Cloudflare OS: an open platform for agents, apps, and work

TL;DR Highlight

Cloudflare open-sourced an agent workspace where agents start with zero access and policy follows what they've read

Who Should Read

Platform or backend developer worried about handing API keys to internal agents and leaking data through shared outputs

Core Mechanics

An agent workspace for non-developers too
- You start with a chat in the browser, with company-curated context and skills preloaded.
- Thousands of Cloudflare staff have used it daily since May for docs, slides, automation, and small apps.
Agents start with zero access
- An agent requests a specific resource and a human grants or denies it.
- Generated code gets it as a typed binding like env.PROJECT, and the credential stays isolated from the agent.
Gatekeepers enforce per-service policy
- A service-specific Worker holds OAuth and credentials and enforces policy.
- For example: one repo only, read issues but not source, mask fields, rate limit, require approval before merge.
Policy follows what the agent has seen
- Every resource the agent observes is logged and attached to its workspace and outputs.
- When someone else opens them, Gatekeepers check that person's access to the original resources.
- After reading sensitive data, outbound writes, new collaborators, agent handoffs, and external requests can be blocked.

Community Reactions

Kenton Varda's take quoted in comments
- It's a remake of Sandstorm on Workers, where each Gadget is a separate sandboxed instance like a Grain.
- The platform handles access control, and each user can modify their own copy with an agent.
Concern about data models and updates
- Commenters asked how shared data and updates work if everyone customizes their own code.
- They also raised risks of users putting HIPAA-type data in apps and the long-term maintenance burden.
Lock-in and billing-cap worries
- Several commenters said vendor lock-in to Workers worries them.
- A solo developer said the lack of a billing cap or prepaid billing makes it hard to trust.
Hands-on and repo observations
- One user reported a free-plan account gets a message that Dynamic Workers require the Workers Paid plan.
- Another noted a checked-in plan file about moving from the Vercel AI SDK to pi-agent-core that calls the project early alpha.

How to Apply

Audit credential exposure per agent tool
- Spend 30 minutes listing whether each agent and MCP server holds an API key directly.
- Mark which can be narrowed to read-only, single-resource scope.
Design a least-privilege wrapper per resource
- Pick one service such as GitHub and write a policy table: per-repo, read-only, masked fields, approval-required actions.
- Let the agent call only the wrapper's small API.
Tie read history to outbound-write policy
- Flag any session where the agent read sensitive data.
- Block external requests and sharing for flagged sessions, or require approval.
Split repeat jobs into deterministic workflows
- Move fixed-rule steps of recurring agent tasks into code.
- Keep model calls only for the one or two steps needing judgment to cut tokens.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the Cloudflare OS permission model: internal agent permission design review)

You are an agent security design reviewer. Review the agent setup below against these principles.
1. Agents start with zero access, and resources are granted by a human on request.
2. Credentials are kept away from the agent and generated code, held by a per-service gateway.
3. Log the resources the agent read, and check the access of whoever opens its outputs against the original resources.
4. After sensitive data is read, block outbound writes, adding collaborators, handing off to other agents, and external requests.

[My setup]
Agent purpose: {{purpose}}
Connected tools/MCP servers: {{tool list}}
Credentials each tool uses: {{key/token types}}
How outputs are shared: {{sharing method}}

Output: (a) a table of violations per principle, (b) a least-privilege policy proposal per service (allow/mask/require approval), (c) 3 paths where read data could leak.

Next step: pick one policy and ask for a draft TypeScript wrapper interface.

Terminology

GatekeeperA Worker that acts like a security desk in front of an external service. It holds the credentials and filters what the agent may do.

capability (binding)An access pass for a specific resource under a specific policy. The code gets the pass, not the key itself.

Dynamic WorkerA Worker that runs generated server code in isolation. Here, outbound networking is disabled by default.

MCPA standard protocol that lets agents call tools. The server holds the credential and exposes only defined tools.

SandstormKenton Varda's startup from 10 years ago, mentioned in comments. It used a security model that sandboxes each app instance (Grain).