Cloudflare just made a bold move. The company announced Cloudflare OS, an open-source platform designed as a true “operating system” for AI: every employee gets an agent and a workspace built around their company — how it works, what it knows, and the systems it relies on.
Since last May, thousands of people at Cloudflare — including those outside engineering — have already been using the first version internally to create documents, presentations, automate repetitive tasks, and build small applications. Today, this refined version is available as open source for all organizations.
The problem: giving the same leverage to the entire company
Developers had their AI revolution: agents produce code that “works” thanks to an immediate feedback loop — the code either runs or it doesn’t. But for the rest of the organization, the problem is harder.
An agent must understand the company’s context (its terminology, procedures, standards) and be able to reach the systems people use daily. This is exactly what Cloudflare OS aims to solve: turning this context and access into concrete work that moves the organization toward its mission.
What changed between v1 and the open-source version
The first version was focused on individuals working with agents in private workspaces. Apps were static, and deterministic tasks consumed model tokens at every execution.
Collaboration revealed a more fundamental challenge: MCP server access told you which tools an agent could call, but not which underlying resources the agent had observed. Once people started sharing workspaces, apps, and results, it became necessary to ensure that collaboration couldn’t expose information someone wasn’t authorized to see.
Cloudflare therefore rebuilt the platform on new foundations, where security is an integral part of the platform — not something each person building an app or using an agent must implement correctly.
The workspace: conversation, doc, app, workflow
Everything starts with a conversation in your browser, like many AI tools. The difference: each conversation is anchored in the context and skills curated by your organization. A workspace combines:
- Agent sessions with persistent state, outputs, files, and resource access
- An isolated runtime where the agent can write and execute code
- Team context and skills: no need to reinvent the wheel on every task. If someone found the best way to do something, everyone benefits
A conversation can become a document, a presentation, a dashboard connected to live data, or even a full application (client + server + API + durable state), built by the agent for a person, project, or team. When an app is sufficient, the workspace can also transform work into deterministic workflows: code for predictable steps, a model only where judgment adds value, with on-demand, scheduled, or event-triggered execution.
Security: the game-changer
The API key problem is well known: people request keys for company systems, but keys offer broad, long-lived access that’s difficult to constrain, share, and audit. Cloudflare OS responds with multiple layers:
- MCP Server Portals for existing MCP servers, and Gatekeepers: service-specific Workers that sit between Cloudflare OS and the external service. A Gatekeeper can grant access to a single GitHub repository (not the entire account), allow reading issues but not source code, mask fields, enforce rate limits, and require approval before merging.
- Capabilities as typed bindings:
env.PROJECTis a capability representing permission to use a specific resource under a specific policy. The credential stays completely isolated from the agent and generated code. - Real sandboxing: server code runs in a Dynamic Worker with the global network disabled; client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide.
- Observation journal: Cloudflare OS logs every resource that agents observe. When someone opens a workspace, the Gatekeeper verifies that person’s access to observed resources — sharing a dashboard never becomes a way to share the sensitive table behind it. Sensitive data reads may prevent the agent from writing to certain sources, inviting collaborators, or making outbound requests.
“Giving an agent access to your entire GitHub account is probably too broad. A Gatekeeper can give it access to a single repository.”
Models and costs: control via AI Gateway
Cloudflare OS works with any model. Every inference call goes through Cloudflare AI Gateway, giving the organization a single point to decide which models are available and which model handles which task.
No need for the most expensive model to summarize your morning emails. Each request is attributed to the person, team, or workspace that made it, and administrators can see where spending goes, set budgets, and enforce rate limits.
Availability and roadmap
- Today: two GitHub repositories — the Cloudflare OS core and a sample deployment repository based on how Cloudflare runs it internally. Deployable to your Cloudflare account in minutes.
- Partners: Presidio and Happy Cog for customization and organization-wide deployment.
- Roadmap: Cloudflare dashboard integration as a managed product, containers for dev workflows, and workspaces in Slack and other chat tools.
Why this matters
Cloudflare OS is not just another gadget. It’s a serious attempt to solve the real problem of AI in the enterprise: context. Models are now powerful — what’s missing is their grounding in each organization’s reality, with security that doesn’t rely on individual vigilance.
By open-sourcing the platform, Cloudflare also changes the nature of the debate: the question is no longer “who will have the best models” but “who will build the best orchestration layer between models, company data, and humans.” And that layer, everyone can now build.
Looking into integrating AI agents into your business — securely? Our team helps organizations adopt AI: strategy, architecture, governance, and training. Get a free audit of your AI maturity and leave with a concrete action plan, tailored to your systems and your risks.
