Cloudflare OS Review 2026 — Open-Source Agent Workspace or Just Another 'OS' in Name?
✅ Pros
- • Security is genuinely baked in, not bolted on: agents and apps start with zero access, generated code receives typed capability bindings (env.PROJECT), server code runs in Dynamic Workers with outbound networking disabled, and Gatekeepers mediate every external service with OAuth held server-side
- • Observation-based policy is a real advance over plain MCP: Cloudflare OS records every resource an agent has seen, and sharing a workspace re-checks the viewer's access to those observed resources — a dashboard built from a sensitive table can't leak it to people without table access
- • Apps are first-class, not chat artifacts: each app is a full-stack Worker with client code, server code, an API, and durable SQLite state, shareable as a live app or as a blueprint that other people can copy and modify with AI
- • Model-agnostic with cost control: all inference goes through AI Gateway, so admins get per-team attribution, budgets, rate limits, and model routing decisions in one place
- • The Sandstorm lineage shows: capability-based security, per-instance app isolation, and 'apps you can modify' are ideas Kenton Varda spent a decade refining, now rebuilt on Workers
⚠️ Cons
- • The 'OS' name is doing heavy lifting — HN spent a third of the thread arguing about it, and skeptics are right that it's a pre-wrapped Codex/Claude Cowork competitor, not an operating system
- • Open source in license only, not portability: it runs on Dynamic Workers, Durable Object Facets, and workerd, so you're locked into Cloudflare's platform regardless of the MIT-style code
- • Deploy friction is real: several HN users hit the Workers Paid plan wall ('Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan') and prathje reported R2 subscription and repeated setup retries before the starter deploy worked
- • Model support is gated: providers are limited to what Cloudflare uses internally (ollama is there for local, but the broader provider list is still pending UI work, per kentonv)
- • The demo surface is thin: jakswa found local Gemma4 12B Q6 struggled to use it for simple goals like a daily briefing after an MCP tool call, and there's no simple artifact concept yet
Enterprises already on Cloudflare that want a governed, self-hosted agent workspace with per-app isolation — especially orgs where security teams need to sleep at night while every employee gets an agent
Cloudflare OS itself is free and open source (github.com/cloudflare/cloudflare-os); deployment requires a Cloudflare account on the Workers Paid plan (from $5/month plus usage) because Dynamic Workers are a paid feature; inference costs are whatever your models cost via AI Gateway
Quick Verdict
Cloudflare OS is the most serious enterprise-agent-platform launch of the week, and it earned the top spot on Hacker News (432 points) for a reason: it is not another chatbot with connectors. It is an open-source, self-hostable workspace where every employee gets an agent grounded in company-curated context and skills, where every “file” can be a full-stack app the agent built, and where security is enforced by the platform rather than by each prompt.
The catch is the same one that dominated the HN thread: it is open source in name but Cloudflare-platform-bound in practice, and the “OS” branding annoyed enough people that it became the top comment thread. Score it as what it actually is — a well-architected, security-first agent workspace for orgs already living inside Cloudflare — and it is a 7.2. Score it as a portable open-source OS and you will be disappointed.
What Cloudflare OS Actually Is
Cloudflare has been running the first version internally since May, with thousands of employees across every function using it daily — including non-engineers making documents, slides, and small data apps. Today’s release open-sources the rebuilt second version via two repos: cloudflare-os (core) and cloudflare-os-starter (an example deployment based on how Cloudflare runs it internally).
Three parts define it:
- An agent workspace — browser-based, no terminal required. Each workspace bundles agent sessions, persistent state, outputs, resource access, and an isolated runtime where the agent can write and execute code.
- A security and governance framework — the Gatekeeper model described below.
- A platform for personal, modifiable apps — every app is a full-stack Worker with its own SQLite database, instantiated as a Durable Object Facet and loaded on demand as a Dynamic Worker.
Conversations can graduate into docs, slides, spreadsheets, live apps, or deterministic workflows. A workflow runs code for the predictable steps and only calls a model where judgment adds value — on demand, on a schedule, or on an event.
The Gatekeeper Security Model: Why It’s Different From MCP
This is the part that makes Cloudflare OS worth studying even if you never deploy it. The team’s core observation: MCP tells you which tools an agent can call, but not which underlying resources the agent has observed. An agent can read a sensitive table, then expose it through an app or output to someone without table access.
Cloudflare OS solves this with three layers:
- Agents start with no access. An agent must ask for access to a specific resource; granting it produces a typed binding in generated code:
const issues = await env.PROJECT.listIssues({ teamId: "ENG", state: "open" }). The credential stays isolated from the agent and generated code. - Gatekeepers govern everything external. A Gatekeeper is a service-specific Worker that understands a service’s API and resources. Instead of giving an agent your whole GitHub account, a Gatekeeper can scope it to one repo, allow reading issues but not source code, mask fields, apply rate limits, and require approval before merging a PR. It holds the OAuth credential, enforces policy, and logs what was read.
- Policy follows observation. Every resource an agent observes is logged. When someone else opens the workspace or views its output, Gatekeepers verify that person’s access to the observed resources. A read of sensitive data can block the agent from writing to certain sources, inviting collaborators, or making outbound requests.
Cap’n Web (Cloudflare’s open-source object-capability RPC) is what lets client code call server methods like plain JS functions — and lets the agent call the same methods, so a tool you build for yourself becomes a tool the agent can use when you’re away.
Pricing: Free Code, Paid Platform
| Component | Cost |
|---|---|
| Cloudflare OS (core + starter) | Free, open source on GitHub |
| Workers Paid plan (required for Dynamic Workers) | From $5/month + usage |
| R2 storage (for some starter flows) | Free tier ~10GB, then usage-based |
| Model inference via AI Gateway | Per-token, model-dependent; BYO keys or hosted models |
| Presidio / Happy Cog customization | Enterprise consulting (quote-based) |
The free-plan wall caught multiple HN deployers by surprise. prathje walked through it live: after subscribing to R2 (free for 10GB), the deploy then demanded Dynamic Workers, which requires the Workers Paid plan. pelagicAustral suggested Cloudflare make the paid requirement obvious up front. arush15june had a smoother run — deployed to Workers in about a minute, worked through Cloudflare Access SSO — but found provider configuration fiddly.
The HN Debate: Name, Lock-In, and ‘Just Another Codex’
The community reaction split into four camps, and each is worth reading:
The naming backlash. A large chunk of the thread is people annoyed that “OS” is slapped on non-bootable software. kentonv (Cloudflare, creator of Sandstorm) leaned into it: “Mostly to get trolls to retweet and complain about it for free advertising. It’s working. ;)” His substantive defense: Sandstorm called itself an OS too, and any platform with an application model software is written against is close enough.
The Sandstorm recognition. Several veterans connected the dots before Kenton confirmed it: “This is a remake of Sandstorm.io, my startup from 10 years ago, except this time built on Cloudflare Workers.” losvedir posted an 11-year-old comment about wanting to build server-side apps people could run without hosting — the exact problem Sandstorm (and now this) targets. mosura was less impressed: “Sandstorm without self-hosting has no interest,” then conceded after learning it can run locally.
The competitor read. wxw called it “effectively a Codex/Claude app competitor” and alansaber called it “a pre-wrapped Codex for enterprise” — the natural evolution of setting up an MCP server. bearjaws argued Cloudflare has a structural advantage: both OpenAI and Anthropic host on Cloudflare infrastructure today.
The lock-in anxiety. This was the deepest thread. hobofan: “It’s open source, but it is so incredibly tied to their platform, that there is no vendor portability.” nthypes: “I really don’t know how folks accept such vendor lock-in.” kentonv pushed back with the strongest counter: “This is 100% open source and self-hostable. It runs on top of our open source runtime” — linking workerd. nater5000 gave the balanced take: if you’ll accept lock-in anywhere, Cloudflare is a reasonable place to accept it.
Use Case: A Real Deployment Walkthrough
HN user arush15june provides the most concrete hands-on report: they deployed Cloudflare OS on Workers in about a minute, got it working through Cloudflare Access SSO, and connected it to a Hermes agent they’d previously been driving from Slack off a Proxmox VM. Their verdict: “If this takes off, this is really how enterprise agents should end up looking like. The dynamic workers hosting applications is the AI Appsmith/Retool that I need for internal dashboards.”
The flip side came from jakswa, who tried running it against a local Gemma4 12B Q6: the model “really struggles to make use of this for simple goals like a daily briefing after an MCP tool call.” Lesson: the platform is only as good as the model you route through it, and local open-weight models may not be strong enough for multi-step agent work yet.
Alternatives Comparison
| Dimension | Cloudflare OS | Claude Cowork / Codex | Open WebUI |
|---|---|---|---|
| Self-hostable | Yes (on Cloudflare platform) | No (hosted) | Yes (any server) |
| Security model | Capability bindings + Gatekeepers + observation-based policy | Per-seat hosted; app-level sandboxing | No equivalent; BYO auth |
| Apps & state | Full-stack Workers + SQLite per app | Artifacts, no durable custom apps | Chat UI, no app runtime |
| Model choice | Any model via AI Gateway, incl. ollama local | Provider’s models primarily | Any OpenAI-compatible endpoint |
| Vendor portability | Weak — requires Cloudflare platform | None (hosted) | Strong (Docker anywhere) |
For teams evaluating an internal agent platform, the honest question from HN commenter dennisy applies: “Are you finding many clients looking at your system and telling you they could prompt Claude directly?” If your org is already on Cloudflare Workers, Cloudflare OS’s governance model is a genuine step ahead of per-seat chat apps. If you’re not, the portability cost is the price of admission.
FAQ
Is Cloudflare OS actually free? The code is free and open source, but a working deployment requires the Workers Paid plan (from $5/month plus usage) because the backend needs Dynamic Workers. You also pay for model inference.
Does Cloudflare OS work with my own models? Yes, any model reachable through AI Gateway, plus ollama for local inference. The provider list in the UI is still limited, but kentonv says the plan is to expand it to everything pi-agent-core supports.
How is this different from MCP servers? MCP controls which tools an agent can call. Cloudflare OS adds observation tracking — it records which resources an agent has seen and gates sharing/output on the viewer’s access to those resources.
Is this a replacement for Claude Code or Codex? Not for individual coding workflows. It’s an enterprise workspace layer — HN’s consensus read was “pre-wrapped Codex for enterprise,” aimed at non-developers and governed access.
Verdict
Cloudflare OS is the strongest argument yet that enterprise agents need platform-level security rather than prompt-level hoping. The Gatekeeper model, the zero-access defaults, and observation-based policy are genuinely novel in a shipping product, and the Sandstorm pedigree shows. But the platform coupling is real, the “OS” branding invites fair mockery, and the deploy experience still trips over paid-plan walls.
Buy it if your org is already on Cloudflare and wants governed agents for everyone. Skip it if you want portable open-source software or you’re happy with Claude Cowork/Codex for a small team — the governance layer only pays off at scale.