How Cloudflare Scaled AI‑Powered Code Review to 3,600 Engineers and 240K Interceptions

Cloudflare’s internal AI engineering effort is organized as a three‑layer stack that supports platform services, knowledge about codebases, and enforceable engineering standards. The platform layer combines an AI Gateway with a proxy Worker that handles zero‑trust SSO, centralizes vendor keys, tracks costs, and stores data, allowing a single command ( opencode auth login https://opencode.internal.domain) to configure authentication, model lists, and policies without exposing API keys on developers’ machines.

Platform Layer: Unified Entry Point and Cost Reduction

All AI requests first pass Cloudflare Access for authentication, then route through the AI Gateway. A dedicated proxy Worker injects secrets dynamically, enabling per‑user cost attribution and model catalog updates without client changes. By running inference on Workers AI with the open‑source Kimi K2.5 model, Cloudflare cut the cost of a high‑volume security agent (70 billion tokens per day) by 77% compared to commercial closed‑source models, thanks to same‑network latency and no cross‑cloud data transfer.

Knowledge Layer: Service Catalog and AGENTS.md

Backstage serves as a service directory, exposing metadata for 2,055 services, 167 libraries, 122 packages, 228 APIs, 544 products, 1,302 databases, and 3,889 users. This structured data feeds AGENTS.md files placed at the root of each of the ~3,900 repositories, describing testing, linting, dependencies, and prohibited actions. An automated pipeline pulls metadata from Backstage, generates draft AGENTS.md via a model, and requires human review before committing, ensuring the documentation stays in sync with code.

Governance Layer: Cloudflare Codex RFC Library

Engineering standards are codified in a machine‑readable RFC library called Codex. Each RFC follows RFC 2119 terminology (SHOULD, MUST) and is stored as structured JSON with lifecycle stages: Approved and Enforced . Only after a rule reaches the Enforced stage does the AI code‑review system block non‑compliant merges. Over 60 RFCs have been created, each exposing a stable slug for cross‑system tracking.

AI Code Review Agent

The core review agent routes merge requests to up to seven specialized sub‑agents (security, performance, documentation, etc.) based on risk. Sub‑agents receive narrowly scoped prompts that explicitly list what not to consider, reducing hallucinations. High‑risk changes (e.g., modifications to auth/ or crypto/) are automatically escalated to the Full tier, costing up to $1.68 per review, while trivial changes cost $0.20.

During a four‑month period, the agent flagged nearly 240 k standard violations and blocked 16 k merges, with a median review cost of $0.98 and median latency of 3 min 41 sec. Model allocation follows a tiered approach: top‑tier models (Claude Opus 4.7, GPT‑5.4) act as coordinators, mid‑tier models (Claude Sonnet 4.6, GPT‑5.3 Codex) handle heavy‑weight checks, and the open‑source Kimi K2.5 handles lightweight documentation tasks.

Supporting Infrastructure

All agent outputs use JSON Lines for resilience against crashes.

Heartbeat logs (“Model is thinking…”) are emitted every 30 seconds to avoid premature cancellations.

Prompt injection is mitigated by stripping XML‑like tags from merge‑request bodies.

Circuit‑breaker logic, inspired by Netflix Hystrix, monitors model health and falls back to cheaper models when needed.

A “break‑glass” override allows engineers to force‑merge by commenting break glass in the MR.

Incremental re‑review re‑uses prior comments, only re‑evaluating unresolved issues.

Operational Metrics

30‑day AI Gateway traffic: 20.18 M requests, 2.4137 B tokens.

3,683 engineers (≈60% of staff) use AI tools daily; 95% coverage in R&D.

~3,900 repositories processed by AGENTS.md pipeline.

131,246 reviews covering 48,095 MRs; median 2.7 reviews per MR.

P99 review cost: $4.45; cache hit rate: 85.7%.

Takeaways for Other Teams

First ensure agents understand the codebase (service catalog + AGENTS.md) before expanding capabilities.

Make standards machine‑readable (RFC with SHOULD/MUST) before automating enforcement.

Separate approval and enforcement phases to give teams time to adopt new rules.

Allocate models by task complexity rather than cost alone.

Define “what not to do” in prompts to curb noisy output.

The real differentiator is the "wiring"—integrating platform, knowledge, and governance layers so that design reviews, code reviews, and post‑mortems all operate against a unified, machine‑enforceable standard.