Cloudflare open-sources 'Cloudflare OS,' an agent workspace for the whole company

Cloudflare has open-sourced Cloudflare OS, a platform that gives every employee — not just developers — an AI agent and workspace grounded in their organization’s own context, terminology, and internal systems. The company ran an internal version starting in May, where thousands of staff across functions used it to draft documents and slides, automate routine tasks, and build small data apps. The pitch is that once someone codifies a good way to do a recurring job as a reusable skill, the whole organization inherits it, rather than re-explaining process and best practices to a model on every task.

The rebuilt version leans heavily on security and governance, framed as a lesson from the first iteration: knowing which tools an agent can call via MCP says nothing about which underlying data it has actually seen, so authorization has to follow the data wherever it flows into shared apps and outputs. Every agent and app now starts with zero access and must request specific resources, which are handed over as typed capability bindings while the real credential stays isolated from the agent and any code it generates. Server-side agent code runs in a Dynamic Worker with outbound networking disabled, and client code runs in a sandboxed browser frame.

Beyond chat, a workspace can produce live documents and spreadsheets that stay wired to their data sources, build collaborative multi-user apps, and run mostly-deterministic workflows that use code for predictable steps and a model only where judgment helps. Cloudflare positions this as extending the tight feedback loop coding agents already enjoy to the rest of the business, with governed connections to systems of record through ‘Gatekeepers’ and support for existing MCP servers. The significance is less the individual features than the packaging: a self-hostable, security-first substrate any organization can deploy, connect to its own tools, and customize.