Summary
- Cloudflare has launched a new open-source iteration of Cloudflare OS, designed to provide every employee with an agent, workspace, and tools for developing small applications.
- This version includes an agent workspace, a security and governance framework known as "Gatekeepers," and a mechanism for deploying personal applications as Cloudflare Workers.
- The key selling point is the ability to operate the system on your own infrastructure, linked to your own data, rather than giving agents broad API keys.
Initially developed for internal use, Cloudflare OS was made available to the company's thousands of employees in May, as noted by CEO Matthew Prince. Employees outside the engineering department began utilizing it for tasks such as drafting documents, creating presentations, and automating repetitive tasks. Now, Cloudflare is releasing a revamped version that any organization can implement and integrate with their internal systems.
According to the company, "Security must be an integral part of the platform, not something each individual developing an app or using an agent has to manage independently." This represents the core functionality of the product.
Components of Cloudflare OS
Cloudflare OS consists of three main components. The first is an agent workspace that contextualizes conversations based on the organization's curated knowledge and skills, along with a secure environment where the agent can write and execute code. The second component is a new security and governance system that acts as a buffer between agents and the organization's record systems. Lastly, there is a framework for personal, customizable apps that allows users to transform a chat into a document, workflow, or a small full-stack application.
Cloudflare's CIO, Sam Rhea, explained the company's security strategy for this agent-driven initiative: providing API keys to users and agents poses risks and does not scale well, as these keys offer extensive, long-lasting access that is difficult to manage or audit. Instead, agents begin with no access and must request specific resources, which are mediated by a Gatekeeper, a service-specific Cloudflare Worker. This way, credentials do not come into contact with the agent or its code.
This model is cleaner than relying solely on the Model Context Protocol (MCP). While MCP informs an agent of which tools it can utilize, it does not specify the underlying resources the agent has encountered. Cloudflare OS keeps a log of all observations and verifies user access before allowing them to open a workspace or review the output generated by an agent.
Each application created by an agent functions as a genuine Cloudflare Worker, utilizing Dynamic Workers and Durable Object Facets developed specifically for this project, communicating with the client via Cap'n Web, an open-source object-capability RPC system. The company notes, "If you can create a tool to perform a task yourself, agents can leverage your tool to accomplish that task in your absence."
While this is an ambitious vision, some users may harbor doubts about the platform: being a Cloudflare product means that the agents, applications, and governance systems it provides are all hosted on Cloudflare's edge. The term "open" in open source grants access to the code, yet the runtime remains under the control of a centralized entity.