Cloudflare has open-sourced Cloudflare OS, its AI agent platform, after first building and using it internally. CEO Matthew Prince wrote that the company gave access to thousands of employees in May, and use quickly spread beyond engineering as staff used it to draft documents, build slide decks, and automate repeatable work. The company is now releasing a rebuilt version that it says any organization can deploy and connect to its own internal systems.
In its announcement, Cloudflare said, "The security had to be part of the platform, not something every person building an app or using an agent has to implement correctly." The company framed that as the real product at the center of the release.
Three parts make up Cloudflare OS
Cloudflare OS is structured around three components. The first is an agent workspace that grounds each conversation in a company’s curated context and skills, while also providing an isolated runtime where the agent can write and execute code. The second is a security and governance framework, introduced in this version, that sits between agents and systems of record. The third is a layer for personal, modifiable apps, allowing a workspace to turn a chat into a document, a workflow, or a small full-stack application.
Gatekeeper sits between agents and sensitive systems
Cloudflare CIO Sam Rhea described how the company approached security in what he called an agent-powered experiment. Handing API keys directly to people or agents is risky and does not scale well, he said, because those keys often grant broad, long-lived access that is difficult to limit or audit. Cloudflare’s alternative starts agents with access to nothing. When an agent needs a specific resource, it requests it, and a Gatekeeper handles the interaction. Cloudflare describes Gatekeeper as a service-specific Cloudflare Worker. The credential never touches the agent or its code.
Cloudflare argues that this is cleaner than relying on MCP alone. Model Context Protocol can tell an agent which tools it may call, but not which underlying resources it has actually seen. Cloudflare OS logs every observation and checks a person’s permissions before they can open a workspace or view what an agent produced.
Apps produced by agents run as Cloudflare Workers
According to the article, each app built by an agent is a real Cloudflare Worker. Those apps run on Dynamic Workers and Durable Object Facets, which Cloudflare built for the project, and communicate with the client through Cap'n Web, the company’s open-source object-capability RPC system. As the post put it, "If you can build a tool to do a job yourself, agents can use your tool to do the job when you're not there."
Open-source code, but a centralized runtime
The article also notes a point that may leave some users unconvinced. Cloudflare OS is still a Cloudflare product, which means the agents, apps, and governance features it offers all run on Cloudflare’s edge. In that sense, the "open" in open source gives users the code, but the runtime remains under the control of a central entity.