Cloudflare OS: The Open Source Agent Workspace That Treats Apps Like Files
TL;DR
Cloudflare OS is an open source agent workspace: capability-based Gatekeepers, apps as private per-user instances, and approvals that keep agents moving.
Last updated: August 5, 2026
On August 5, the fifth day of Cloudflare's Agents Week, the company open sourced Cloudflare OS, the platform thousands of its employees have used internally since May 2026. It is an agent workspace, a security framework, and an app runtime in one: a browser-based workspace where every "file" is a full-stack application written by an agent, every connection to an external service runs through a capability-granting Gatekeeper, and every agent starts with access to nothing.
Two repositories shipped: cloudflare-os (the core, Apache-2.0) and cloudflare-os-starter, an example deployment shaped like Cloudflare's own internal install. The core runs on Workers and workerd, and the README is explicit that this is v2, a complete rewrite, "early access" with rough edges.
What shipped#
Cloudflare OS combines three parts:
- An agent workspace - conversations grounded in curated company context and skills, with an isolated runtime where the agent writes and executes code; users authenticate through Cloudflare Access.
- Gatekeepers - service-specific Workers that hold the OAuth credential for an external service, expose a typed API, log every action, and route side effects through human approval. They ship for GitHub, Google, Slack, Notion, and more.
- Gadgets - the file model. Asking for a slide deck creates a private instance of a slide deck app with its own SQLite database and a sandboxed server; share the gadget to collaborate in real time, or share a blueprint, which copies the code without the data.
For Workers developers the stack is the story: every workspace is a Durable Object, every gadget is a Dynamic Worker, and the client talks to the server over Cap'n Web, Cloudflare's open source object-capability RPC.
Why the security model matters#
The notable decisions are about authorization. MCP servers are supported through Cloudflare's MCP Server Portals, but the default posture is capability-based, not ambient: an agent or gadget has access to nothing until you introduce it to a resource, and the agent can request an introduction it thinks it needs. Generated code receives resources as typed bindings like env.PROJECT, never as keys the model can read. This is the same direction as the Agent Access Model paper Cloudflare published this week, which we covered in Cloudflare's Agent Access Model: Zero Trust for Task-Scoped Agent Runs: the credential never reaches the model, and policy is enforced in the harness and network, not the prompt.
Two mechanisms deserve attention because they attack real failure modes. First, policy follows what the agent has seen: every observed resource is logged and attached to the work, and a user opening a shared workspace is verified against those observations, so a live dashboard cannot smuggle access to the table behind it. Second, Gatekeepers solve approval fatigue: instead of blocking an agent until a human clicks approve, they simulate the outcome, let the agent continue and queue actions, then let the user approve or reject in bulk when convenient. We documented how synchronous approval prompts push users toward --dangerously-skip-permissions in Approval Fatigue Is an Agent Security Bug; this simulated-commit pattern is the most direct fix we have seen shipped.
CIO Sam Rhea's companion post reports internal numbers - all vendor-reported, none independently verified: sales teams saved over 10,000 hours on previously manual tasks in the last month, and users created over 4,000 apps and tools in 30 days. The engineering-side context layer (the "Engineering Codex") flagged nearly 250,000 potential problems and blocked 16,000 merges in four months, again by Cloudflare's own count. Those are adoption claims, not benchmarks, but they are the strongest evidence yet that non-developer teams actually build with agent platforms when the security story stops being their problem.
What to make of it#
Two implications are bigger than the product. The gadget model is a direct challenge to SaaS: if every user can run their own private instance and prompt an agent to change its code, the centralized shared-app model stops being the only option. Cloudflare OS is not the first to try this, but it is the first credible open source implementation with a real security layer underneath.
And the OS framing is more than marketing. The kernel analogy is technical: backend as kernel, Gatekeepers as device drivers, gadgets as processes, blueprints as executables, and agents as a new first-class entity that traditional OSes do not manage. We argued in Skills Are the New Agent Operating System that the agent platform layer would accrete around context and skills rather than file systems; Cloudflare OS puts the same bet behind company-curated skills and context loaded into every workspace. For teams building their own version, the practical takeaways: start from the starter repo, configure OAuth per gatekeeper, and expect to write your own gatekeepers, because that is where the real work of connecting your systems of record lives.
The honest caveats: this is not production-grade yet, contributions are closed for anything beyond small fixes, and the fully managed product, containers for development workflows, Slack integration, and workerd self-hosting docs are all still on the roadmap.
FAQ#
What is Cloudflare OS?#
Cloudflare OS is an open source agent workspace, security framework, and app runtime that Cloudflare open sourced on August 5, 2026, after thousands of its employees used it internally since May. It combines an agent workspace, service-specific Gatekeepers, and Gadgets, where every "file" is a full-stack application written by an agent.
What is a Gatekeeper in Cloudflare OS?#
A Gatekeeper is a service-specific Worker that holds the OAuth credential for an external service, exposes a typed API, logs every action, and routes side effects through human approval. Instead of blocking an agent until a human approves, Gatekeepers simulate the outcome, let the agent continue and queue actions, then let the user approve or reject in bulk.
What is Cloudflare OS built on?#
The core runs on Workers and workerd. Every workspace is a Durable Object, every gadget is a Dynamic Worker, and the client talks to the server over Cap'n Web, Cloudflare's open source object-capability RPC. The core repository is Apache-2.0 licensed.
Is Cloudflare OS production ready?#
Not yet. The README describes v2 as a complete rewrite in "early access" with rough edges, contributions are closed beyond small fixes, and the fully managed product, containers for development workflows, Slack integration, and workerd self-hosting docs are still on the roadmap.
Continue Reading#
- Cloudflare's Agent Access Model: Zero Trust for Task-Scoped Agent Runs - the reference architecture released earlier this week that Cloudflare OS operationalizes
- Approval Fatigue Is an Agent Security Bug - why synchronous approvals break agent workflows, and what fixing it requires
- Zero-Touch OAuth for MCP: Enterprise Auth Gets Practical - the OAuth primitives behind Gatekeepers and MCP Server Portals
- Skills Are the New Agent Operating System - the context-and-skills layer that Cloudflare OS bakes into every workspace
- DevDigest OS: The Thesis Behind Treating an Empire as One Operating System - our own take on tools that compound into a coherent layer
- lib0xc Is the Opposite of Rewrite Culture - related deep dive
Sources#
Get the next deep dive like this in your inbox
One email a week on News and the rest of the AI dev stack. Free.
Read next on AI coding tools
Cloudflare's Agent Access Model: Zero Trust for Task-Scoped Agent Runs
Cloudflare's Agent Access Model: short-lived task-scoped credentials, enforcement in the harness and network, and a Trust Ratchet that only narrows access.
7 min readApproval Fatigue Is an Agent Security Bug
Approval fatigue turns coding agent permission prompts into reflex clicks. The fix is risk-aware autonomy - safe reads, scoped writes, and meaningful gates.
7 min readZero-Touch OAuth Is the MCP Feature Enterprises Were Waiting For
MCP Enterprise-Managed Authorization explained: zero-touch OAuth moves agent tool access into the identity, policy and audit systems enterprises already run.
8 min readNew here? Start with
Technical content at the intersection of AI and development. Building with AI agents, Claude Code, and modern dev tools - then showing you exactly how it works.
