interface, adding organization-specific Gatekeepers, and building bespoke features are all intended to happen at the deployment layer, leaving the core intact.
Partners for the parts that are not code
Source code is only one ingredient. The institutional context, skills, workflows, and policies surrounding the platform determine how useful it is in practice.
Cloudflare's strategic partners, Presidio and Happy Cog, handle that layer. They work with organizations to customize Cloudflare OS around existing operations and manage the rollout across a workforce.
Partner engagements can include curating shared skills and context, building custom interfaces, wiring internal systems through Gatekeepers and MCP Server Portals, and configuring security, model, and cost controls. The end result is a branded Cloudflare OS instance that is connected to your systems, running on Cloudflare, and tailored to how your people work.
Availability and next steps
Cloudflare OS is live on GitHub. You can inspect the source, try the demo, or deploy into your own Cloudflare account via the starter repository, which is designed to get you running in minutes.
The roadmap includes a fully managed version of Cloudflare OS inside the Cloudflare dashboard, support for containers in development workflows, and extending workspaces into Slack and other chat tools.
Organizations that want to discuss a deployment directly with the team can reach out through this form.
