Cloudflare OS: An Open-Source Agent Workspace for Building Enterprise AI Apps

Key Features

Agent workspace grounded in company context – Each conversation is tied to the organization's curated knowledge, tools, and data. The workspace includes an isolated runtime where agents can write and run code .

Personal, modifiable apps (Gadgets) – Users can ask the workspace to build full-stack applications with client code, server code, an API, and durable state. Each app runs as a Dynamic Worker with its own Durable Object Facet and isolated SQLite database. Apps are private by default but can be shared as blueprints, allowing others to create their own copies .

Cap'n Web RPC – Client-server communication uses Cap'n Web, Cloudflare's open-source object-capability RPC system. Agents can call the same server methods that human-built apps expose .

Non-technical user empowerment – Employees without developer expertise can research, draft documents, spin up apps, and automate workflows without waiting for IT or engineering teams .

Managed dashboard deployment – A managed deployment option within the Cloudflare dashboard is coming, allowing organizations to run Cloudflare OS directly on their Cloudflare account .

Security Framework: Gatekeepers and Zero Permissions by Default

Cloudflare OS introduces a security model built on capability-based access control rather than broad ambient credentials. The core component is the Gatekeeper, a per-service Worker that sits in front of every internal system . Instead of giving agents blanket access via OAuth tokens or Model Context Protocol (MCP), Gatekeepers grant scoped, capability-based access: for example, read issues but not source code, mask particular fields, and apply rate limits .

Key elements of the security framework:

• Zero permissions by default – Agents and Gadgets start with no permissions; access must be explicitly granted per task, preventing ambient credential sprawl .
• Async human-in-the-loop approvals – The Gatekeeper can issue approvals that proceed without blocking while sign-offs happen in parallel, breaking from synchronous approval patterns .
• Zero Trust by default – The platform is built on Cloudflare Access, verifying every user and every request before granting access .
• Capability contract security – Cloudflare's position is that security must be part of the platform itself, not left to every person building an app or using an agent to implement correctly .

Model Flexibility

Cloudflare OS supports any AI model through Cloudflare AI Gateway . Administrators can :

• Choose different models per task (e.g., small efficient models for routine tasks, frontier models for high-reasoning needs).
• Control token usage and attribute costs by person, team, and app.
• Set spending budgets and rate limits.

Additionally, the platform works with local LLMs via Ollama, and Kenton Varda confirmed that running locally can be faster than the hosted version for some workloads .

Open-Source Licensing: Apache 2.0 with a Caveat

Cloudflare OS is released under the Apache 2.0 license . The core repository is hosted at github.com/cloudflare/cloudflare-os . Cloudflare also shipped a separate example-deployment repo that serves as a template for how any organization wires in its own UI, integrations, and skills . The code is built on Cloudflare's open-source workerd runtime .

Important caveat: While the license is genuinely open-source, the platform depends on Cloudflare-proprietary runtime primitives (Dynamic Workers, Durable Object Facets, Cap'n Web) that currently run well only on Cloudflare's own infrastructure. This means true vendor independence is limited .

Launch Partners for Enterprise Deployments

Cloudflare named two system integrators as launch partners for enterprise deployments :

• Presidio
• Happy Cog

These partners provide enterprise deployment channels alongside Cloudflare's developer-led open-source adoption motion .