Cloudflare OS

What it is

Cloudflare OS is an open-source agent workspace that a company deploys into its own Cloudflare account. Every employee gets a browser chat where an agent, preloaded with company context and shared skills, researches, writes documents and slides, automates repeat tasks, and builds small internal apps. Cloudflare gave all of its own staff the first version in May 2026, open-sourced a full rewrite (v2) under Apache 2.0 on 2026-08-05, and on 2026-10-01 opened a waitlist for a managed version launched from the Cloudflare dashboard. The launch post reached the Hacker News front page at 668 points; the GitHub repository passed 10,200 stars by October 2026.

The “OS” in the name is a metaphor. Three parts do the work:

• Agent workspace. A Code Mode agent that completes tasks by writing and running code snippets, with any model you route through Cloudflare AI Gateway (Anthropic, OpenAI, Google, Workers AI, or self-hosted).
• Gadgets. Each document or app the agent builds is a private instance running in its own sandbox: a Dynamic Worker with outbound internet disabled, plus a sandboxed iframe. You share a gadget like a Google Doc, with real-time multiplayer, or share its code as a Blueprint so colleagues get their own copy.
• Gatekeepers. One Worker per external service (GitHub, Google, Slack, Notion, Confluence, ZoomInfo, Supabase, email and a few others ship in the repo). A Gatekeeper holds the OAuth credentials so the agent never sees them, exposes only the specific resource a user introduced, logs every read, and queues side-effecting actions for human approval.

The part worth buying: governance by default

Most agent workspaces connect MCP servers up front, so every chat has ambient access to everything you connected. Cloudflare OS starts every agent and gadget with zero access. A user introduces a specific repo, doc or channel; the agent can request more, and the user approves or denies. Every resource the agent reads is recorded in an observation log attached to its output, and that log decides later whether the agent is allowed to write to an outside destination or share the result with someone who lacks access to the source data.

Approvals are asynchronous. When the agent wants to send a Slack message or edit a doc, the Gatekeeper simulates the result, the agent keeps working, and the user approves or rejects the queued actions in bulk when they return. That removes the main reason teams switch agents to auto-approve.

Pricing reality

The software is $0. You pay Cloudflare for the infrastructure and a model provider for tokens. Figures checked 2026-10-01 on Cloudflare’s published pricing:

• Workers Paid — $5 per account per month. Required for Dynamic Workers. Includes 10 million requests and 30 million CPU milliseconds; beyond that, $0.30 per million requests and $0.02 per million CPU milliseconds.
• Dynamic Workers — $0.002 per unique Worker loaded per day, with 1,000 per month included; Cloudflare waives this fee while the feature is in beta.
• Cloudflare Access (Zero Trust) — the starter repo’s default sign-in. Free up to 50 users, then $7 per user per month on pay-as-you-go. The core also supports username/password or Google, GitHub and Cloudflare OAuth sign-in if you skip Access.
• Model tokens — billed by your provider through AI Gateway, with budgets and rate limits per person, team or workspace.
• Managed version — waitlist only; no price published as of 2026-10-01.

Worked example for 200 employees on Access: $16,800 a year for Access, $60 for Workers Paid, and tokens on top. The same 200 seats on Claude Team cost $48,000 a year at the $20 annual rate before anyone hits a usage cap, and Microsoft Agent 365 adds $36,000 a year to an E5 estate. The infrastructure line is small; the real cost is the engineer who deploys it, writes OAuth apps for each Gatekeeper, and upgrades a pinned early-access release.

Best for

Ops and IT leaders at companies of 50-2,000 people that already run on Cloudflare, have one platform engineer who can own a Workers deployment, and want every employee using agents against GitHub, Google Workspace and Slack without handing a vendor broad standing access. It fits RevOps teams building pipeline dashboards on live data, legal ops teams that need an audit trail of what an agent read before it drafted, and recruiting teams who want shared skills instead of everyone writing their own prompts.

Do not use it if nobody on staff will own the deployment, your core systems are Salesforce, HubSpot or an ATS (no Gatekeeper ships for them; you write one), or procurement needs a vendor SLA today.

Versus the alternatives

• Claude Cowork — pick it when you want a managed agent workspace this quarter with no deployment. $20-25 per seat, Anthropic models only, and connectors configured up front rather than introduced per task.
• Microsoft Agent 365 — pick it when the company is standardized on Microsoft 365 and the job is governing agents across the estate. $15 per user per month on top of a qualifying base.
• Dust — pick it when non-engineers need to build and share agents over Salesforce, HubSpot and Snowflake now. Managed, about $31 per seat, with connectors Cloudflare OS lacks.
• Onyx — pick it when the problem is search and chat over company knowledge, not building apps. MIT, self-hosted on any infrastructure, 40-plus connectors.
• OpenClaw — the fastest-growing open-source agent of 2026. Pick it for a personal agent for one to three operators. It has no multi-user permission model.

Watch-outs

• Early-access software. Cloudflare’s own README calls v2 an “early access” release with “many rough edges”, and the repository had 128 open issues on 2026-10-01. Guard: deploy through the cloudflare-os-starter repo, which pins an upstream release, and test each upgrade on a staging route before production.
• Thin connector catalog for business systems. The shipped Gatekeepers cover GitHub, Google, Slack, Notion, Confluence and ZoomInfo; there is none for Salesforce, HubSpot or an ATS. Guard: list your top five systems before piloting and budget engineering time to write a custom Gatekeeper for each one missing, using packages/custom-gatekeeper in the starter repo.
• Cloudflare lock-in in practice. Self-hosting on the open-source workerd runtime is documented as “coming soon”; production today means a Cloudflare account with Workers, KV, R2, Browser Rendering, Workers AI and AI Gateway enabled. Guard: treat it as a Cloudflare platform decision and get the security team’s sign-off on that dependency, not only on the app.
• No outside contributions. Cloudflare accepts only small, trivially verified pull requests, so the roadmap is Cloudflare’s. Guard: put company-specific changes in Gatekeepers and the starter wrapper rather than a fork of the core, so upgrades stay mechanical.
• Token spend is uncapped by default. The per-user daily allowance is off unless you set it. Guard: configure AI Gateway budgets and rate limits per team before the first all-hands rollout.