By ByteBot
Ten years ago, Kenton Varda built Sandstorm.io — an app platform where every document was its own isolated application, controlled by a zero-trust security model. It failed. Not because the idea was wrong, but because the infrastructure to run it didn’t exist yet. Varda spent the next decade building that infrastructure at Cloudflare. On August 5, Cloudflare open-sourced the result: Cloudflare OS v2.
What Actually Shipped
Cloudflare OS is an AI agent workspace released during the company’s two-week “Agents Week” event. It’s open source under Apache-2.0, available at github.com/cloudflare/cloudflare-os, and runs on Cloudflare Workers. The distinction worth making: this is not a chatbot with connectors. Every competitor is building that. Cloudflare OS is an environment where AI agents build applications.
Cloudflare deployed v1 internally in May 2026. By August, thousands of employees — engineers and non-engineers alike — were using it daily to write docs, create slide decks, and build small internal tools. The v2 open-source release is a complete rewrite and is explicitly labeled “early access.”
Apps, Not Files
The fundamental unit of Cloudflare OS is the Gadget. When you ask the agent to build a dashboard, it doesn’t open a document. It generates a sandboxed application — its own Cloudflare Worker, its own Durable Object, its own SQLite database. The Gadget persists, stays live, and can be modified later by the same agent.
This is the inversion that matters: you’re not creating a file that an AI reads. You’re asking an AI to build you a running application. Each one is isolated from every other. A bug in one Gadget cannot touch another.
One app per document. Capabilities instead of credentials. Nothing reachable that you didn’t hand it. Kenton got that model right with Sandstorm years before the infrastructure existed to run it.
Dane Knecht, Cloudflare
Gatekeepers: Agents Start With Nothing
Every agent in Cloudflare OS begins with zero permissions. To connect to Slack, GitHub, or any external service, the agent needs a capability explicitly granted through a Gatekeeper.
Gatekeepers are Cloudflare’s answer to MCP — and deliberately go further. Rather than exposing a flat list of tools, a Gatekeeper exposes a Cap’n Web RPC API with built-in audit logging and human-in-the-loop approval hooks for any action with a side effect. MCP is supported as one type of Gatekeeper, but Gatekeepers enforce a stronger contract: policy follows data. When you share a Gadget, the Gatekeeper re-validates the recipient’s access to the underlying data sources before rendering anything.
In practice, an agent cannot silently read your Slack history, send email on your behalf, or query a database it wasn’t explicitly given access to. The architecture is designed for a world where agents write code that runs in production — and where a bad permission grant stays contained.
The Stack
- Workers — user workspace runtime
- Durable Objects — per-user state and per-Gadget persistence
- Dynamic Workers — the agent-generated Gadget applications
- SQLite — per-Gadget database via Durable Object Facets
- AI Gateway — model inference from 14+ providers
- Cap’n Web — RPC protocol between client and Worker-side app code
The cloudflare-os-starter repo handles deployment configuration. Fill in deployment.jsonc with your account ID and Worker names, run pnpm check, then pnpm deploy. Local evaluation uses pnpm run-local. Production self-hosting on the open workerd runtime is possible but documentation is still forthcoming.
The Business Model You Should Understand
The code is free. The infrastructure is not. Cloudflare OS runs on Workers, Durable Objects, Dynamic Workers, and AI Gateway — all billed Cloudflare services. Workers Paid starts at $5/month; actual costs scale with usage and model token consumption through AI Gateway. Cloudflare open-sources the workspace and earns on the compute. If you’re deploying this for a large organization with significant inference traffic, run cost estimates before committing.
Part of a Larger Bet
Cloudflare OS was one of more than 20 launches during Agents Week. Others included agent wallets with spend limits and human-in-the-loop financial controls, Agent Memory as a managed service, Browser Run with full CDP access for agents, and DeepSeek V4 Flash on Workers AI with a 1M-token context window.
Cloudflare is building the full agent infrastructure stack: compute, connectivity, security, economics, workspace. Whether Cloudflare OS becomes the default internal tooling platform for developer teams depends on how fast the rough edges get resolved. But the architectural decisions are genuinely different from everything else in this space — and 6,000 GitHub stars in two days suggests developers noticed.
