Cloudflare OS: the open-source platform giving every employee an AI agent

Cloudflare just made a big move. The company announced Cloudflare OS, an open-source platform built as a true “operating system” for AI: every employee gets an agent and a workspace shaped around their company — how it works, what it knows, and the systems it relies on.

Since May, thousands of people at Cloudflare — many of them outside engineering — have been using the first version internally to create documents and slides, automate repeatable tasks, and build small apps. Today, that rebuilt version is available as open source for every organization.

The problem: bringing the same leverage to the whole company

Developers got their AI revolution first: agents produce code that “works” thanks to an immediate feedback loop — code either runs or it doesn’t. For the rest of the organization, the problem is harder.

An agent needs to understand the company’s context (its terminology, procedures, standards) and be able to reach the systems people use to do their jobs. That’s exactly what Cloudflare OS sets out to do: turn that context and access into work that moves the organization toward its mission.

What changed between v1 and the open-source version

The first version was centered on individuals working with agents in private workspaces. Apps were static, and deterministic jobs consumed model tokens on every run.

Collaboration exposed a more fundamental challenge: access to an MCP server told us which tools an agent could call, but not which underlying resources the agent had observed. Once people began sharing workspaces, apps, and outputs, Cloudflare needed to ensure that collaboration could not expose information someone was not permitted to see.

So Cloudflare rebuilt the platform on a new foundation, where security is part of the platform itself — not something every person building an app or using an agent has to implement correctly.

The workspace: conversation, doc, app, workflow

Everything starts with a conversation in your browser, like many AI tools. The difference: each conversation is grounded in the context and skills your organization has curated. A workspace combines:

• Agent sessions with persistent state, outputs, files, and resource access
• An isolated runtime where the agent can write and run code
• Team-curated context and skills: no more reinventing the wheel for every task. If someone on your team figured out the best way to do something, everyone benefits

A conversation can become a document, a presentation, a dashboard connected to live data, or even a full-stack application (client + server + API + durable state), built by the agent for one person, one project, or one team. And when a full app is overkill, the workspace can turn jobs into mostly deterministic workflows: code for the predictable steps, a model only where judgment adds value, triggered on demand, on a schedule, or on an event.

Security: the part that changes everything

The API key problem is well known: people ask for keys to company systems, but keys grant broad, long-lived access that is hard to constrain, share safely, and audit. Cloudflare OS answers with several layers:

• MCP Server Portals for existing MCP servers, and Gatekeepers: service-specific Workers sitting between Cloudflare OS and an external service. A Gatekeeper can grant access to a single GitHub repository (not the whole account), allow reading issues but not source code, mask fields, apply rate limits, and require approval before merging a pull request.
• Capabilities as typed bindings: env.PROJECT is a capability representing permission to use a specific resource under a specific policy. The credential stays completely isolated from the agent and any generated code.
• Real sandboxing: server code runs in a Dynamic Worker with global outbound networking disabled; client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide.
• Observation log: Cloudflare OS records every resource agents observe. When someone else opens a workspace, the Gatekeeper verifies that person’s access to the observed resources — sharing a dashboard never becomes a way to share the sensitive table behind it. A read of sensitive data can prevent the agent from writing to certain sources, inviting collaborators, or making outbound requests.

“Giving an agent access to your entire GitHub account is likely too broad. A Gatekeeper can give it access to a single repository.”

Models and costs: control through AI Gateway

Cloudflare OS works with any model. Every inference call runs through Cloudflare AI Gateway, giving your organization a single place to decide which models are available and which model handles each job.

You don’t need the most expensive frontier model to summarize your unread emails every morning. Every request is attributed to the person, team, or workspace that made it, and administrators can see where spend goes, set budgets and rate limits.

Availability and roadmap

• Today: two GitHub repositories — the Cloudflare OS core and an example deployment repository based on how Cloudflare runs it internally. Deployable into your own Cloudflare account in a few minutes.
• Partners: Presidio and Happy Cog to customize and roll out across your workforce.
• Roadmap: bringing Cloudflare OS to the Cloudflare dashboard as a fully managed product, containers for development workflows, and workspaces in Slack and other chat tools.

Why it matters

Cloudflare OS is not another gadget. It’s a serious attempt to solve the real problem of enterprise AI: context. Models are now powerful — what’s missing is anchoring them in the reality of each organization, with security that doesn’t rely on individual vigilance.

By open-sourcing the platform, Cloudflare also changes the nature of the debate: the question is no longer “who will have the best models” but “who will build the best orchestration layer between models, company data, and humans.” And that layer can now be built by anyone.

Thinking about how to bring AI agents into your organization — safely? Our team helps companies adopt AI: strategy, architecture, governance, and training. Get a free AI maturity diagnostic and walk away with a concrete action plan tailored to your systems and your risks.