Cloudflare OS is an agent workspace for company work, originally built for internal use at Cloudflare and released so other organisations can run and customise their own copy. It provides three things: an agent chat surface preloaded with knowledge about how the company operates, sandboxed application development where agents build small personal apps, and a security framework that constrains both agents and those apps.
The unit of software is a gadget — a private instance of an application that belongs to one user rather than a shared multi-tenant service. Creating a slide deck creates a private copy of slide-deck software in its own sandbox, and the owner can ask an agent to change its code. Gadgets start from blueprints, which are shareable copies of a whole application rather than document templates. Every gadget is backed by a Durable Object, so real-time multiplayer collaboration and sharing work the way they do in an online office suite.
External services are reached through gatekeepers, each a separate Worker that wraps one service. A gatekeeper exposes a Cap'n Web API, handles OAuth, narrows access to the specific resource the user intended, logs every action, and gates side-effecting calls behind human approval. Approval is asynchronous: the gatekeeper simulates the outcome locally so the agent can keep queueing work, and the user approves or rejects the queued actions in bulk or one by one afterwards. Agents and gadgets start with access to nothing and must be introduced to each resource explicitly.
The system runs on Cloudflare Workers and makes heavy use of Durable Objects, Dynamic Workers, and Facets — every workspace is a Durable Object, every gadget runs in a Dynamic Worker Facet with internet access disabled, and client code runs in a sandboxed iframe that reaches its server only over a Cap'n Web RPC session. Because workerd is open source, the stack can also run on self-managed servers. The agent uses Code Mode, performing tasks by writing and immediately executing code snippets, and works with a range of model providers including self-hosted models. As of the August 2026 release this is version 2, a rewrite, published as an early-access project.
Features
- Gadgets: per-user private instances of applications, each in its own sandbox and editable by asking an agent
- Blueprints: shareable copies of a gadget's whole codebase, so each recipient runs and can modify their own instance
- Gatekeepers: per-service Workers providing a Cap'n Web API, OAuth handling, narrow resource scoping, and full action logs
- Asynchronous approval: side-effecting actions are simulated locally so the agent continues, and the user approves or rejects the queue later
- Capability-based access: agents and gadgets hold no ambient credentials and must be introduced to each resource
- Code Mode agent: a general-purpose agent that performs tasks by writing and executing code snippets, not only coding tasks
- Agent-friendly APIs: gadgets communicate over Cap'n Web RPC, so their server API is directly callable by an agent without a separate MCP server
- Real-time multiplayer: Durable Object backing gives shared editing and live collaborator presence by default
- Sandboxing: gadget servers run without internet access except through explicit bindings; clients run in restricted iframes
- Deployment options: run locally on wrangler and workerd, deploy to a Cloudflare account, or self-host on workerd
- Service gatekeepers included: GitHub, Google, Cloudflare, Supabase, Notion, Confluence, Email Workers, Home Assistant, Slack, Spotify, and ZoomInfo
