cloudflare/cloudflare-os

What it solves

Cloudflare OS is an AI-powered productivity environment designed to let companies create a safe, customized "operating system" for AI workloads. It addresses the security risks associated with AI agents and third-party apps by providing a sandboxed environment where users can generate and run personal, AI-written applications (called "Gadgets") without risking data leaks or unauthorized system access.

How it works

The system operates as a capability-based security layer built on Cloudflare Workers. It uses three core components:

• Gadgets: Private, AI-generated mini-apps that run in their own isolated sandboxes. Users can modify the code of these gadgets via AI prompts to add features tailored to their specific needs.
• Gatekeepers: Specialized security layers (similar to supercharged MCP servers) that moderate access to external services (e.g., GitHub, Google, Slack). They handle authorization and allow users to asynchronously approve or reject agent actions in bulk, preventing the agent from getting stuck while waiting for human approval.
• Blueprints: Templates that define entire applications, allowing users to share the code for a gadget so others can deploy their own private instance.

Who it’s for

It is designed for companies and teams who want to deploy a secure, internal AI productivity suite where non-technical users can use AI agents to build and use custom tools without needing a centralized SaaS model.

Highlights

• AI-Driven App Creation: A built-in coding agent builds, tests, and debugs custom gadgets from natural language prompts.
• Asynchronous Human-in-the-Loop: Gatekeepers simulate action outcomes locally so agents can continue working while waiting for user approval.
• Sandboxed Execution: Gadgets are isolated in Dynamic Workers and iframes, blocking internet access unless explicitly permitted.
• Real-time Collaboration: Built-in multiplayer support via Durable Objects, allowing multiple users to collaborate on gadgets in real time.
• Capability-Based Security: Agents and gadgets have zero access by default and must be explicitly introduced to specific resources.