Inside Cloudflare OS: An Open‑Source AI Operating System for Enterprises

Overview

Cloudflare OS is an AI‑driven productivity environment designed for corporate knowledge, workflows, and internal systems. It is not a traditional desktop operating system but a browser‑based workspace that integrates an Agent, a security/governance layer, and a platform for building and sharing small applications called Gadgets.

Agent Workspace and Early Access

The workspace launches as a conversational interface in the browser. Beyond chat, agents can search and analyse company data, generate documents, slides, tables, and convert repetitive tasks into scheduled or event‑driven flows. Cloudflare released the first internal version in May 2024 to thousands of engineers, salespeople, and other staff. The open‑source release is a rewrite of v2 based on that internal feedback.

Main entry point: Browser‑based Agent workspace

Outputs: Documents, slides, tables, applications, automation flows

Runtime base: Workers, Dynamic Workers, Durable Objects

Model selection: Supports multiple cloud models or self‑hosted models via AI Gateway

Status: Open‑source, early‑access

Gadget Model – Conversation to Application

Each “file” can become an independent application, termed a Gadget, written by an Agent for a person, project, or team. A Gadget bundles front‑end, back‑end, API, and persistent state. On the server side it loads on demand as a Dynamic Worker and obtains an isolated SQLite database through a Durable Object Facet, eliminating the need for a dedicated server and preventing state sharing with other apps.

The same API can be invoked by the UI or by an Agent. After an Agent creates a project board, the user may click UI buttons or let the Agent continue updating data or adding features.

Sharing offers two options: share a running application or share only the Blueprint. The Blueprint copies the code but does not transfer the SQLite data, conversation history, credentials, or connected resources.

Gatekeeper Security Model

Integrating Agents with internal systems raises permission questions: which data can an Agent read, where can results be sent, and who can view generated content. Cloudflare OS addresses this by assigning no default permissions to any Agent or application. When access to a resource such as GitHub, a calendar, or a data warehouse is required, the system grants a capability bound to that specific resource; real credentials remain stored in Gatekeeper.

Gatekeeper handles OAuth flows, enforces access policies, logs resource reads, and orchestrates manual approvals for actions with external impact. It can simulate the outcome of a pending approval so the Agent can continue work, with a human later approving or rejecting the batch.

Permissions follow the data: when the workspace reads a revenue table, ticket list, or team calendar, those “observation records” attach to the Agent and its artifacts. When another user opens the workspace or an app, the system re‑evaluates whether they have rights to the associated resources.

Open‑Source Availability and Deployment Requirements

The core repository and deployment templates are public. Developers can try the platform locally with pnpm run-local or deploy it to a personal Cloudflare account. The quick‑start method is marked as unsuitable for production.

Deployment prerequisites include Node.js 24, pnpm 11, and Cloudflare capabilities such as Workers, KV, R2, Browser Rendering, and Dynamic Worker Loaders. External integrations (GitHub, Google, Slack, etc.) require separate OAuth configurations. Full documentation for self‑hosting on workerd is still in progress.

Operational Costs and Early Feedback

Running costs arise from model inference, Cloudflare resources, internal system integration, and Gatekeeper maintenance. AI Gateway can track usage per person, team, or workspace and supports budgeting, throttling, and model routing, but there is no fixed‑price tier for Cloudflare OS.

Early user reports include:

A user connected a self‑hosted DeepSeek model and found the platform suitable for a private assistant.

Another user encountered repeated issues with R2, Workers, resource duplication, and Zero‑Trust configuration, leading to deployment failures.

Additional feedback mentioned UI panel glitches, disappearing panels, and incomplete support for complex file types.

These anecdotes represent a small sample and do not reflect overall experience.

Suggested Pilot Approach

Teams that already rely heavily on Cloudflare and need non‑technical staff to invoke internal systems may start with a low‑risk pilot: begin with read‑only data, verify permission tracking, approval flows, and sharing boundaries before enabling write operations.