A Gatekeeper is the Worker that sits between a Cloudflare OS agent and one external
system — wrapping its API, narrowing what the agent can reach, logging every read, and
holding every write for a person to approve.
Cloudflare ships Gatekeepers for the systems you would expect. It does not ship them for
regional or self-hosted tools, and since the project is not accepting outside code
contribution, those live in other people's repositories by design. These are ours, with
the detail that only comes from having built them.
Cloudflare OS agent
Gatekeeper
Auth model
API shape
Observer
Approval queue
Edge path from a Cloudflare OS agent through a custom gatekeeper to a system with an approval queue.
Illustrative connector pattern. Auth, API shape and observer choices are in each article.
We deployed it in its first week and wrote up what the licence permits, which pieces are
still in beta, why upstream contributions are closed, and the setup details the README
leaves out.