Cloudflare OS: an Open Platform for Agents, Apps, and Work

Every organization has a mission, a reason for being. It passes that mission — along with its terminology, procedures, systems, standards, and ways of working — to its people. People take this context, add their own experience, and do the work.

Work takes many forms: code, documents and slides, relationships, outcomes in the physical world. Some of it is straightforward. Code either runs or it doesn’t, and agents have been riding that feedback loop to write working code for the last couple of years. But what about the rest of the organization?

Bringing that same leverage to everyone else is a harder problem. Agents need to understand the company’s context and reach the systems people use every day, then turn that context and access into work that moves the organization toward its mission.

That’s why Cloudflare built Cloudflare OS — an open-source platform that gives every person an agent and a workspace built around their company: how it works, what it knows, and the systems it relies on.

Where It Started

In May of this year, every person at Cloudflare received access to the first version of Cloudflare OS. Thousands of people across every function — many of them outside of engineering — now use it daily to create documents and slides, automate repeatable tasks, and build small apps that visualize data and help them do their work.

Cloudflare OS also shipped a shared library of context and skills built by internal teams. It captures terminology, procedures, and the best-known ways of doing recurring work as instructions an agent can follow. When one person figures out a better way to do something, everyone else gets to use it.

Today Cloudflare is open sourcing a new version of Cloudflare OS. Any organization can deploy it, connect it to internal systems, and make it its own.

Lessons from the First Version

The version being open sourced today is a rebuild, shaped by what Cloudflare learned running the first one internally. That early version centered on individuals working with agents in private workspaces. Apps were static rather than live software connected to internal systems, and even mostly deterministic jobs still required re-running an agent skill and burning more model tokens.

Collaboration exposed a deeper problem. Access to an MCP server told the platform which tools an agent could call, but not which underlying resources the agent had actually observed. Once people began sharing workspaces, apps, and outputs, Cloudflare needed to guarantee that collaboration could never expose information someone was not permitted to see.

The answer was to rebuild Cloudflare OS on a new foundation where security is part of the platform — not something every app builder or agent user has to implement correctly by hand. The result is a platform designed to belong to the company running it: customizable interfaces, connected tools, and the skills and context that capture how your organization actually works.

Introducing Cloudflare OS

Cloudflare OS starts with a conversation in your browser, like many other AI tools. What sets it apart is that every conversation is grounded in the context and skills your organization has curated. Give a workspace a goal, and it can draw on that knowledge and work with the tools and data your organization already uses to achieve it.

Cloudflare OS combines three parts:

• An agent workspace grounded in context and skills your company curates, with an isolated runtime where agents can write and run code.
• A new security and governance framework for safe access to internal data and services.
• A platform for personal, modifiable apps that people can build, share, and keep changing.

What begins as a conversation can become a doc, an app, or a workflow that keeps doing the work on its own.

An Agent Workspace for Everyone in Your Company

Workspaces are designed for everyone, not just developers. You interact with them in your browser, so there’s no terminal and no coding required. Each workspace combines agent sessions, persistent state, outputs and files, resource access, and an isolated runtime where the agent can write and run code.

They arrive preloaded with the curated context and skills your team or company has collected. No reinventing the wheel for every task — if someone on your team has already found the best way to do something, everyone benefits.

Research and Ask Questions

Ask a workspace to research a topic using company context and the resources you make available. The agent can write code to search, filter, join, and analyze information instead of pulling an entire dataset into the model’s context window.

Create Docs, Slides, and Spreadsheets

A workspace can turn its research into a document, presentation, or spreadsheet you can continue editing. These outputs don’t have to be static files. They can stay connected to live data, update as their sources change, and still export to familiar formats or services like Google Drive.

Build Collaborative, Connected Apps for Your Team

When a document or spreadsheet isn’t enough, the agent can build an app with its own interface, logic, and state. The app can use connected company resources and support multiple people working together.

Run Deterministic Workflows

Not every job needs a full agent session. Many are a known sequence of steps with one or two places where judgment is useful. A workspace can turn those jobs into mostly deterministic workflows — code handles the predictable steps, and a model is used only where it adds value. Workflows can run on demand, on a schedule, or when an event occurs in a connected system.

Cloudflare OS gives agents and apps governed access to systems of record through Gatekeepers (more below), and it supports existing Model Context Protocol (MCP) servers your organization already uses through MCP Server Portals.

Security and Governance for Safe Access to Internal Systems

When people start experimenting with AI at work, one of their first requests is usually for API keys to company systems. That makes sense: AI isn’t much use at work without access to the systems people use to do their jobs.

But handing API keys to people and agents is dangerous and doesn’t scale. Keys often grant broad, long-lived access that is hard to constrain, share safely, or audit.

MCP gives agents a better way to use these systems. An MCP server can hold the credential and expose a defined set of tools instead of passing the key directly to the agent. But controlling which tools an agent can call is only the first step. MCP alone doesn’t tell you which underlying resources an agent has observed. The agent can combine information across systems, send it somewhere less restricted, or expose it through apps and outputs to people who may not be allowed to see the original resources. Authorization has to account for where the data can go next.

Agents Start with No Access

Cloudflare Access controls who can enter Cloudflare OS. Inside, every agent and app starts with access to nothing. An agent can ask for access to a specific resource, which you can grant or deny. Generated code receives that resource as a typed binding:

const issues = await env.PROJECT.listIssues({
  teamId: "ENG",
  state: "open",
});

env.PROJECT is a capability — permission to use a specific resource under a specific policy. The credential stays completely isolated from the agent and any generated code. Server code runs in a Dynamic Worker with global outbound networking disabled. Client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide.

Gatekeepers Govern Resources and Actions

A Gatekeeper is a service-specific Worker that sits between Cloudflare OS and an external service. It understands the service’s API, its resources, and the operations that can be performed on them.

Giving an agent access to your entire GitHub account is likely too broad. A Gatekeeper can limit it to a single repository, allow reads of issues but not source code, mask particular fields, apply rate limits, and require approval before merging a pull request.

The agent and its apps see a small TypeScript API. The Gatekeeper handles OAuth, holds the credential, enforces policy, records what was read, and mediates anything with an externally visible side effect.

Policy Follows What the Agent Has Seen

Controlling the initial read isn’t enough. Consider an agent that reads a sensitive table in a data warehouse and uses it to produce a live dashboard. Sharing the dashboard must not become a backdoor for sharing the table with people who couldn’t access it directly.

Cloudflare OS records every resource agents observe. Those observations stay attached to the agent and its work. When someone else tries to open the workspace, interact with the agent, or view what it produced, Gatekeepers verify that person’s access to the observed resources.

The same observation log informs policies that decide when agents can make external requests. A read of sensitive data can prevent the agent from writing to certain sources, inviting new collaborators, handing work to another agent, or making an outbound request.

People using agents or building apps don’t have to worry about making these mistakes. The platform handles it for them.

A Platform for Personal, Modifiable Apps

Most productivity suites give you a fixed set of applications: documents, spreadsheets, and presentations. In Cloudflare OS, each “file” can be its own application, written by an agent for one person, one project, or one team.

These aren’t prototypes you have to export and deploy somewhere else. Each one is a full-stack application with client code, server code, an API, and durable state. Apps are private by default, but can be shared like documents.

Every App Is a Worker

When you ask your workspace to build an app, the agent writes two parts:

• Client code that renders the app’s UI in the browser
• Server code that stores state and implements the app’s behavior

The server is loaded on demand as a Dynamic Worker and instantiated as a Durable Object Facet — both features built for this project. The facet gives the app its own SQLite database, separate from the Cloudflare OS runtime managing it. Dynamic Workers use lightweight V8 isolates, so every app gets its own isolated runtime without a dedicated server or container sitting around.

The browser client talks to the server using Cap’n Web, Cloudflare’s open source object-capability RPC system. A server method can be called from the client like a normal JavaScript function:

const issues = await app.listIssues({
  status: "done",
});

The special part: the agent can call the same method too. If you can build a tool to do a job yourself, agents can use your tool to do the job when you’re not there.

Share the App, or Share How It Was Built

When you build an app in Cloudflare OS, you have two ways to share it:

• Sharing your app itself lets other people collaborate in real time using the same state.
• Sharing a blueprint of your app lets other people create their own copy.

An app instantiated from a blueprint contains the original app’s code, but not its SQLite data, conversation history, credentials, or connected resources. Each new app starts with independent state and resources.

That means when you share apps with your team, they can modify them themselves with AI — instead of filing a feature request and assigning it to you.

Use Any Model, and Control What It Costs

Cloudflare OS works with any model. Every inference call runs through Cloudflare AI Gateway, giving your organization one place to decide which models are available and which model should handle each job.

Not every task needs the most expensive model. You may not want to run a frontier model just to summarize your unread email every morning. AI Gateway gives you the control to make sure expensive models are reserved for the hardest work.

Every request is attributed to the person, team, or workspace that made it. Administrators can see where inference spend is going, set budgets and rate limits, and decide what happens when a limit is reached.

Open Source, So You Can Make It Yours

Cloudflare OS is available today and is open source. You can deploy it into your own Cloudflare account and use your own Access policies, AI Gateway configuration, data, and integrations.

Cloudflare’s internal deployment reflects Cloudflare’s systems, terminology, policies, and ways of working. Yours should reflect your organization. Cloudflare OS is designed so you can customize the interface, add internal Gatekeepers, and build organization-specific features without changing the core product.

Two repositories are being released: the Cloudflare OS core and an example deployment based on how Cloudflare runs it internally. The deployment repository consumes the core without patching it, providing a home for configuration, custom UI, internal integrations, analytics, and deployment pipelines.

Delivered Together with Partners

The source code is only the starting point. The context, skills, workflows, internal systems, and policies are what make Cloudflare OS truly useful for your organization.

Cloudflare’s strategic partners, Presidio and Happy Cog, will work with you to customize Cloudflare OS around how your organization operates and roll it out across your workforce. Partners can help you curate shared skills and institutional context, build custom interfaces, connect internal systems through Gatekeepers and MCP Server Portals, and configure security, model, and cost controls.

The result is your own branded Cloudflare OS, connected to your systems, running on Cloudflare, and shaped around how your people actually work.

Get Started

Cloudflare OS is available today on GitHub. You can explore the source code, try the demo, or deploy it into your own Cloudflare account in a few minutes using the starter repository.

Cloudflare is just getting started: bringing Cloudflare OS to the Cloudflare dashboard as a fully managed product, adding containers for development workflows, and bringing workspaces into Slack and other chat tools.

Every organization now has the opportunity to give every person an agent and workspace shaped around how the company actually works — one that understands its context, protects its data, and turns shared knowledge into shared leverage.