Cloudflare OS Open Source Release: Transparent Logging of Agent Activities

Cloudflare has open-sourced its Cloudflare OS agent platform, introducing a comprehensive audit trail for resource access and strict access controls.

Overview of Cloudflare OS Agent Platform

Cloudflare has released its Cloudflare OS agent platform as open source, following internal use by employees since May. The system tracks all resources accessed by agents, ensuring that any output generated by an agent is tied to the underlying data it interacted with. When another user accesses shared workspaces or outputs, the platform verifies their permissions against the recorded data before granting visibility.

Key Components and Features

For example, if an agent creates a dashboard from a sensitive database table, a colleague can only view the dashboard if they have explicit access to the original table. A key component of the platform is the Model Context Protocol, which defines which external tools an agent can invoke. However, this protocol does not track specific data interactions, such as rows, files, or repositories accessed.

Repositories and Access Controls

Two repositories were published on GitHub: a core framework and a starter deployment mirroring Cloudflare’s internal implementation. The system enforces strict access controls by design. Every agent and application begins with no permissions. When an agent requests a resource, a user grants or denies access, and the system generates a typed binding representing the allowed usage under a specific policy.

Execution Environments and Gatekeeper

Server-side code executes in a Dynamic Worker with outbound networking disabled, while client-side code runs in a sandboxed browser environment. Neither can access the internet without explicit capabilities handed through a service called the Gatekeeper. The Gatekeeper acts as an intermediary between the platform and external APIs, handling OAuth handshakes, storing credentials, enforcing policies, and logging accessed data.

Observation Logs and Data Visibility

A critical feature addressing data visibility is the observation log, which records every resource an agent accesses. This log remains attached to the agent and its outputs, ensuring that any subsequent user accessing shared workspaces or results must meet the same permissions as the original agent. The same log also governs outbound actions, preventing agents that accessed sensitive data from writing to restricted destinations, inviting collaborators, transferring tasks, or making external requests.

Platform Capabilities and Applications

The platform enables any file to function as an application. Workspaces can generate software, with agents creating client and server code dynamically loaded as Dynamic Workers or instantiated as Durable Object Facets—Cloudflare’s custom pairing for this project. Each app includes an isolated SQLite database, leveraging lightweight V8 isolates for efficient execution without idle containers.

Communication and Sharing Options

Communication between browsers and servers occurs via Cap n Web, Cloudflare’s open-source object-capability RPC system, allowing clients and agents to invoke server methods as if they were local functions. Apps are private by default, with two sharing options: collaborative editing of live state or distributing blueprints that include code without data, credentials, or connected resources.

Administrative Controls and Future Plans

Users requesting changes interact with agents instead of submitting direct requests. Administrative controls include the Cloudflare AI Gateway, which lets administrators select available models, attribute inferences to users or teams, and set budgets and rate limits. Cost management is a primary driver, as resource-intensive tasks like daily email summaries do not require high-end models.

The platform is accessible via GitHub.

About Author

Anuj

See author's posts