Cloudflare OSとは？APIキーをエージェントに持たせない基盤

In May of this year, we gave every person at Cloudflare access to the first version of Cloudflare OS. ／ Today, we are open sourcing a new version of Cloudflare OS. Any organization can deploy it, connect it to internal systems, and make it their own. ／ Cloudflare OS starts with a conversation in your browser, like many other AI tools. What makes it different is that each conversation is grounded in the context and skills your organization has curated. ／ Cloudflare OS combines three parts: ／ An agent workspace grounded in context and skills your company curates, with an isolated runtime where agents can write and run code. ／ A new security and governance framework for safe access to internal data and services. ／ A platform for personal, modifiable apps that people can build, share, and continue changing. ／ In Cloudflare OS, each “file” can be its own application, written by an agent for one person, one project, or one team. ／ Each one is a full-stack application with client code, server code, an API, and durable state. Apps are private by default, but can be shared like documents. ／ An app instantiated from a blueprint contains the original app’s code. But it does not contain its SQLite data, conversation history, credentials, or connected resources. ／ Apps were static rather than live software connected to internal systems, and mostly deterministic jobs still required running an agent skill again and consuming more model tokens. ／ Once people began sharing workspaces, apps, and outputs, we needed to ensure that collaboration could not expose information someone was not permitted to see. — 第1版の社内配布、オープンソース化、入口と3つの構成要素、アプリの単位、Blueprint、および第1版の課題に関する記述より

This is not a traditional computer operating system. We use the term "operating system" in two senses: ／ We call this a "gadget". This instance runs in a separate sandbox from everyone else's slide decks. ／ A Blueprint is essentially a copy of the code. ／ As of the August 2026 release, Cloudflare OS v2 is very capable, but still has many rough edges. — OS という語の断り書き、Gadget と Blueprint の定義、およびリリース時期に関する記述より

As people begin experimenting with AI at work, one of their first requests is often for API keys to company systems. ／ But handing over API keys to people and agents is dangerous and does not scale. Keys often provide broad, long-lived access that is difficult to constrain, share safely, and audit. ／ MCP alone does not tell us which underlying resources an agent has observed. ／ Cloudflare Access controls who can enter Cloudflare OS. Inside, every agent and app starts with access to nothing. An agent can ask for access to a specific resource, which you can grant or deny. Generated code receives that resource as a typed binding: ／ The credential remains completely isolated from the agent and any generated code. ／ Server code runs in a Dynamic Worker with global outbound networking disabled. Client code runs in a sandboxed frame in the browser. Neither can reach the Internet except through capabilities you explicitly provide. ／ A Gatekeeper is a service-specific Worker that sits between Cloudflare OS and an external service. ／ A Gatekeeper can give it access to a single repository, allow it to read issues but not source code, mask particular fields, apply rate limits, and require approval before merging a pull request. ／ The Gatekeeper handles OAuth, holds the credential, enforces policy, records what was read, and mediates anything with an externally visible side effect. ／ Cloudflare OS records every resource agents observe. ／ When another person tries to open the workspace, interact with the agent, or view what it produced, Gatekeepers verify that person's access to the observed resources. ／ A read of sensitive data can prevent the agent from writing data to certain sources, inviting new collaborators, handing work to another agent, or making an outbound request. ／ It also supports existing Model Context Protocol (MCP) servers your organization already uses via MCP Server Portals. — API キー要求の問題、エージェントの初期権限、実行環境の隔離、Gatekeeper の定義と制御粒度、観測ログ、および MCP との関係に関する記述より

Each agent, and each Gadget, by default has access to nothing. ／ Gatekeepers are like supercharged MCP servers. ／ When the agent (or Gadget) performs an action that requires approval, the Gatekeeper will simulate the outcome locally, allowing the agent to proceed and queue up more actions. ／ Once the agent is done, the user may approve or reject the actions in bulk, or one-by-one, but either way, they can do it later, when it is convenient. — エージェントの初期権限、Gatekeeper と MCP サーバーの関係、および非同期の承認に関する記述より

We are releasing two repositories: the Cloudflare OS core and an example deployment based on how we run it internally at Cloudflare. The deployment repository consumes the core without patching it, providing a place for configuration, custom UI, internal integrations, analytics, and deployment pipelines. ／ Our internal deployment reflects Cloudflare’s systems, terminology, policies, and ways of working. Yours should reflect your organization. ／ Cloudflare OS is designed so you can customize the interface, add internal Gatekeepers, and build organization-specific features without changing the core product. ／ Cloudflare OS can be used with any model. Every inference call runs through Cloudflare AI Gateway, giving your organization one place to decide which models are available and which model should handle each job. ／ Every request is attributed to the person, team, or workspace that made it. Administrators can see where inference spend is going, set budgets and rate limits, and decide what happens when a limit is reached. ／ Cloudflare’s strategic partners, Presidio and Happy Cog, will work with you to customize Cloudflare OS around how your organization operates and roll it out across your workforce. ／ Cloudflare OS is available today on GitHub. You can explore the source code, try the demo, or deploy it into your own Cloudflare account in a few minutes using our starter repository. — 公開リポジトリの構成、社内デプロイの位置づけ、カスタマイズの想定、モデルと費用の管理、提携先、および始め方に関する記述より

To quickly run Cloudflare OS locally, install pnpm, then do: ／ pnpm run-local ／ Then visit: http://localhost:8787 ／ This runs the whole stack locally on wrangler and workerd. This is not meant for production use, but is a quick way to see what the product does. ／ Your data will be stored in a subdirectory named .wrangler. ／ We've built an online flow that helps you deploy to your own Cloudflare account: ／ https://os.cloudflare.app/deploy ／ Or, for more sophisticated deployment, with your gatekeepers and potentially code changes, check out our deployment starter repo: ／ https://github.com/cloudflare/cloudflare-os-starter ／ COMING SOON ／ We are still working on documentation and tooling to help you smoothly deploy the OS on top of workerd on your own servers. ／ Many Gatekeepers require configuration in order to be able to connect to third-party services, including obtaining OAuth client credentials for each service. ／ As of the August 2026 release, Cloudflare OS v2 is very capable, but still has many rough edges. We know, and we're working on it. For now, consider this an "early access" release. ／ At this time, we are not seeking outside contribution. — ローカル実行、デプロイ、workerd への展開、Gatekeeper の設定、成熟度、および外部貢献に関する記述より

We’re working on bringing Cloudflare OS to the Cloudflare dashboard as a fully managed product, adding containers for development workflows, and bringing workspaces into Slack and other chat tools. — 今後の予定に関する記述より