Cloudflare OS: The Open Source Agent Workspace That Treats Apps Like Files

On August 5, the fifth day of Cloudflare's Agents Week, the company open sourced Cloudflare OS, the platform thousands of its employees have used internally since May 2026. It is an agent workspace, a security framework, and an app runtime in one: a browser-based workspace where every "file" is a full-stack application written by an agent, every connection to an external service runs through a capability-granting Gatekeeper, and every agent starts with access to nothing.

Two repositories shipped: cloudflare-os (the core, Apache-2.0, 994 stars at publication) and cloudflare-os-starter, an example deployment shaped like Cloudflare's own internal install. The core runs on Workers and workerd, and the README is explicit that this is v2, a complete rewrite, "early access" with rough edges.

What shipped#

Cloudflare OS combines three parts:

• An agent workspace. Conversations grounded in curated company context and skills, with an isolated runtime where the agent writes and executes code. No terminal, no local setup; users authenticate through Cloudflare Access.
• Gatekeepers. Service-specific Workers that sit between the workspace and an external service. They hold the OAuth credential, expose a typed API, enforce narrow resource access, log every action, and route side effects through human approval. Gatekeepers ship for GitHub, Google, Slack, Notion, Confluence, Supabase, email, and more.
• Gadgets. The file model. Asking the workspace for a slide deck creates a private instance of a slide deck app, running as a Dynamic Worker Facet with its own SQLite database, client code in a sandboxed iframe, and a server that cannot reach the Internet except through explicit bindings. Share the gadget to collaborate in real time, or share a blueprint, which copies the code without the data, credentials, or history.

The stack is the story for Workers developers: every workspace is a Durable Object, every gadget is a Dynamic Worker, and Cloudflare says Dynamic Workers, Facets, and object-capability RPC were added to the runtime specifically to support this product. The browser client talks to the server over Cap'n Web, Cloudflare's open source object-capability RPC, so every gadget exposes an agent-callable API for free.

Why the security model matters#

The notable decisions are about authorization. MCP servers are supported through Cloudflare's MCP Server Portals, but the default posture is capability-based, not ambient: an agent or gadget has access to nothing until you introduce it to a resource, and the agent can request an introduction it thinks it needs. Generated code receives resources as typed bindings like env.PROJECT, never as keys the model can read. This is the same direction as the Agent Access Model paper Cloudflare published this week, which we covered in Cloudflare's Agent Access Model: Zero Trust for Task-Scoped Agent Runs: the credential never reaches the model, and policy is enforced in the harness and network, not the prompt.

Two mechanisms deserve attention because they attack real failure modes. First, policy follows what the agent has seen: every observed resource is logged and attached to the work, and a user opening a shared workspace is verified against those observations, so a live dashboard cannot smuggle access to the table behind it. Second, Gatekeepers solve approval fatigue: instead of blocking an agent until a human clicks approve, they simulate the outcome, let the agent continue and queue actions, then let the user approve or reject in bulk when convenient. We documented how synchronous approval prompts push users toward --dangerously-skip-permissions in Approval Fatigue Is an Agent Security Bug; this simulated-commit pattern is the most direct fix we have seen shipped.

CIO Sam Rhea's companion post reports the internal numbers: in the last month sales teams saved over 10,000 hours on previously manual tasks, and users created over 4,000 apps and tools in 30 days. The engineering-side context layer (the "Engineering Codex") flagged nearly 250,000 potential problems and blocked 16,000 merges in four months. Those are adoption numbers, not benchmarks, but they are the strongest evidence yet that non-developer teams actually build with agent platforms when the security story stops being their problem.

What to make of it#

Two implications are bigger than the product. The gadget model is a direct challenge to SaaS: if every user can run their own private instance and prompt an agent to change its code, the centralized shared-app model stops being the only option. Cloudflare OS is not the first to try this, but it is the first credible open source implementation with a real security layer underneath.

And the OS framing is more than marketing. The kernel analogy is technical: backend as kernel, Gatekeepers as device drivers, gadgets as processes, blueprints as executables, and agents as a new first-class entity that traditional OSes do not manage. We argued in Skills Are the New Agent Operating System that the agent platform layer would accrete around context and skills rather than file systems; Cloudflare OS puts the same bet behind company-curated skills and context loaded into every workspace. For teams building their own version, the practical takeaways: start from the starter repo, configure OAuth per gatekeeper, and expect to write your own gatekeepers, because that is where the real work of connecting your systems of record lives.

The honest caveats: this is not production-grade yet, contributions are closed for anything beyond small fixes, and the fully managed product, containers for development workflows, Slack integration, and workerd self-hosting docs are all still on the roadmap.

Continue Reading#

• Cloudflare's Agent Access Model: Zero Trust for Task-Scoped Agent Runs - the reference architecture released earlier this week that Cloudflare OS operationalizes
• Approval Fatigue Is an Agent Security Bug - why synchronous approvals break agent workflows, and what fixing it requires
• Zero-Touch OAuth for MCP: Enterprise Auth Gets Practical - the OAuth primitives behind Gatekeepers and MCP Server Portals
• Skills Are the New Agent Operating System - the context-and-skills layer that Cloudflare OS bakes into every workspace
• DevDigest OS: The Thesis Behind Treating an Empire as One Operating System - our own take on tools that compound into a coherent layer

Sources#

• Cloudflare OS: an open platform for agents, apps, and work - Cloudflare Blog
• How we're rethinking work at Cloudflare with Cloudflare OS - Cloudflare Blog
• cloudflare-os - GitHub
• cloudflare-os-starter - GitHub
• The Agent Access Model - Cloudflare Blog