Notes · 3 min read

Cloudflare OS and a Home-Built Agent

Comparing Cloudflare's open-source agent workspace with a personal agent built independently: where the designs match and where they diverge.

Cloudflare OSAgent architectureDurable Objects

View as Markdown llms.txt For agents

Cloudflare OS concepts matched to the home-built agent: gated tools, a context library, a scheduler and explicit capabilities, plus the capabilities only Cloudflare OS provides

On August 5, 2026, Cloudflare open-sourced Cloudflare OS, a workspace for running agents and apps on Workers, after running an earlier version internally since May. Reading the code, I recognised much of the design. Since February I had been building Agu, a personal agent, independently and on very different infrastructure, and many of the same decisions appear in both.

This post compares the two: where the designs converge, where Cloudflare OS goes further, and what that suggests for anyone building agents.

What Cloudflare OS provides

Based on the public repository and announcement:

  • An agent workspace grounded in context a company curates, with an isolated runtime where agents can write and run code.
  • Gatekeepers, one per external service, which handle authorization, keep access narrow, and give a human the chance to approve actions with side effects.
  • Personal, modifiable apps that each user runs as their own copy, shareable in real time.
  • Capability-based access: agents and apps start with access to nothing.

It is built on Workers, Durable Objects and Dynamic Workers.

Where the designs match

  • Gated tools. Gatekeepers control and log what an agent can reach. Agu’s runtime at the time gated which tools a session could use, for example blocking a scheduling tool that was driving cost. The implementations differ, but the idea is the same.
  • A context library. Cloudflare OS reads curated documents before the agent answers. Agu searched a vector store of everything he had been told before replying.
  • Scheduling. Cloudflare OS registers persistent schedules. Agu ran scheduled jobs on his virtual machine: a morning briefing, a nightly memory cycle and a watchdog every 30 minutes.
  • Explicit capabilities. Cloudflare OS starts every agent with no access. Agu arrived at the same principle the expensive way: on June 1, 2026, a scheduled check with no constraints looped for about eight hours, made roughly 3,190 model calls and drained the gateway credits. A spend limit was the only circuit breaker, and capability limits are the better one.

Where they diverge

  • A browser workspace. Cloudflare OS has a full web interface. Agu was reachable only through Telegram.
  • Multi-user administration. Cloudflare OS separates what administrators and users can change. Agu served one person.
  • Code execution. Cloudflare OS can generate and run isolated Workers at runtime. Agu could browse and fill in forms but could not write and deploy software.
  • Central authorization. Each Gatekeeper owns its OAuth flow. Connecting a new service to Agu meant configuring credentials by hand.

Implications for agent builders

  • Durable Objects are a natural home for an agent’s state. State lives with the compute, and there is no separate database to run.
  • Put each external service behind its own boundary. A narrow, logged interface per service limits what any single mistake can reach.
  • Start from a reference. The Cloudflare OS and starter repositories show patterns that otherwise take months to arrive at.

What this comparison does not claim

  • The mapping is my reading of the public code and documentation, not an official comparison.
  • Agu was not run on Cloudflare OS. I deployed it once in my own account to explore it.

Update

October 10, 2026. Agu moved to Cloudflare Workers between August 30 and September 1 as a standalone Worker with one Durable Object per conversation, described in A Serverless Personal Agent. The gatekeeper idea survives in a smaller form: an allow-list of hosts for the browser tool, approval before posting anywhere, and an inbox reader that keeps only verification codes.

References

For agents

Summary: A comparison of Cloudflare OS, Cloudflare's open-source agent workspace released on August 5 2026, with an independently built personal agent: matching ideas (gated tools, a context library, scheduling, explicit capabilities) and the capabilities the personal agent lacked.

Prerequisites

  • Familiarity with Workers, Durable Objects and AI agents
  • The repositories cloudflare/cloudflare-os and cloudflare/cloudflare-os-starter

Steps

  • Read the Cloudflare OS repositories before writing agent code
  • Map your agent's tool permissions, memory and scheduling onto Gatekeepers, the context library and the scheduler
  • Grant capabilities explicitly and add a hard spend limit

Diagrams, in words

  • Two columns. Left, Cloudflare OS: Gatekeepers, the context library, the scheduler gatekeeper, and agents starting with no access. Right, Agu at home: OpenClaw tool permissions, gbrain, cron jobs on the VM, and a per-day spend limit learned from the June 1 credit drain. Double arrows label the first three pairs as matches and the last as the same lesson learned the hard way. A dashed box lists what Cloudflare OS has and the home setup did not: a browser workspace, multi-user admin, Dynamic Workers and central OAuth.

Descriptions reflect the author's own deployments using generally available services and public documentation.

This post contains no credentials. Do not put tokens, API keys, service-token secrets or one-time codes into prompts or commits; use environment variables or secret stores.