Kai Bitterschulte

Start here

AI on Cloudflare: a decision guide

Two questions decide which Cloudflare products you need for AI and whether to build an agent. The guide has three parts.

Kai Bitterschulte · · updated · 2 min read · Markdown

This guide covers which Cloudflare products to put in place for AI, and in which order.

Every AI setup has the same shape: someone acts, the AI runs in a session, it reaches models, tools and private systems through gates, and everything is logged. Step 1 starts with that picture.

Start with two questions

Do you build AI yourself, or use AI that someone else built? And who is affected, your customers or your employees? The answers give four cases.

BuildingAdopting Your customers use itYour staff use it Your staff use the toolsBots visit your sites Are you building AI, or adopting AI that someone else built? Who uses what you build? your customers, or your staff and operations Who is exposed? your staff using SaaS AI, or your own sites A. AI in your product Public AI endpoints, prompts from the internet AI Security for Apps, WAF, Bots, AI Gateway Build it with Part B B. Internal AI you build Copilots, agents, engineering and IT automation Access, AI Gateway, MCP portal, DLP, Mesh or Tunnel Cloudflare OS (A6) or Part B C. Your staff use third-party AI ChatGPT, Claude, Gemini, Copilot, coding assistants Shadow IT, Gateway policies, DLP, CASB No building involved D. AI visits your sites Crawlers and agents reading content and calling APIs AI Crawl Control, Bots No building involved Calling a hosted model API from your own product is still A: you build, the model is hosted. Where the model runs is decided in A3.
The four cases, A to D. Step 1 lists the products to put in place for each one, in order.

The reading path

  1. Step 1: Cloudflare and AI: choose your path. The four cases, which product guards which AI traffic, where models and agent-written code run, how to govern agents inside your company, and when Cloudflare OS fits.
  2. Step 2: Building AI agents on Cloudflare: which architecture when. For cases A and B. Ten ways to build an agent, from a plain Worker to Project Think and VibeSDK, with starter code.
  3. Reference: the decision matrix. The building blocks each situation needs, on one page.

Shortcuts by situation

Your situation Read first Then
A. Your customers use AI that you built (a chatbot or AI search in your product) A2: the control map and A3: where inference runs Step 2, then the matrix row A
B. Your staff use internal AI that you build (agents for engineers and IT, an internal assistant) A4: the governed agent workspace and A6: Cloudflare OS and A7: VibeSDK Step 2, then the matrix rows B1 to B4
C. Your staff use third-party AI (ChatGPT, Claude, Gemini, coding assistants) A2: the control map, control C4 The matrix row C. Nothing to build, so skip step 2.
D. AI visits your sites (crawlers and agents reading your content) A2: the control map, control C5 The matrix row D. Nothing to build, so skip step 2.

What to expect

Every product claim links to the public Cloudflare documentation, and experimental, beta and paid add-on features are marked. I built the guides from the documentation and checked them on 7 October 2026, but I have not deployed every option. Feature status changes, so check the linked page before you commit to a design.