Cloudflare OS: The Open-Source Agent Platform Rewriting Enterprise AI Security

On August 5, 2026, Cloudflare did something no other infrastructure company has attempted at this scale: it open-sourced the entire agent workspace it had been running internally since May, complete with a capability-based security model that tracks what every agent has seen, not just what it’s allowed to call. Within 24 hours, the repository cleared 3,900 GitHub stars. Two days earlier, Cloudflare had shipped a companion project — @cloudflare/computer — an MIT-licensed runtime that gives any agent its own virtual machine by dynamically splitting work between V8 isolates and Linux containers.

These are not incremental improvements to existing agent frameworks. They represent a fundamentally different answer to the question every enterprise automation team is asking right now: how do we give agents real access to production systems without handing them the keys to the kingdom?

If you’ve been following the AI agent control plane conversation, Cloudflare OS is the first open-source project to ship a working implementation of the governance patterns that analysts have been describing in theory. And if you’ve been tracking trending open-source agentic AI repos, this is the one that matters most this month — not because of star count, but because it solves a problem that LangGraph, CrewAI, and AutoGen deliberately leave to the deployer.

This guide breaks down the architecture, security model, and runtime design of Cloudflare OS and @cloudflare/computer so you can evaluate whether they belong in your enterprise automation stack.

What Cloudflare OS Actually Is (and What It Is Not)

The name is deliberately provocative, and it has caused confusion. Cloudflare OS is not a traditional operating system like Linux or Windows. It is an open-source agent workspace platform released under the Apache 2.0 license. Think of it as an “operating system for organizational AI work” — it manages agent sessions, enforces security policies, provides an isolated code execution environment, and ships a library of organizational context and skills.

The platform combines three components:

An agent workspace grounded in company-curated context and skills, with an isolated runtime where agents can write and execute code. Every person in the organization gets a browser-based workspace — no terminal required, no developer tooling prerequisite. The workspace comes preloaded with shared knowledge: terminology, procedures, and documented best practices that the organization has codified as reusable agent instructions.

A security and governance framework called Gatekeepers — capability-based access objects that sit between agents and external services. This is the architectural decision that separates Cloudflare OS from every other agent platform on the market.

More Read

UiPath Maestro Case: The Complete Step-by-Step Tutorial (2026)

Microsoft Copilot: The Complete Guide for 2026 (And Why It Actually Matters)

RPA and Compliance: Ensuring Regulatory Adherence

A platform for personal, modifiable apps called Gadgets — full-stack applications (client code, server code, API, and durable state) that agents build for individual users and that run as sandboxed Cloudflare Workers. Each Gadget is a separate, isolated instance — when you create a slide deck, the system spins up a private instance of the slide-deck application just for you, sandboxed from every other instance.

The repository lives at github.com/cloudflare/cloudflare-os, with a companion starter kit at github.com/cloudflare/cloudflare-os-starter for customizing deployments.

The Backstory: 3 Months of Internal Dogfooding

Cloudflare didn’t build this in a vacuum. In May 2026, the company deployed the first version of Cloudflare OS to every employee — engineering, sales, legal, marketing, HR, every function. By the time of the open-source announcement, “thousands” of employees across the company were using it daily, many of them non-engineers, to create documents and presentations, automate repeatable tasks, and build small internal apps to visualize data.

The first version exposed critical problems that shaped the v2 architecture:

Collaboration broke the security model. MCP servers told the platform which tools an agent could call, but not which underlying resources the agent had observed. Once people began sharing workspaces, apps, and outputs, there was no mechanism to prevent an agent from combining data across systems and exposing it to someone who shouldn’t see the original sources. The example from Cloudflare’s own blog post is instructive: an agent reads a sensitive data-warehouse table and builds a live dashboard from it. If someone shares that dashboard, it becomes an unaudited back-door into the restricted table.

Static apps wasted tokens. Apps in the first version were deterministic rather than live software connected to internal systems. Running the same job again required spinning up a full agent session and consuming model tokens for work that should have been handled by deterministic code.

The v2 rewrite solved both problems at the platform level, which is why the security model is the most interesting part of the architecture.

Gatekeepers: Capability-Based Security for AI Agents

This is the core innovation of Cloudflare OS and the reason automation architects should pay attention. Most agent platforms implement security at the tool level: the agent can or cannot call a specific API. Gatekeepers implement security at the resource level, with policy that follows what the agent has observed.

How Gatekeepers Work

A Gatekeeper is a service-specific Cloudflare Worker that sits between Cloudflare OS and an external service (GitHub, Jira, Salesforce, a data warehouse — anything with an API). It understands the service’s API, its resources, and the operations that can be performed on them.

Every agent and every app starts with access to nothing. When an agent needs to access a resource, it requests permission. If granted, the agent receives a typed capability binding — not an API key, not an OAuth token, but a scoped object representing permission to use a specific resource under a specific policy:

const issues = await env.PROJECT.listIssues({
  teamId: "ENG",
  state: "open",
});

In this example, env.PROJECT is a capability. The actual credential (OAuth token, API key, service account) never touches the agent’s code or context window. The Gatekeeper holds the credential, handles OAuth flows, enforces policy, records what was read, and mediates anything with an externally visible side effect.

The Observation Log: Security That Follows the Data

This is where Cloudflare OS diverges sharply from the MCP-only approach to agent security. MCP controls which tools an agent can call. Gatekeepers go further: they record every resource the agent observes. These observations remain attached to the agent session and everything it produces.

When another person tries to open the workspace, interact with the agent, or view what it produced, Gatekeepers verify that person’s access to every observed resource. If the agent read a restricted data-warehouse table to build a dashboard, only people with access to that table can see the dashboard.

The observation log also informs egress policies: a read of sensitive data can prevent the agent from writing data to certain destinations, inviting new collaborators, handing work to another agent, or making outbound requests. This is taint tracking for AI agents — the same concept that operating systems use to prevent data exfiltration, applied at the agent-workspace level.

What a Gatekeeper Can Enforce

Using the GitHub Gatekeeper as an example, the administrator can configure policies that:

• Allow an agent to read issues on a specific repository while blocking access to source code
• Mask specific fields in returned data (e.g., strip email addresses from issue comments)
• Rate-limit how many API requests the agent can make per hour
• Require human approval before a pull request is merged
• Block the agent from creating public repositories

For enterprise automation teams accustomed to building these guardrails manually around every RPA bot and API integration, Gatekeepers represent a significant reduction in governance overhead. The security is in the platform, not in every individual automation.

Gadgets: Every App Is a Worker

Most AI agent platforms produce outputs — documents, code, data files. Cloudflare OS produces running applications.

When you ask a workspace to build something, the agent writes two parts: client code that renders a UI in the browser, and server code that stores state and implements behavior. The server is loaded on demand as a Dynamic Worker — a feature Cloudflare built specifically for this project — and instantiated as a Durable Object Facet, giving each app its own SQLite database, separate from the Cloudflare OS runtime managing it.

Dynamic Workers use lightweight V8 isolates, so every Gadget gets its own isolated runtime without needing a dedicated server or container. The browser client communicates with the server using Cap’n Web, Cloudflare’s open-source object-capability RPC system.

The critical design decision: a server method can be called by both the user and the agent using the same interface. If you build a tool to do a job yourself, agents can use that same tool to do the job when you’re not there. This collapses the distinction between “human-facing app” and “agent-facing tool” — a Gadget is both.

Two Sharing Models

Gadgets support two sharing modes:

Share the app itself — other people collaborate in real time using the same state, like a shared Google Doc. The Gatekeeper observation log ensures that collaborators can only access what they’re authorized to see.

Share the Blueprint — other people get the app’s source code and can deploy their own instance, connected to their own data and resources. This is how teams scale internal tooling: one person (or agent) builds a useful app, publishes the Blueprint, and everyone else gets their own copy.

@cloudflare/computer: The Hybrid Agent Runtime

Shipped two days before the Cloudflare OS announcement on August 3, 2026, @cloudflare/computer is an MIT-licensed agent runtime that takes a fundamentally different approach to agent execution than the container-first model used by most platforms.

The core thesis: an agent should need a container for less than 10% of its work. Most agent tasks — text generation, data transformation, API calls, file manipulation — don’t need a full Linux userland. They need fast, cheap, isolated compute. Containers are the right tool only for tasks that require native binaries, real filesystem operations, or full networking.

Three Execution Backends

@cloudflare/computer sits on top of a virtual filesystem backed by SQLite inside a Durable Object. That filesystem is the single source of truth. The runtime then exposes one pluggable execution surface — workspace.runtime — with three backends that ship today:

1. Container backend: Projects the SQLite state into a sandbox container as a real FUSE mount. A sandbox-side daemon called computerd mounts the state as a filesystem and syncs changes back over a Cap’n Web RPC channel. This gives you the full Linux userland — real binaries, real package managers, real networking. Use it for coding tasks, audio/video processing, or anything that needs apt-get install.

2. Isolate shell backend: Runs bash in a Dynamic Worker, reaching the authoritative Workspace over Workers RPC. No second store, no sync round trip — the shell reads and writes the SQLite-backed filesystem directly. Suitable for lightweight scripting tasks that don’t need native binaries.

3. Isolate JavaScript backend: Runs an ECMAScript module in a fresh Dynamic Worker with structured input/results, durable relative imports, configured libraries, Workspace-backed node:fs/promises, and trusted ws:git and ws:artifacts modules. The fastest backend — cold-start in single-digit milliseconds — for pure computation and data transformation.

The runtime dynamically selects the right backend for each task. A single agent session might use the JavaScript isolate for data analysis, the shell isolate for a quick file transformation, and a container for installing and running a Python package — all sharing the same virtual filesystem.

Why This Matters for Automation Teams

If you’re running agent workloads at scale — and most enterprise automation teams will be within the next 12 months — the cost and latency difference between isolates and containers is substantial. V8 isolates have near-zero cold-start time and consume a fraction of the memory. Containers take seconds to spin up and hold a full OS image in memory. A runtime that routes 90%+ of work through isolates and falls back to containers only when necessary can reduce both cost and latency by an order of magnitude.

For teams already operating enterprise RPA platforms like UiPath, Automation Anywhere, or Blue Prism, this is directly comparable to how those platforms handle attended vs. unattended robot execution — but at a different layer of the stack and with finer-grained resource isolation.

Architecture Deep Dive: How the Pieces Fit Together

The full Cloudflare OS architecture maps traditional operating-system concepts to cloud-native equivalents:

Identity is handled by Cloudflare Access, which verifies who can enter the platform. Inside the platform, the Gatekeeper layer handles authorization — what resources each agent and user can access, and under what conditions.

Generated code (both Gadget server code and agent-authored scripts) runs in Dynamic Workers with global outbound networking disabled by default. Client code runs in sandboxed iframes in the browser. Neither can reach the internet except through capabilities explicitly granted via Gatekeepers. This is the zero-trust principle applied at the agent runtime level.

MCP Integration

Cloudflare OS supports existing Model Context Protocol servers through MCP Server Portals. If your organization already uses MCP servers for agent tooling, they plug into Cloudflare OS without modification. The Gatekeeper layer adds the observation-tracking and policy-enforcement capabilities on top of whatever the MCP server already provides.

This is a pragmatic design decision: rather than asking organizations to rewrite all their agent integrations as Gatekeepers, Cloudflare OS accepts MCP servers as-is and layers additional governance on top. Organizations can then migrate high-value integrations to full Gatekeepers over time to get the richer security model.

Self-Hosting and Deployment

The official deployment path uses Cloudflare’s own infrastructure — Workers, Durable Objects, KV, and R2. The starter kit (cloudflare-os-starter) provides a customization guide that handles DNS, TLS, and resource provisioning through Wrangler. With resource values left as null, Wrangler automatically creates the required KV namespaces and R2 bucket.

Sign-in uses Cloudflare Access, so any identity provider that Access supports (Okta, Azure AD, Google Workspace, GitHub, OneLogin, and others) works out of the box.

The community has already produced unofficial self-hosting alternatives, including a Docker Compose setup using LiteLLM and Tailscale (cloudflare-os-home) for teams that want to run the platform on their own infrastructure without depending on Cloudflare’s managed services. However, the container and isolate runtime backends depend heavily on Cloudflare Workers internals, so full feature parity on non-Cloudflare infrastructure remains a work in progress.

How Cloudflare OS Compares to Other Agent Platforms

Cloudflare OS occupies a different layer of the stack than most agent frameworks. Here’s how it fits into the August 2026 landscape:

The key distinction: LangGraph, CrewAI, and the Microsoft Agent Framework are orchestration tools — they manage how agents plan, execute, and coordinate. Cloudflare OS is a workspace tool — it manages what agents can access, what they’ve seen, and where their outputs can go. These are complementary, not competitive. You could run a LangGraph agent inside a Cloudflare OS workspace and get the orchestration from LangGraph with the security and governance from Cloudflare OS.

Microsoft’s Agent Governance Toolkit is the closest competitor in the security/governance space — it covers all 10 OWASP Agentic Top 10 risks with sub-millisecond policy enforcement. But it’s a governance library you integrate into your own runtime, not a complete workspace platform. Cloudflare OS bundles governance into the platform itself, which is an easier adoption path for organizations that don’t want to build their own agent infrastructure.

What This Means for RPA and Automation Teams

If you’re an automation architect evaluating whether Cloudflare OS belongs on your radar, here’s the practical assessment:

The governance model is production-ready for sensitive environments. The capability-based security, observation logging, and taint-tracking approach directly address the concerns that CISOs raise when automation teams request API access for agents. If your existing RPA platform struggles with credential management at scale, Gatekeepers offer a fundamentally better pattern.

The hybrid runtime reduces agent infrastructure cost. Enterprise automation teams running hundreds of attended and unattended agents will see meaningful cost savings from isolate-first execution. The 90/10 split between isolates and containers is realistic for most business-process automation workloads that don’t involve heavy document processing or desktop interaction.

The Blueprint/Gadget model is citizen-developer-friendly. Non-technical users can build and share internal apps without deploying infrastructure. This directly competes with Microsoft Power Platform’s citizen-developer story, but with agent-native security built in rather than bolted on.

The rough edges are real. The project launched 9 days ago. The v2 architecture is sound, but the ecosystem of pre-built Gatekeepers is limited, the self-hosting story outside Cloudflare’s own infrastructure is incomplete, and the documentation reflects an internal tool being open-sourced rather than a product designed for external adoption from day one. Early adopters should budget time for integration work.

Getting Started: A Minimal Deployment

For teams that want to evaluate Cloudflare OS, the fastest path is through the official starter kit:

# Clone the starter
git clone https://github.com/cloudflare/cloudflare-os-starter.git
cd cloudflare-os-starter

# Configure your deployment
# Edit wrangler.toml with your Cloudflare account details
# Set identity provider in Cloudflare Access

# Deploy — Wrangler creates KV namespaces and R2 bucket automatically
npx wrangler deploy

The starter deploys Cloudflare Access mode for identity verification. You’ll need a Cloudflare account (free tier supports initial experimentation, but production workloads will require Workers Paid plan for Durable Objects and Dynamic Workers).

For the @cloudflare/computer runtime specifically:

npm install @cloudflare/computer

The package provides the virtual filesystem, workspace management, and all three execution backends. Documentation and examples are available in the GitHub repository.

Frequently Asked Questions

Is Cloudflare OS free to use?

The source code is free under Apache 2.0. However, running it requires Cloudflare infrastructure (Workers, Durable Objects, KV, R2), which has its own pricing. The free tier covers experimentation, but production deployments will incur Cloudflare platform costs. Community-built alternatives using Docker Compose exist for self-hosting on your own infrastructure, though with reduced feature parity.

Can I use Cloudflare OS with models other than Cloudflare’s Workers AI?

Yes. Cloudflare OS is model-agnostic. The workspace connects to any LLM provider via API — Claude, GPT-4o, Gemini, DeepSeek, or any model accessible through a standard API endpoint. The community self-hosting project uses LiteLLM as a model proxy for multi-provider support.

How does Cloudflare OS relate to MCP (Model Context Protocol)?

Cloudflare OS supports existing MCP servers through MCP Server Portals. It’s not a replacement for MCP — it’s a governance layer on top. Gatekeepers add observation tracking and policy enforcement that MCP’s current specification (including the 2026-07-28 stateless spec) doesn’t cover. Organizations can use MCP servers inside Cloudflare OS without modification.

Can I run existing RPA bots inside Cloudflare OS?

Not directly. Cloudflare OS is an agent workspace for LLM-based agents, not a traditional RPA runtime. However, Gatekeepers can connect to the same enterprise systems (SAP, Salesforce, ServiceNow) that RPA bots access, and the container backend in @cloudflare/computer can run any Linux-compatible automation tooling. Integration with existing RPA platforms would require building a Gatekeeper for the RPA platform’s API.

What happened to the Cloudflare Agents SDK and Workers AI?

Cloudflare OS builds on top of Cloudflare’s existing developer platform — Workers, Durable Objects, Workers AI, and the Agents SDK are all underlying technologies. Cloudflare OS is the application layer that brings them together into a unified workspace with security governance. Think of it as the “finished product” that the underlying platform components enable.

Key Takeaways

• Cloudflare OS is the first open-source agent platform to ship capability-based security with observation tracking — a fundamentally different approach than tool-level permissions that tracks what agents see, not just what they call.
• Gatekeepers solve the credential-management problem at scale by holding credentials, enforcing fine-grained policies, and logging every resource observation for downstream access control.
• @cloudflare/computer’s hybrid isolate/container runtime targets a 90/10 split that can dramatically reduce agent infrastructure costs compared to container-only approaches.
• Gadgets and Blueprints make agents productive for non-developers — every output can be a running application with its own state, shareable and modifiable without touching code.
• The platform is complementary to existing agent frameworks — you can run LangGraph, CrewAI, or any MCP-compatible agent inside Cloudflare OS and layer governance on top.
• It’s early. The architecture is sound and battle-tested internally at Cloudflare, but the open-source release is 9 days old. Budget for integration work and expect the Gatekeeper ecosystem to mature over the coming months.

External References

1. Cloudflare Blog — “Cloudflare OS: an open platform for agents, apps, and work” (August 5, 2026)
2. Cloudflare Blog — “Your agent needs a computer, not a container — introducing @cloudflare/computer” (August 3, 2026)
3. GitHub — cloudflare/cloudflare-os (Apache 2.0)
4. GitHub — cloudflare/computer (MIT)
5. InfoQ — “Cloudflare Launches Persistent, Stateful, Computer-Like Environments for Agents” (August 2026)
6. Cloudflare Developers — @cloudflare/computer agent runtime changelog
7. Decrypt — “Cloudflare OS: Here’s What’s Inside the Open-Source AI Agent Platform”
8. Help Net Security — “Cloudflare OS goes open source with a record of everything its agents read”
9. Microsoft Open Source Blog — “Introducing the Agent Governance Toolkit” (April 2, 2026)
10. Hacker News Discussion — Cloudflare OS announcement thread

Next steps: Run the full open-source agentic AI landscape alongside this deep dive to see where Cloudflare OS fits in the broader ecosystem. For teams already running agentic workloads on Microsoft’s Agent Framework or exploring self-hosted models like Meta Muse Glimmer, Cloudflare OS adds the missing governance layer that those frameworks leave to the deployer.