Cloudflare OS is now listed on AIxploria, the AI tools directory that catalogues more than 5,000 AI sites, and it arrives there carrying a “Free” price label, a 4.5 out of 5 rating and a Gold Verified badge. That listing is accurate, and it is also the most misleading thing about the product.
The listing is accurate because Cloudflare OS genuinely is free: Cloudflare released it under the Apache 2.0 licence on 5 August 2026, and anyone can clone the repository today. It is misleading because a directory entry sits next to hundreds of tools you sign up for in ninety seconds, and this is not one of them. Cloudflare OS is a platform you deploy onto infrastructure you own, wire into your own identity provider, and point at a model provider you pay for separately.
This guide takes the AIxploria entry as a starting point and then answers the question the directory card cannot: what is actually inside, what does running it cost, what did Cloudflare learn from running it on themselves, and which organisations should genuinely deploy it. Our AI models and tools hub tracks releases like this one; this article is the deep read on a single platform.
We also cover the parts the marketing does not. Cloudflare’s own repository warns that the software “is very capable, but still has many rough edges”, the managed deployment route is not shipping yet, and one deployment mode is explicitly marked as unsuitable for production. Those caveats matter more than the star rating.
Every figure quoted here comes from Cloudflare’s own blog posts, its press release, the public repository, the AIxploria listing or Cloudflare’s published rate card, all dated. Where a number is our arithmetic on a published rate, we say so.
Table of contents
- What Cloudflare OS Actually Is — And What It Is Not
- Cloudflare OS On AIxploria: What Directory Placement Really Signals
- Inside The Architecture: Gadgets, Blueprints And Gatekeepers
- The Security Model That Makes Cloudflare OS Different
- What Cloudflare’s Own Rollout Of Cloudflare OS Proves
- What Running Cloudflare OS Actually Costs
- Cloudflare OS Versus The Commercial AI Workspaces
- Should You Deploy Cloudflare OS? A Practical Framework
- Frequently Asked Questions
- References
What Cloudflare OS Actually Is — And What It Is Not
The name causes more confusion than anything else about the product. Cloudflare OS is not an operating system in the sense that Linux or Windows is an operating system. It never touches a kernel, a bootloader or a filesystem driver.
The name is a metaphor, and a slightly unhelpful one
What Cloudflare means by “OS” is closer to the original sense of the phrase: the layer that sits between people and machines, arbitrates access to shared resources, and gives every application a common set of services to call. Cloudflare OS does that for AI agents rather than for processes. It runs in a browser tab, on Cloudflare’s own developer platform, and the resources it arbitrates are your company’s systems of record.
Matthew Prince, Cloudflare’s co-founder and chief executive, framed the intent plainly at launch: “Cloudflare OS is how we run Cloudflare. For AI to truly transform an enterprise, it can’t live in a silo or behind a developer bottleneck.” That sentence contains the actual product thesis. The problem it targets is not model quality. It is distribution and permission.
Three parts, not one product
Cloudflare OS bundles three things that companies usually buy or build separately. First, an agent workspace grounded in curated company context and skills, with an isolated runtime where agents can write and execute code. Second, a security and governance framework that mediates every request for internal data or services. Third, a platform for personal, modifiable applications that employees build, share and keep changing.
Most AI deployments ship the first part and improvise the other two. That is the gap Cloudflare OS is built to close, and it is why the architecture is worth reading properly rather than judging from a directory card. Read the three parts as a single decision: adopting Cloudflare OS means adopting its permission model too, because the workspace and the governance layer are not separable.
It ran in production before it was open source
The version on GitHub is not a science project. Cloudflare deployed the first internal build in May 2026 and, by the time of the August release, thousands of employees across every function used it daily. Prince was direct about why they published it: “We built this because nothing else did what we needed. Now any company can start from where it took us years to get.”
| Component | What it is | What it does in Cloudflare OS |
|---|---|---|
| Gatekeepers | Service-specific Workers | Hold credentials, enforce policy, mask fields, rate limit |
| Dynamic Workers | Lightweight V8 isolates | Host each user-built app in its own sandbox |
| Durable Object Facets | Per-object SQLite | Give every app a private database |
| Cap’n Web | Object-capability RPC | Carry client to server calls as capabilities, not URLs |
| AI Gateway | Model broker | Route to any provider, attribute and cap spend |
| Cloudflare Access | Zero Trust gateway | Decide who gets into the workspace at all |
| MCP Server Portals | Protocol bridge | Reuse existing Model Context Protocol servers |
Cloudflare OS On AIxploria: What Directory Placement Really Signals
AIxploria is a discovery directory, not an evaluator. It indexes over 5,000 AI sites by category and keeps a running “latest tools” feed, which is exactly how a platform released a fortnight ago surfaces there.
What the entry actually says
The AIxploria entry files Cloudflare OS under Developer Tools, where it currently sits at number 90 in the category. It is tagged #Developer Tools, #Github Projects and #Latest AI, dated 5 August 2026, priced Free, rated 4.5 out of 5, and flagged Gold Verified. The description leads on the sandboxed Gadgets, the shareable Blueprints and the Gatekeepers permission framework — which is a fair summary of the architecture.
Usefully, the listing is honest about the two prerequisites that a lot of coverage skipped. You choose a deployment route yourself, and you must configure your own model provider through Cloudflare AI Gateway. There is no bundled inference.
What a listing does not tell you
A directory rank measures visibility, not fit. “Free” here means the Cloudflare OS licence costs nothing, not that the deployment costs nothing — a distinction that matters a great deal once you read the cost section below. And a 4.5 rating on a two-week-old repository reflects launch enthusiasm rather than production experience.
The GitHub trajectory tells a clearer adoption story than the rating does. The repository cleared 3,900 stars on its first day, passed 6,000 within two days, and stands at roughly 8,500 as of 17 August 2026.
Where this sits against the rest of the market
Directory placement under Developer Tools is telling in itself. Cloudflare OS is aimed at organisations willing to run infrastructure, which is a much smaller pool than the productivity-suite market. If your evaluation shortlist came from a directory, this is the entry on it with the highest ceiling and the highest setup cost.
Inside The Architecture: Gadgets, Blueprints And Gatekeepers
Three coined terms carry most of the design, and understanding them is the difference between evaluating this platform properly and guessing at it.
Gadgets are private apps, sandboxed one per person
A Gadget is a small application that an agent builds on request and that then runs as a private instance for the person who asked for it. Each one gets its own Dynamic Worker — a lightweight V8 isolate — and its own SQLite database via a Durable Object Facet. Nobody shares state accidentally, because nobody shares a database.
This is the answer to a failure mode every AI rollout meets: someone builds something useful, and there is no safe place to put it. In Cloudflare OS a Gadget is the safe place, and the isolation is structural rather than a policy someone has to remember. Nothing else on the AIxploria Developer Tools list gives an ordinary employee a disposable, isolated application of their own.
Blueprints turn one person’s tool into everyone’s
A Blueprint is a shareable template of a Gadget. Publishing one lets colleagues instantiate their own copy without hosting anything themselves and without inheriting the author’s data or permissions. That single mechanism is what turned internal usage into volume at Cloudflare: employees created more than 4,000 apps and tools in a single month.
Gatekeepers hold the credentials so agents never do
The most important design decision in Cloudflare OS is that agents never receive API keys. A Gatekeeper — a service-specific Worker — sits in front of each system and brokers every request. Decrypt’s write-up put the consequence precisely: “The credential never touches the agent or its code.”
Because the Gatekeeper is real code rather than a prompt instruction, it can do things a system prompt cannot enforce: mask individual fields, apply per-resource restrictions, rate limit, and require human approval before a class of action proceeds. This is the single strongest reason to evaluate Cloudflare OS even if you ultimately deploy something else — the pattern is copyable.
Existing tooling connects through MCP portals
Organisations that have already built Model Context Protocol servers do not have to rebuild them. MCP Server Portals expose that existing estate to Cloudflare OS, which materially shortens the integration work for anyone who invested in AI employees and autonomous AI agents over the past two years.
The Security Model That Makes Cloudflare OS Different
Governance is the part most AI platforms bolt on afterwards. Here it is load-bearing, and the design choices are specific enough to audit.
Agents begin with zero access
An agent in Cloudflare OS starts with no permissions whatsoever. It must request access to a named resource, and that request is mediated. This inverts the normal pattern, where an integration is handed a broad service-account token and trusted to behave.
Outbound networking follows the same rule: it is disabled by default and reachable only through explicit capabilities. An agent cannot quietly call an external endpoint because the network path does not exist until someone grants it.
Observations are logged, and sharing is checked twice
Every resource an agent observes is logged and attached to the work it produced. When a colleague later opens that output, their own access rights are checked against the resources behind it. Cloudflare’s framing of the objective was that “the security had to be part of the platform, not something every person building an app or using an agent has to implement correctly.”
That is the practical answer to the leakage problem that makes information security teams block AI pilots — a concern we cover in depth in our guide to Copilot agents, security, governance and cost.
Cost control is a security control here
Cloudflare AI Gateway attributes inference to a person, a team or a workspace and enforces budgets against it. Cloudflare routes routine work to efficient models and reserves frontier models for genuine reasoning, which is a governance mechanism as much as a finance one. Our FinOps for AI guide covers the wider discipline.
Where the open-source claim has limits
One caveat deserves stating plainly. The code is Apache 2.0, but the platform is designed for Cloudflare’s runtime, and as Decrypt noted, “the runtime still is controlled by a central entity”. Self-hosting via the open source workerd runtime is listed as coming soon and its documentation is incomplete. Cloudflare OS is open source in licence and, for now, largely single-vendor in practice.
| Control | Typical AI integration | Cloudflare OS approach |
|---|---|---|
| Credential handling | Token issued to the agent | Held by a Gatekeeper, never exposed |
| Default permissions | Broad service account | Zero, requested per resource |
| Outbound network | Open unless blocked | Disabled unless granted |
| Field-level redaction | Prompt instruction | Enforced in Gatekeeper code |
| Onward sharing | Trusts the sharer | Re-checked against observed resources |
| App isolation | Shared tenant | One isolate and one database per app |
| Spend attribution | One org-wide API bill | Per person, team and workspace |
What Cloudflare's Own Rollout Of Cloudflare OS Proves
The most valuable document in this release is not the architecture post. It is the account by Sam Rhea, Cloudflare’s chief information officer, of how the internal rollout actually went, including the parts that went badly.
Five principles came before any code
Cloudflare set five rules first. Use AI to spend more time with customers. Everyone deserves superpowers. The human owns the output. Context from the organisation matters more than the model. And nobody should ever have more permission with systems of record when using AI than without it.
That fourth principle explains the entire product, and the fifth explains the entire security model of Cloudflare OS. Both are worth stealing regardless of which platform you choose.
The engineering numbers are substantial
On the engineering side the results are concrete. Over four months, code review agents flagged close to 250,000 potential problems and blocked 16,000 merges. Architectural issues were caught in 600 designs before implementation began. Cloudflare also maintains an Engineering Codex, an authoritative statement of its practices, as the context the agents reason against.
The ratio is the interesting part. Only 6.4 per cent of flags escalated to a blocked merge, which is what a review agent tuned for signal rather than volume looks like.
The non-engineering side needed a different product
Cloudflare’s admitted mistake is the most transferable lesson in the whole release. They first gave non-engineers the same code-focused tools with friendlier interfaces, and got, in their own words, “vibe coded apps looking for a problem to solve”.
The fix was to work backwards from real requests. A staffed email alias collected work people wanted automated, patterns were triaged by hand, and those patterns became prebuilt skill files. Demand-led beat capability-led. In the most recent month, the sales organisation alone recorded more than 10,000 hours saved on manual tasks. Anyone rolling out Cloudflare OS should plan for that same two-phase discovery rather than assuming the engineering pattern transfers.
Adoption came from champions, not mandates
Rather than a top-down programme, Cloudflare recruited champions across roles and geographies — a sales leader in London, a solutions engineer in Texas, investor relations in Portugal, business development in Japan, sales operations in the United States — and embedded 1,111 interns across departments to bring teams up to speed. Thousands of employees now use Cloudflare OS weekly, with daily actives still climbing.
What Running Cloudflare OS Actually Costs
“Free” is the AIxploria price label and it is true of the licence. The running cost is a different calculation, and it has two components.
The platform bill is Workers, not licences
Cloudflare OS runs on Cloudflare’s developer platform, so the platform bill is metered infrastructure. The Workers Paid plan starts at $5 per month and includes 10 million requests and 30 million CPU-milliseconds, with additional requests at $0.30 per million and additional CPU at $0.02 per million CPU-milliseconds. Durable Objects add 1 million requests and 400,000 GB-seconds monthly, then $0.15 per million requests, $12.50 per million GB-seconds, and $0.20 per GB-month of SQLite storage beyond the included 5 GB.
Applying Cloudflare’s published formula of $5 plus $0.30 per million requests above the included 10 million gives a platform cost curve that stays remarkably flat.
Excludes Durable Objects duration, storage and all inference. The point of the curve is that the compute underneath Cloudflare OS is not the line item that will surprise you.
The inference bill is the real number
Because you bring your own model provider through AI Gateway, token spend is entirely yours and is the dominant cost in any serious Cloudflare OS deployment. This is precisely why the per-person and per-team attribution built into Cloudflare OS matters — it is the only way the number stays governable. Our AI token cost calculator guide sets out the estimation method.
Three deployment routes, three very different commitments
There is no managed option yet. The dashboard-based deployment is listed as coming soon, and until it lands the choices are a hosted demo, your own Cloudflare account, or a local instance.
| Route | Effort | Your data stays where | Production ready |
|---|---|---|---|
| Hosted demo | Minutes | Cloudflare’s demo environment | No, evaluation only |
| Your Cloudflare account | Days to weeks | Your account and your Gatekeepers | Yes, with early-access caveats |
| Local instance | Hours | Your workstation | No, explicitly not for production |
| Managed via dashboard | Unknown | Cloudflare-managed | Not released yet |
| Partner-led | Scoped engagement | Your account | Available now via partners |
Cloudflare has named Presidio and Happy Cog as launch partners for implementation work. Matt Weinberg, co-founder and president at Happy Cog, made the case for the governance-first framing: “Security and governance can no longer be an afterthought when deploying autonomous” agents.
Cloudflare OS Versus The Commercial AI Workspaces
The honest comparison is not against a chatbot. It is against the enterprise assistants your organisation is probably already paying for.
Where it wins
Three Cloudflare OS advantages are structural rather than marketing. Model independence means no vendor lock-in and the freedom to route cheap work to cheap models. Governance is enforced in code that your own team can read and modify. And the licence cost is zero, so the spend follows usage instead of headcount — which changes the maths completely for large, low-intensity user populations.
Where the commercial products still win
Equally, three disadvantages are real. There is no managed hosting yet, so you are the operator. The repository itself concedes “many rough edges” and carries an early-access designation. And there is no bundled document-suite integration of the kind Microsoft ships by default; your integrations are Gatekeepers you build.
| Factor | Cloudflare OS | Bundled enterprise assistant |
|---|---|---|
| Licence cost | £0, Apache 2.0 | Per user, per month |
| Model choice | Any provider via AI Gateway | Vendor’s models |
| Who operates it | You | The vendor |
| Governance model | Code you can audit and change | Admin console settings |
| End-user app building | Gadgets and Blueprints | Limited or add-on licensed |
| Maturity | Early access, rough edges | Generally available |
| Skills required | Workers, TypeScript, identity | Administration only |
The two are not mutually exclusive
In practice many organisations will run both: a bundled assistant for document work across the whole company, and Cloudflare OS where agents need governed access to systems of record. The cybersecurity argument favours Cloudflare OS for anything touching regulated data, because the controls are inspectable rather than described in a compliance datasheet.
Should You Deploy Cloudflare OS? A Practical Framework
This is a genuinely good platform aimed at a genuinely narrow audience. Four questions settle it quickly.
The four questions
Do you already run infrastructure on Cloudflare, or are you willing to? If not, stop here. Do you have engineers who can write and own a Gatekeeper per integrated system? Do you have a model provider relationship and a budget you control? And can you tolerate early-access software in a workflow people depend on?
Four yeses make Cloudflare OS one of the strongest options available at any price. A single no makes a managed product the better answer this year.
A realistic first ninety days
Weeks one and two: run the hosted demo, and separately stand up a Cloudflare OS deployment in your own account with exactly one Gatekeeper against one low-risk read-only system. Weeks three to six: copy Cloudflare’s demand-led method — collect real automation requests from staff, triage them by hand, and turn the top patterns into skill files. Weeks seven to twelve: publish two or three Blueprints, enable per-team spend attribution, and only then widen access.
Resist the temptation to connect systems of record early. Cloudflare’s own sequence put governance and context ahead of breadth, and their fifth principle is the reason. Teams that need help standing this up can look at our intelligent automation and DevOps practices.
What to measure
Track four things: apps created per hundred employees, weekly active users, inference spend per active user, and the ratio of agent suggestions accepted to suggestions raised. That last one is the quality signal — Cloudflare’s own 6.4 per cent flag-to-block ratio is a useful benchmark for a well-tuned review agent. If Cloudflare OS is not moving all four numbers by the end of the first quarter, the problem is the context you loaded, not the platform.
Frequently Asked Questions
Is Cloudflare OS really free?
The software is, under Apache 2.0. You pay for Cloudflare Workers and Durable Objects consumption, and separately for all model inference through your own provider. Budget for the inference, not the compute.
Do I need a Cloudflare account?
For any real deployment, yes — the platform is built on Workers, Durable Objects and Cloudflare Access. A local instance exists for experimentation but is explicitly not intended for production use.
Is it production ready?
Cloudflare uses it in production themselves, but the public repository carries an early-access designation and states that the software “still has many rough edges”. Treat the first deployment as a pilot with a named owner.
What about self-hosting away from Cloudflare?
Server deployment on the open source workerd runtime is marked as coming soon with incomplete documentation. Anyone whose requirement is genuine infrastructure independence should wait for that to land.
Does it replace our existing AI assistant?
Usually not. Cloudflare OS is strongest where agents need governed access to internal systems and where employees should be able to build their own tools. Document-centric assistance is better served by a bundled product.
References
Cloudflare OS: an open platform for agents, apps, and work
How we’re rethinking work at Cloudflare with Cloudflare OS
Cloudflare OS Is the First AI Workspace Built Around How Companies Actually Work
cloudflare/cloudflare-os on GitHub
Cloudflare wants to provide the operating system for the AI-first enterprise
Cloudflare AI Gateway documentation
Cloudflare OS: Here’s What’s Inside the Open-Source AI Agent Platform
