← All Demos
Ch 01 / 09 · Opening

Cloudflare OS Surface

Cloudflare OS is an AI-native OS built from real Developer Platform primitives — not a black box. The same global network that stops DDoS attacks and enforces WAF rules is the substrate every AI interaction runs on.

Cloudflare OS · Home
Cloudflare OS Home scene — prompt bar and workspace surface
Cloudflare OS · Home scene
Primary primitive cluster
kernel Worker Workers Runtime Cloudflare Network

The Cloudflare OS surface is served and orchestrated by a kernel Worker — the orchestrating Worker behind the Cloudflare OS surface. Each user interaction flows through this runtime before dispatching to the relevant primitive cluster.

What is a Worker?
Workers Runtime — Cloudflare's globally distributed serverless runtime. Code runs across 300+ cities with no cold starts and no infrastructure to manage. Think AWS Lambda or Google Cloud Run, but deployed at the network edge and natively composable with every other platform primitive through typed bindings.
Ch 02 / 09 · AI Control Plane

Model Breadth

100+ models. Any provider. One control plane. Built-in Workers AI models plus OpenAI, Anthropic, and more — switchable without changing your code.

Cloudflare OS · AI Providers
Cloudflare OS AI Providers — model picker showing built-in Workers AI models and custom providers
Cloudflare OS · AI Providers / model picker
Workers AI · Built-in models
Workers AI
@cf/meta/llama-3…
Text generation
Workers AI
@cf/mistral/…
Text generation
Workers AI
@cf/stabilityai/…
Image generation
Custom providers
Custom
OpenAI GPT-4o
External provider
Custom
Anthropic Claude
External provider
Primary primitive cluster
Workers AI
AI Gateway ↗ logging + cost Vectorize · embeddings / RAG ↗

Workers AI — 100+ built-in models, zero GPU provisioning. Custom providers extend the picker without changing your code. AI Gateway wraps every call: logging, caching, rate limiting, spend control.

AI breadth — what each primitive does
Workers AI
Workers AI — Cloudflare's managed inference service. 100+ open models — text, image, embedding, speech, code — run directly in your Worker. Zero GPU provisioning, zero idle capacity cost. Add Vectorize for semantic search, embeddings, and RAG pipelines on the same platform.
Cloudflare vs hyperscalers
Like AWS Bedrock or GCP Vertex AI — but edge-deployed across 300+ locations, billed per inference request, no separate model-hosting tier to provision or scale.
AI Gateway
Managed AI request proxy. Unified logging, caching, rate limiting, and cost tracking across any provider — Workers AI, OpenAI, Anthropic, and more. Observability and spend control built in, no extra infrastructure.
Ch 03 / 09 · Agent Orchestration

Prompt to Platform

A Code Mode coding agent writes and immediately executes snippets of code. The kernel Worker routes each prompt to the right connection type.

Code Mode
Writes and immediately executes snippets of code — a computer-style agent runtime, not a chat response.
Code Mode writes snippets immediately executes
Cloudflare Agents SDK — agent experience interface showing Code Mode agent connections and the OS Agent Connection Surface
Cloudflare Agents SDK · agent experience
OS Agent Connection Surface Direct — built into OS
AI Model
Model provider
Dynamic Route — kernel resolves at runtime
Agent
AI agent conversation
Agent bindings explicit — not ambient
MCP Server
Tool provider
Gatekeeper-controlled · visibility downstream
Connection detail + Agents SDK
Dynamic Route — when Agent type is selected, the kernel Worker resolves the model at runtime. Agent bindings are explicit: a gadget starts with no agent connection; one is created from its Connections tab only, keeping the surface scoped rather than ambient. The OS Agent Connection Surface is built directly into Cloudflare OS. The Agents SDK productizes the same fundamentals — agent state, capability boundaries, durable execution, and runtime integration — as a building block on the same substrate.
Primary primitive cluster
kernel Worker Workers Router Workers Runtime
Agents SDK fundamentals
State
Agent memory · workspace isolation
Durable Objects
Capability boundaries
Explicit bindings · Gatekeeper
MCP
Durable execution
Tasks survive restarts
DO Alarms
Observability
AI Gateway evidence
AI Gateway
Agents SDK — same fundamentals, packaged
Cloudflare OS demonstrates the same fundamentals that Cloudflare Agents SDK productizes: agent state, tool and capability boundaries, durable execution, human approvals, observability, and runtime integration. Use Cloudflare OS, or use the Agents SDK to build your own — the Developer Platform primitives are the substrate either way.
Why the platform foundation matters
Typical agent SDK
orchestration library only
external runtime · state · tool hosting
multiple services to connect and secure
Cloudflare advantage
globally deployed Workers Runtime
Durable Objects — state built in
AI Gateway evidence + cost control
explicit tools via bindings · MCP · Gatekeeper
Less glue. One programmable platform.
Ch 04 / 09 · State

Workspace State

Each Cloudflare OS Workspace holds isolated, durable state. Durable Objects power the per-workspace state surface and scheduling.

Cloudflare OS · Workspaces
Cloudflare OS Workspaces — multiple isolated workspace containers each backed by a Durable Object
Cloudflare OS · Workspaces scene
Workspace A
Durable memory
Conversation history persists across sessions
DO Facets
Per-gadget isolated state surface
Scoped state
All state belongs to this workspace only
Workspace B
Independent isolation
Zero state leak from or to Workspace A
Alarms
Scheduled background work, runs concurrently
Concurrent-safe
Never shares state with any other workspace
state boundary — no cross-workspace access
Primary primitive cluster
Durable Objects DO Facets DO Alarms
Workers KV ↗ callout Cloudflare R2 ↗ callout

Each Cloudflare OS Workspace maps to a Durable Object. Facets provide an isolated state surface per gadget. Alarms power scheduled work.

Globally unique actor
One consistent instance — stateful coordination without distributed-lock complexity
Compute + storage together
Built-in strongly consistent storage — no external database to provision
Co-located at the edge
Compute and storage co-located at the edge — no round-trip to a separate DB tier
Ch 05 / 09 · Governance

Governed Capabilities

Capabilities are explicitly granted — not ambient. Zero Trust applied to AI tool access. The same policy model behind Cloudflare's SASE and Zero Trust network controls governs which tools agents can reach.

Cloudflare OS · Add resource
Cloudflare OS Add Resource screen — governed capability attachment via Gatekeeper
Cloudflare OS · Add resource (governed flow)
Primary primitive cluster
Gatekeeper Service bindings
Model Context Protocol (MCP) ↗ Zero Trust governance ↗
Cloudflare Access ↗ boundary note
Governed capability path
Workspace
User's isolated OS environment — no ambient capabilities by default
Cloudflare OS Gatekeeper
Explicit capability attachment — governed tool registry, nothing is ambient. Like IAM role bindings, enforced at runtime.
MCP Portal
User MCP Portal presents approved tools; auth via Cloudflare Access. Reads immediate; writes need approval.
Approved tools in workspace
Only Gatekeeper-approved, explicitly declared capabilities reach the agent
Side path
Service bindings — typed, zero-latency inter-Worker calls wire the Gatekeeper to the kernel Worker. No HTTP round-trip, no auth ceremony. The platform wires them at deploy time.
Ch 06 / 09 · Isolation

Generated Code Sandbox

In the observed Cloudflare OS configuration, generated code is loaded as a secure sandbox in a Dynamic Worker with internet disabled by default; only explicit Workers Bindings and Facets can cross the runtime boundary; capabilities are granted only through explicit bindings.

Cloudflare OS · Outputs
Cloudflare OS Outputs scene — generated gadgets running as isolated Dynamic Workers
Cloudflare OS · Outputs / generated gadgets
Adjacent
Sandbox SDK
An adjacent Cloudflare primitive for container-backed execution environments. Distinct from Cloudflare OS's Dynamic Workers-based sandboxing model shown above.
Primary primitive cluster
Dynamic Workers Worker Loaders Facets
Sandbox SDK ↗ adjacent
Evidence chips
LOADER globalOutbound: null disallow_importable_env Facet install
Sandbox flow
Dynamic Worker · isolated code execution
Generated code
AI-authored gadget source — untrusted, unreviewed input
Worker Loader
LOADER binding — loads gadget into an isolated Dynamic Worker scope
Dynamic Worker · runtime boundary
globalOutbound: null · disallow_importable_env · no ambient access
Facets + explicit bindings
Durable Object Facets · declared capabilities — nothing else crosses the boundary

Similar in isolation principle to Lambda per-invocation scoping — but runtime-level, no VM overhead, globally deployed, composable with typed bindings. Evidence chips reflect the observed Cloudflare OS configuration; not universal Dynamic Worker platform guarantees.

Ch 07 / 09 · Observability

Evidence Plane

Every AI request is logged, auditable, and cost-tracked. AI Gateway is the observability and evidence layer — compliance and spend control built in from day one.

AI Gateway · User Insights dashboard Real values · live evidence
AI Gateway analytics dashboard showing request logs, token counts, and cost tracking with real values
AI Gateway · Request analytics (real values)
AI Gateway analytics continued — detailed request breakdown, latency, and provider breakdown
AI Gateway · Analytics detail view
Primary primitive cluster
AI Gateway Observability

AI Gateway — managed AI request proxy, provider-agnostic. Works with Workers AI, OpenAI, Anthropic, and more. No extra infrastructure.

AI Gateway · what you get
Enforce / control
rate limits
caching
model / provider routing
retries and fallback
cost governance controls
Gain visibility
requests + responses
token usage and cost
latency and errors
model + provider detail
request-level analytics
Logged, auditable, and cost-tracked — compliance built in.
Ch 08 / 09 · Architecture

Composed Architecture

Every primitive from the last seven chapters composes into one architecture. The open-source showcase sits on top — the Developer Platform substrate powers everything underneath.

For builders coming from hyperscalers

The same primitives you rely on — model catalogs, stateful coordination, code execution isolation, observability, and policy enforcement — exist here. Cloudflare's distinction: every primitive is globally deployed across 300+ locations, integrated into one runtime, and composable through typed bindings with no separate infrastructure to provision or stitch together.

Hyperscaler analog
AWS Bedrock / GCP Vertex AI
Managed model catalog + gateway
Cloudflare equivalent
Workers AI + AI Gateway
Edge inference + unified routing, logging, and cost tracking
Workers AI: primarily usage-based — pay for what you use, no pre-provisioned GPU capacity. AI Gateway core features (analytics, caching, rate limiting) currently available at no charge.
Hyperscaler analog
DynamoDB + Step Functions / Azure Durable Entities
Stateful coordination
Cloudflare equivalent
Durable Objects
Single-threaded actor, co-located storage, no separate DB tier
Durable Objects combine stateful compute and strongly consistent storage in one primitive — fewer separately provisioned services.
Hyperscaler analog
Lambda isolation / Firecracker microVM
Code execution boundary
Cloudflare equivalent
Dynamic Workers
Runtime-level isolation, no VM overhead, globally deployed
Runtime isolation without provisioning a VM or container per workload.
Hyperscaler analog
IAM + API Gateway / Azure API Management
Governed tool registry + policy enforcement
Cloudflare equivalent
MCP portal + Gatekeeper + Access
Integrated auth, capability attachment, governed tool registry
Integrated auth and capability governance reduce separate gateway and policy plumbing.

Cloudflare's integrated primitives mean the same runtime handles compute, state, and observability — and the same global network that stops DDoS attacks, enforces WAF rules, and powers Zero Trust / SASE access policies wraps every app, agent, and API built on it. Less glue, less platform sprawl, security by design.

Ch 09 / 09 · Validation

Seal Proof

Cloudflare OS is used for real internal work. Seal is an internal tool experience built on Cloudflare OS — validating the pattern beyond a demo.

Seal · Internal tool experience
Seal internal tool experience — built on Cloudflare OS primitives. High-level view only.
Seal · Internal tool experience built on Cloudflare OS · High-level description only
Closing proof

An internal tool experience built on Cloudflare OS.

Seal proves the pattern works at real scale. Cloudflare OS is the open-source showcase — the Developer Platform primitives are the foundation your team builds on, whether you use Cloudflare OS, extend it, or build your own AI-native experience from scratch.

Wording boundary: description is high-level only. Specific internal systems, teams, data sources, and tool inventory are not exposed here.
Cloudflare OS Internal validation Open source → build your own