Cloudflare OS: An Open Platform for AI Agents and Apps
Discover Cloudflare OS, a secure, open-source platform combining collaborative workspaces, sandboxed runtimes, and Gatekeepers for enterprise AI agents.
What if everyone in your company could use AI agents to automate tasks, analyze data, and build custom web applications safely?
Normally, giving AI agents access to company systems requires handing over API keys. However, API keys are often too broad, long-lived, and dangerous to expose. If an agent goes rogue or is fed untrusted input, a security breach is just seconds away.
To solve this, Cloudflare introduced Cloudflare OS, an open-source platform designed to let organizations safely deploy AI agents, run deterministic workflows, and build collaborative apps tailored to their custom business logic.
Understanding Cloudflare OS (ELI5)#
Imagine your company is a highly secured library.
Normally, if an AI agent wants to write a report using books from the restricted section, you have to give it a master key (an API key) to the library. Once the agent has the key, it can open any room, read any book, and potentially copy or leak sensitive information to the outside world.
Cloudflare OS works differently. Instead of giving the agent the master key, it introduces two things:
- The Sandboxed Reading Room (Isolated Runtime): The agent is put in a secure room where it can read books and write down its work, but it cannot exit the room or talk to the outside world.
- The Librarian (Gatekeeper): A librarian stands at the door. If the agent needs a book, it asks the librarian. The librarian retrieves only that specific book, masks any highly sensitive pages, and logs exactly what the agent read. If the agent tries to copy sensitive information onto a postcard to mail outside, the librarian blocks the request.
This approach makes it safe to let agents build tools, fetch database records, and run code.
Core Architecture#
Cloudflare OS is built on three key pillars:
graph TD
User[User Browser] -->|Capn Web RPC| Workspace[Agent Workspace]
Workspace -->|Isolated V8 Runtime| Runner[Dynamic Worker / Sandbox]
Runner -->|TypeScript API bindings| Gatekeeper[Gatekeeper Worker]
Gatekeeper -->|OAuth & Audits| ExternalService[(Internal DB / Github / APIs)]
style Gatekeeper fill:#ff5f07,stroke:#333,stroke-width:2px
style Runner fill:#ff9910,stroke:#333,stroke-width:2px
1. The Agent Workspace#
The Workspace is the primary user interface in the browser. It combines:
- An active conversation session.
- A file system for inputs, outputs, and generated files.
- An isolated code execution runtime (powered by V8 isolates) where the agent can run code to analyze data instead of loading large datasets directly into the LLM context.
2. Gatekeepers: Secure Data Access#
Instead of giving raw API credentials to an agent, Cloudflare OS uses Gatekeepers.
- A Gatekeeper is a lightweight Worker sitting between Cloudflare OS and an external API (like GitHub or a PostgreSQL database).
- It exposes a restricted TypeScript API (e.g.,
env.PROJECT.listIssues()) to the sandboxed code. - The credentials never leave the Gatekeeper, allowing strict audit logs, field masking, and rate limits.
3. Personal, Modifiable Apps#
In Cloudflare OS, users can ask agents to build complete web applications.
- Every app is run as a Dynamic Worker associated with a Durable Object Facet, providing its own isolated SQLite database for state management.
- Communication between the client UI and the server backend uses Cap’n Web, an open-source object-capability RPC protocol.
- Apps can be shared directly with colleagues or distributed as blueprints (which replicate code structure but leave behind individual data/credentials).
Observation Logs & Data Lineage#
One of the coolest features of Cloudflare OS is its ability to track what the agent has seen.
When an agent reads a piece of data through a Gatekeeper, that resource is appended to its Observation Log. If you build a dashboard displaying this data and share it with a teammate, Cloudflare OS checks the observation log and verifies whether that teammate has the necessary access rights to see the source data. If not, access is denied.
Similarly, if the observation log contains sensitive data, the platform’s policy engine will automatically disable outbound network calls to prevent data leakage.
How to Get Started#
Cloudflare OS is open-source and can be deployed to your own Cloudflare account in minutes.
1. Clone the Starter Repository#
git clone https://github.com/cloudflare/cloudflare-os-starter.git
cd cloudflare-os-starter2. Install Dependencies#
bun install3. Deploy to Cloudflare#
Configure your wrangler.toml with your Cloudflare Account ID and deploy:
bun run deploy[!TIP] Make sure to configure your Cloudflare AI Gateway to route model inference requests. This allows you to monitor API costs, set token limits, and switch between models (e.g., Llama 3, Claude, GPT-4) seamlessly.