Cloudflare OS

Scroll sideways for more →

Cloudflare OS is an open-source AI agent workspace and application platform released by Cloudflare on August 5, 2026, during the company's Agents Week 2026 launch week ^[1]. It gives each employee of an organization a browser-based chatbot workspace where an AI agent, loaded with company context, can research questions, produce documents and slides, run scheduled workflows, and build small sandboxed applications that the project's documentation calls "gadgets" ^[3]. The project began as an internal tool that Cloudflare rolled out to its entire workforce in May 2026, and the released version is a rewrite of that system, built on Cloudflare Workers by the team that develops the Workers runtime itself ^[1][3].

Kenton Varda, the Cloudflare engineer behind the Workers runtime, framed the release as a revival of his failed 2010s startup Sandstorm.io: "Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing. Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers" ^[4]. Despite the name, Cloudflare OS is not a computer operating system. The project's README says the term is used in two senses: an operating system "for the company to be productive with AI", and an operating system for AI workloads, in the sense that a kernel manages processes ^[3].

Overview

Cloudflare OS combines three parts: an agent workspace grounded in context and skills the organization curates, with an isolated runtime where agents write and run code; a security and governance framework, called Gatekeepers, for access to internal data and services; and a platform for personal, modifiable apps that people can build, share, and keep changing ^[1]. The launch post, written by Phillip Jones and Dan Carter, positions the product for non-developers: workspaces run in the browser, and skills captured by one team (the company's "best-known ways of doing recurring work as instructions an agent can follow") become reusable by everyone else ^[1].

A workspace can research a topic against connected company resources, turn the result into a document, presentation, or spreadsheet that stays connected to live data, build a collaborative app when a static document is not enough, and convert repeatable jobs into mostly deterministic workflows that use code for predictable steps and a large language model only where judgment is needed. Workflows can run on demand, on a schedule, or on events from connected systems ^[1].

The intended deployment model is that each company runs its own instance under its own name. The README states: "The idea is not that your company uses Cloudflare OS, but rather that you make it 'Your Company OS'" ^[3]. Varda confirmed on Hacker News that the product name and logo are configurable in the admin settings ^[7].

Origins inside Cloudflare

Cloudflare's chief information officer, Sam Rhea, described the internal history in a companion post published the same day ^[2]. He traces the project to a request from a sales employee for API keys, plural, to about a dozen internal systems of record, to power a "SuperApp" they had built with AI. Cloudflare had been cautious about AI rollout during 2025, but Rhea writes that at the end of that year "better models and more powerful harnesses changed that calculus," and hundreds of employees began building their own tools ^[2].

Rather than hand out API keys, the company wrote down five principles (among them "Everyone deserves superpowers," "The human owns the output," and "You should never have more permission with systems of record when using AI") and built a platform to enforce them, initially from existing pieces such as Workers and Cloudflare Access ^[2]. For engineers, Cloudflare built a context layer called the Engineering Codex; Rhea says agents checking work against it flagged nearly a quarter of a million potential problems, blocked 16,000 merges, and caught architectural issues in close to 600 designs before implementation over four months ^[2]. For everyone else, the company ran a "magic AI email bot" address that was secretly staffed by humans using AI tools; the thousands of requests it received were mined to identify which workflows people actually wanted automated, and those became the platform's initial skill files ^[2].

Cloudflare gave every employee access to the first version of Cloudflare OS in May 2026, and says thousands of people across every function used it daily ^[1]. The open-sourced code is version 2, a ground-up rewrite. According to the launch post, the first version's collaboration model exposed a gap: access to an MCP server told administrators which tools an agent could call, but not which underlying resources it had observed, so sharing an agent's output could leak information the viewer was not allowed to see. Version 2 rebuilds the system so that this tracking is part of the platform ^[1]. The README describes the August 2026 release as "early access" with "many rough edges" ^[3].

Architecture

Cloudflare OS runs on Cloudflare Workers and makes heavy use of Durable Objects, Dynamic Workers (lightweight V8 isolates that load code on demand, which Cloudflare introduced in March 2026 as a sandboxing mechanism for AI agents), and Durable Object Facets ^[3][13][14]. Every workspace is a Durable Object; every gadget runs in a Dynamic Worker facet with its own SQLite database, separate from the runtime managing it ^[1][3]. Several runtime features, including Dynamic Workers and Facets, were added to the Workers runtime specifically to support this project ^[3].

The README draws the operating system analogy explicitly: the workshop-backend package is the kernel, Gatekeepers are device drivers, the frontend is the shell, gadgets are processes, blueprints are executables, and shared permissions are ACLs. It argues that AI agents are a workload traditional operating systems do not yet manage: agents "must be accountable to a human user, while at the same time having their own restricted permissions," which the project addresses with capability-based security rather than access control lists ^[3].

The agent itself is a Code Mode agent: instead of invoking tools one call at a time, it performs tasks by writing and immediately executing snippets of code, an approach Cloudflare introduced in 2025 as an alternative way to consume Model Context Protocol tools ^[3][15]. Client and server halves of every gadget communicate over Cap'n Web, Cloudflare's open-source object-capability RPC protocol, which means every app automatically exposes an API that agents can call without anyone building an MCP server for it ^[1][3][16].

Gadgets and blueprints

The user experience resembles an online office suite, with one structural difference: each "file" can be its own application. When a user creates a slide deck, the system does not call shared SaaS software; it creates a private instance of the slide deck code just for that user, running in its own sandbox ^[3]. Because the instance is private, a coding agent can freely modify it, so a user who needs a missing feature can ask the agent to add it rather than filing a feature request ^[1][3]. Three blueprints (docs, slides, and sheets) are installed by default ^[7].

Gadgets are private by default and can be shared in two ways. Sharing the gadget itself gives collaborators real-time access to the same state, backed by the underlying Durable Object. Sharing a "blueprint" gives others a copy of the code only: a gadget instantiated from a blueprint contains none of the original's SQLite data, conversation history, credentials, or connected resources ^[1][3].

Each gadget's server runs in a Dynamic Worker with outbound internet access disabled, able to reach only resources the user has explicitly attached via Workers bindings; the client runs in a sandboxed iframe that can talk only to its own server over Cap'n Web via postMessage ^[1][3]. Varda has contrasted this with Sandstorm's design, which put each document in its own Linux container: "it didn't work well, because of cold start times and memory usage... Cloudflare OS doesn't use containers. It uses Dynamic Workers, which are 100x more efficient" ^[7].

Gatekeepers and security model

Cloudflare Access controls who can enter a Cloudflare OS instance, and inside it every agent and app starts with access to nothing ^[1]. Access to external services flows through Gatekeepers: service-specific Workers that sit between the platform and an external API, hold the credential (handling OAuth), enforce policy such as restricting an agent to a single repository or masking fields, log what was read, and mediate any action with an externally visible side effect ^[1][3][5]. The repository ships Gatekeepers for GitHub, Google, Cloudflare, Supabase, Notion, Confluence, email, Home Assistant, Slack, Spotify, and ZoomInfo, and existing MCP servers are supported through MCP Server Portals ^[1][3].

Two design choices distinguish the system from typical agent harnesses. First, approvals are asynchronous. Where conventional human-in-the-loop setups force the agent to stop and wait for each approval (pushing users toward auto-approve modes), a Gatekeeper simulates the outcome of an unapproved action locally, lets the agent continue and queue further work, and presents the human with the accumulated actions to approve or reject later, in bulk or one by one ^[3][5]. Reads do not require approval; writes do ^[7].

Second, policy follows what the agent has seen. Cloudflare OS records every resource an agent observes, and those observations stay attached to the agent and its outputs. When someone else tries to open a workspace or view what an agent produced, Gatekeepers verify that the person has direct permission to each observed resource, so sharing a dashboard built from a sensitive table cannot become a way to share the table ^[1]. The same observation log can block a "tainted" agent from writing data out, inviting collaborators, or making outbound requests, which Varda describes as groundwork for defenses against prompt injection and data exfiltration ^[1][7].

Model support and cost controls

Cloudflare OS is model-agnostic. As of the launch, the code supports Anthropic, OpenAI, Gemini, Workers AI, and Ollama as providers; in the default configuration users enter provider API keys directly in the UI ^[7]. An organization can optionally route all inference through Cloudflare AI Gateway, which centralizes site-wide keys, decides which models are available for which jobs, attributes every request to a person, team, or workspace, and enforces budgets and rate limits ^[1][7]. The README credits the open-source Pi library (pi-agent-core) for its single API across LLM providers, along with Monaco, Yjs, and Vite ^[3]. Varda has said the stack runs "decently well with some local LLMs" through Ollama, adding of self-hosting: "Honestly it is faster running locally" ^[7].

Relationship to Sandstorm

Cloudflare OS is a deliberate return to the ideas of Sandstorm.io, the open-source self-hosting platform Varda launched publicly in July 2014 with an Indiegogo crowdfunding campaign ^[4][8]. Sandstorm pioneered what it called fine-grained containerization, running each document or "grain" in its own isolated Linux container, with a capability-based sharing model ^[9]. As a business it failed: in February 2017 Varda announced the startup had run out of money, removed the "Sandstorm for Work" paywall, and open-sourced its scale-out backend, Blackrock, while the project continued as a community effort ^[9]. The following month most of the Sandstorm team, including Varda, joined Cloudflare ^[10]. Varda went on to build Cloudflare Workers, announced in September 2017; Cap'n Proto, the serialization and RPC framework developed by Sandstorm, was already in heavy use at Cloudflare when the team arrived ^[10][12]. Sandstorm's paid hosting service, Oasis, shut down at the end of 2019, and the community project moved to sandstorm.org in 2024 ^[11][19].

The lineage is direct on several points: per-user private instances of applications instead of shared SaaS, capability-based security instead of ambient permissions, and sandboxed sharing. The main technical difference is the substrate. On Hacker News, Varda wrote: "The real innovation was the fine-grained instances -- each document in its own container. No other container platform did that. But honestly, it didn't work well... So the stuff I have been building in Workers for the past 9 years turns out to be the thing that Sandstorm needed all along" ^[7].

Scroll sideways for more →

Availability

Cloudflare OS is open source under the Apache 2.0 license; the repository passed 5,800 GitHub stars within two days of release ^[3]. The project site describes it as "the open source AI operating system companies can shape around their own context, tools, and rules" ^[6]. It can be deployed to a Cloudflare account through a guided flow at os.cloudflare.app/deploy or via a starter repository that holds an organization's configuration, custom UI, and integrations without patching the core ^[1][3][17]. It can also run locally with a single command on wrangler and workerd, the open-source Workers runtime, and Cloudflare says tooling for production self-hosting on workerd is coming ^[3]. Varda noted he runs an instance "on a random server in my basement" ^[7]. Cloudflare says its consulting partners Presidio and Happy Cog will customize deployments for enterprises, and that planned work includes a fully managed version in the Cloudflare dashboard, container support for development workflows, and bringing workspaces into Slack and other chat tools ^[1].

Unusually for an open-source launch, the project discourages outside code contributions, accepting only small, trivially verified fixes. The README argues that AI has made writing code the easy part, so external contributions "are 'donating' the easy part of the job, while creating more of the hard work" of review ^[3].

Reception

The launch discussion on Hacker News reached 657 points and over 320 comments within two days, with Varda answering questions throughout ^[7]. A recurring complaint was the name; several commenters objected that the product is not an operating system. Varda replied that the name was simply the internal one that stuck after a naming brainstorm failed to produce agreement, comparing it to the accidental naming of the Wrangler CLI ^[7]. Others raised lock-in concerns, to which Varda responded that the entire stack, including the runtime, is open source and self-hostable offline, adding that the blog post targeted an enterprise audience while his tweet thread was written "for the hacker audience" ^[7].

Developer Jamie Lord published a close reading of the source code titled "Cloudflare OS is an architecture of distrust," highlighting the Gatekeeper contract's instruction to simulate unapproved actions: the system deliberately reports fictional success to the agent so work can continue before a human commits or discards the batch, which Lord reads as the platform's core assumption that agent decisions cannot be trusted to touch the world directly ^[18]. On the competitive question, one commenter called the product "effectively a Codex/Claude app competitor" and a sensible move because it helps Cloudflare sell its core infrastructure, a common read of the launch's positioning against enterprise agentic AI offerings ^[7].

See also

• Cloudflare
• AI agent
• Model Context Protocol
• MCP server
• Chatbot
• Human in the loop
• Vibe coding

References

1. ^Phillip Jones and Dan Carter, "Cloudflare OS: an open platform for agents, apps, and work", Cloudflare Blog, August 5, 2026. blog.cloudflare.com/cloudflare-os
2. ^Sam Rhea, "How we're rethinking work at Cloudflare with Cloudflare OS", Cloudflare Blog, August 5, 2026. blog.cloudflare.com/how-we-use-ai-with-cloudflare-os
3. ^cloudflare/cloudflare-os repository and README, GitHub, accessed August 7, 2026. github.com/...cloudflare-os
4. ^Kenton Varda (@KentonVarda), post on X, August 5, 2026. x.com/...2084990137180590572
5. ^Kenton Varda (@KentonVarda), post on X describing Gatekeepers, August 5, 2026. x.com/...2084990302784307363
6. ^Cloudflare OS website, accessed August 7, 2026. os.cloudflare.app
7. ^"Cloudflare OS: an open platform for agents, apps, and work", Hacker News discussion with comments by Kenton Varda (kentonv), August 5-7, 2026. news.ycombinator.com/item
8. ^Kenton Varda, "Open Source Web Apps Aren't Viable; Let's Fix That", Sandstorm Blog, July 21, 2014. sandstorm.io/...web-apps-require-federated-hosting
9. ^Kenton Varda, "Sandstorm is returning to its community roots", Sandstorm Blog, February 6, 2017. sandstorm.io/...storm-returning-to-community-roots
10. ^Kenton Varda, "The Sandstorm Team is joining Cloudflare", Sandstorm Blog, March 13, 2017. sandstorm.io/...2017-03-13-joining-cloudflare
11. ^"Sandstorm Oasis is Shutting Down", Sandstorm Blog, September 15, 2019. sandstorm.io/...2019-09-15-shutting-down-oasis
12. ^Kenton Varda, "Introducing Cloudflare Workers: Run JavaScript Service Workers at the Edge", Cloudflare Blog, September 29, 2017. blog.cloudflare.com/introducing-cloudflare-workers
13. ^"Sandboxing AI agents, 100x faster" (Dynamic Workers), Cloudflare Blog, March 24, 2026. blog.cloudflare.com/dynamic-workers
14. ^"Durable Objects in Dynamic Workers: Give each AI-generated app its own database", Cloudflare Blog, April 13, 2026. blog.cloudflare.com/...ject-facets-dynamic-workers
15. ^"Code Mode: the better way to use MCP", Cloudflare Blog, September 26, 2025. blog.cloudflare.com/code-mode
16. ^cloudflare/capnweb (Cap'n Web RPC library), GitHub. github.com/...capnweb
17. ^cloudflare/cloudflare-os-starter (deployment starter repository), GitHub. github.com/...cloudflare-os-starter
18. ^Jamie Lord, "Cloudflare OS is an architecture of distrust", lord.technology, August 5, 2026. lord.technology/...-is-an-architecture-of-distrust
19. ^"Sandstorm now belongs to Sandstorm.org", Sandstorm Blog, January 14, 2024. sandstorm.io/...2024-01-14-move-to-sandstorm-org