Cloudflare has released "Cloudflare OS" as open source.
After cloning the source code and running it myself, I realized this isn't just a release of an internal tool—it's the blueprint for how companies should use AI. Today, I'll dive into the code and explain it.
In short, this is the next phase after "giving employees ChatGPT." It's relevant for any company looking to integrate AI into their operations.
What is Cloudflare OS?
- An open-source version of the "infrastructure for safely using AI at scale" used daily by thousands of Cloudflare employees, from engineers to sales.
- A package consisting of three parts: a chat interface for tasking agents, a system for letting AI build business apps, and permission management.
- Released with the stance of "copy this for your own company and make it your 'Company OS'."
It's not a traditional OS, but there's a reason Cloudflare calls it one. Looking at the source, the backend is the "kernel," external service integrations are "device drivers," and AI-generated apps are "processes." It manages corporate AI usage with the same philosophy an OS uses to manage a computer.
The Concept of "Gadgets"
This is a crucial point.
- When you ask it to "make a slide," an instance of a private slide app is generated within a sandbox.
- Since every user has their own copy, the structure prevents data leaks to others caused by app bugs.
- If a feature is missing, you just say, "add this feature." You can modify it freely because it doesn't affect anyone else.
This is a contrarian move against the last 25 years of the "everyone connects to a central SaaS" model.
Until now, developers hosted apps on a server, and everyone connected to them. Cloudflare OS is more like a mobile app where everyone runs their own copy. Therefore, you don't have to wait for a developer to respond to a feature request. Users can fix it themselves by asking the AI.
The design assumes that if "AI has made everyone a developer," then centralized software models no longer make sense.
The Security Layer: "Gatekeeper"
You want agents to touch internal GitHub or Notion data, but you're afraid of data leaks. The answer to this dilemma is the Gatekeeper mechanism.
- Both agents and apps have zero permissions by default. They can only touch resources like GitHub repositories after they are "introduced" to them.
- All operations are logged, and actions with side effects wait for human approval.
- Unlike methods like MCP that show all tools from the start, this only provides what is necessary for the task at hand.
What impressed me most reading the code was the approval mechanism.
In typical "human-in-the-loop" systems where AI stops until a human approves, you might ask an agent to do something, step away, and return to find it stuck on the first step. People then resort to "auto-approve everything" out of convenience, leading to dangerous operations.
Cloudflare OS is different: it simulates the result of the pending operation and lets the agent move forward. The human can then approve or reject them in bulk later. "The agent proposes high-risk operations, and the human decides." This boundary is designed as a permanent solution, not a stopgap.
Running it Locally
I tried cloning and running it myself.
- It starts up locally with just
pnpm run-local, and you can use it in a browser. - It includes 16 types of external service integrations (Gatekeeper), including GitHub, Google, Notion, Slack, Supabase, Linear, Confluence, and schedulers, with separate permission management implementations for each.
- There is also a path to deploy it to your own Cloudflare account in minutes for production.
Looking at the build, the thoroughness of the authentication stands out. The settings for who can sign in are intentionally fixed in environment variables so they cannot be changed from the admin UI.
This design ensures that "even if an admin account is compromised, the authentication settings cannot be changed."
Why This is a "Business Story"
AI usage in many companies is currently in this state:
- They distributed ChatGPT or Copilot accounts to employees.
- But it stops at individuals using it for chat.
- When they try to let it touch real data or build apps, IT departments stop it for fear of data leaks.
Cloudflare OS demonstrates the next phase:
- Employees have AI build "private business apps" for them.
- These apps proliferate within the company.
- This is managed safely on a foundation that grants only necessary permissions starting from zero.
After "distributing AI to employees," the phase of "company-wide proliferation of AI apps built by employees" will come. What will matter then isn't the high-performance AI itself, but the foundation that manages it without letting it run wild.
The greatest value of this release is that a reference implementation, actually operated by thousands of people, is now entirely readable for free.
Summary
- Cloudflare OS is an open-source release of an entire infrastructure for safely using AI internally.
- The core is "Gadgets": everyone has their own copy of business apps that AI can freely modify.
- "Gatekeeper" provides only necessary permissions from a zero-base. The design that doesn't stop while waiting for approval is brilliant.
- It's still in the early access stage, but as a design philosophy for "corporate AI integration," it's worth reading now.
Last year, the job of designing how AI does work was born. Next, the job of designing the environment where all employees work with AI will be born.
The first complete form of that is now available for free.
