Agents that start with access to nothing: Cloudflare open-sourced the agent platform it runs internally

Cloudflare open-sourced its internal AI agent platform on August 5. Cloudflare OS ships under Apache 2.0 as cloudflare/cloudflare-os, and thousands of the company’s own staff have been using it since May. It landed inside a week of agent launches that reads like a map of the whole stack.

That week matters more than the repo. Cloudflare is arguing that the web has a second kind of visitor now, and that this visitor needs four things ordinary web plumbing never had to provide: a way to prove who it is, a way to find things, a way to call them, and a way to pay for them. The launches map onto those four needs almost one to one. What’s harder to work out from a wall of launch-day blog posts is which pieces a developer can build on this afternoon.

What an agentic internet needs

Start with the plain version. An agent is a program that browses on a person’s behalf: it fetches pages, reads them, decides something, then acts. It doesn’t render CSS, look at images, or click ads. Jack Galilee’s post framing the week states Cloudflare’s target in one line: “We see its future as readable, discoverable, callable, and payable.”

Identity comes first. A site trying to work out whether an inbound request is a person, a helpful assistant, or a scraper has almost nothing to go on beyond a user-agent string that anyone can forge. Cloudflare’s answer is Web Bot Auth, a signature scheme it describes as letting “a bot cryptographically identify itself to any site it visits,” paired with PACT, an anonymous vouching token it says it built alongside Mozilla, Google, Microsoft and Shopify.

Discovery is the second gap. Search engines index for keyword queries typed by humans, while an agent wants a semantic index and a callable endpoint. AI Search now crawls a site by following links instead of demanding a sitemap, and exposes public /search and /mcp endpoints that can sit on a custom domain. It’s in beta with billing switched off, and the published preview pricing starts at $0.75 per million ingestion tokens.

Invocation and payment are where the engineering gets interesting, and where the availability story gets messy.

Which pieces are actually shipping

The platform itself is the unambiguous one. Phillip Jones and Dan Carter write that Cloudflare OS deploys “into your own Cloudflare account” with your own Access policies and AI Gateway configuration, and Phoronix confirmed the Apache 2.0 license on the cloudflare-os repository. The security model is the part worth reading closely. “Inside, every agent and app starts with access to nothing,” the post says, and every external system is reached through a Gatekeeper: a service-specific Worker that can apply read-only mode, rate limits or an approval gate before a call goes through.

Kitesurf is the launch a developer can try in ten minutes. It’s a browser Cloudflare wrote from scratch to run on Workers, with a Rust DOM and HTML parser compiled to WebAssembly, Firefox’s Stylo for CSS, and a fresh V8 isolate per page load. Celso Martinho’s post puts median CPU for a screenshot at 380 ms against 1,173 ms for a warm Chromium pool, with memory at 57.8 MiB against 271.0 MiB. Wall time runs the other way, 1,148 ms versus 637 ms, so Kitesurf finishes roughly 1.8 times slower while burning a fraction of the resources. It passes more than 215,000 Web Platform Tests. Access is through Browser Run, “available for free while in beta, behind per-account limits.”

Then the enterprise half, which is gated. MCP Portal and WriteGuard went to private beta on August 5. Cloudflare’s internal portal now fronts 27 MCP servers, up from 13 in April 2026, and WriteGuard sits between the MCP client and server to classify every tool into one of four risk tiers, from Read Only to Critical, then allow, modify or block the call. It also binds session context to a human identity so that each write is attributable to “an agent session acting on behalf of a particular person.” Sign-ups are open. General availability isn’t.

Cloudflare Wallets is the thinnest launch of the week. Handle claims are live at cloudflare.pay, so an agent can be addressed as something like research.example.cloudflare.pay, and an Account Wallet can delegate a spending allowance to an API-key-operated Virtual Wallet with allow lists and per-transaction caps. Actually paying with it comes later. That rhythm is familiar: the Monetization Gateway launched in July opened as a waitlist too, and x402 is the settlement rail in both.

Where this collides with open MCP

Every specification Cloudflare names here is genuinely open. x402, MCP, Web Bot Auth and PACT are all things anyone can implement, and Galilee makes a point of it: “We are Customer Zero of the same rails our customers use, with no privileged path or early-access API that only we can reach.” That claim holds up for the standards. The implementations are a different question.

WebMCP is the clearest example. The standard is a browser API exposed to pages as document.modelContext, shipping experimentally in Chrome 146. Cloudflare’s contribution is a toggle in the dashboard under Agent Readiness that injects one script tag with HTMLRewriter at the edge, so “there’s nothing to deploy and nothing to change at your origin.” That’s genuinely convenient. It also puts the tool contract a site advertises to agents in an edge config rather than in the repo, which is a strange place for an interface definition to live.

Developers noticed. The Hacker News thread on Cloudflare OS ran to 603 points and roughly 290 comments, with Kenton Varda answering objections in the replies. One commenter called the project “far too Cloudflare flavored to be interesting.” Another pointed at workerd’s own warning that it “is not a hardened sandbox” and should sit inside a virtual machine, which sits awkwardly next to a security pitch built on per-app sandboxes. A third itemised the pricing traps in D1, KV and WebSocket hibernation that make self-hosting cost more than the license suggests. Several read the announcement post as AI-written.

The most useful document of the week is also the least productised. The Agent Access Model is a reference design, and it admits its own gap: “We are not comfortable saying that multiplayer access control can be built end to end today.” It cites simulated agent workflows with privacy violation rates between 15.8% and 50.9%. Compare that with the OAuth provider Cloudflare shipped in June, which was a library developers could install and forget.

What this means for you

Sort the week by what’s installable and it gets short fast. Cloudflare OS and Kitesurf are the two things worth an afternoon: one is an Apache 2.0 repository, the other a free beta behind an endpoint many teams already call. AI Search is cheap to evaluate while billing stays off. WebMCP is a dashboard switch, which makes it both the lowest-effort experiment on the list and the easiest to reverse.

Everything else is a signup. WriteGuard is private beta, Wallets hands out a name rather than a payment method, and the Agent Access Model is a paper. Read that paper anyway before you design permissions for your own agents. Its Trust Ratchet idea, where a task’s capabilities only ever narrow and never widen after protected data arrives, is the part you can implement without buying anything, and the DPoP token binding it leans on is a published RFC.

The thing to watch is whether Kitesurf gets open-sourced. Martinho wrote that Cloudflare is “going to open source Kitesurf once we’re ready,” hoping that’s soon. A browser engine small enough to run in a V8 isolate, under a real license, would matter to people who will never buy a Cloudflare plan, in the same way the company’s acquisition of the VoidZero toolchain mattered to developers who don’t deploy on Workers. If that engine ships, the agentic internet pitch becomes infrastructure. If it doesn’t, this was a very good product launch with the word “open” carrying a lot of weight.