Reference: decision matrix
AI on Cloudflare: decision matrix
Map your AI situation to the Cloudflare building blocks you need, and compare the options for building an agent, on one page.
The first matrix maps your situation to the Cloudflare building blocks you need. The second compares the options for building an agent: AIChatAgent, Project Think, an MCP server on a Worker, an existing harness, Cloudflare OS, VibeSDK and more.
How to read it
- Core and included items give a working, safe setup.
- Add recommended items when they apply, for example DLP if prompts hold personal data.
- Optional items are for specific needs. Not needed items are not part of the situation.
- Provided in the second matrix means the platform supplies it. You may still write code to use it.
1. Your situation: which building blocks do you need?
| Your situation | Who | Models | Tools | Data and prompts | Run safely | Visibility | Other | Core | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Access and your IdP | AI Gateway | MCP server portal | Code Mode | DLP | AI Security for Apps | Secure Web Gateway | Sandbox or Dynamic Worker | Private network reach | Shadow IT and CASB | Logs to your SIEM | AI Crawl Control and Bots | Build on Workers and Agents SDK | ||
| You build AI | ||||||||||||||
| A. AI in your productYour customers use AI that you built. | ○ | ● | ○ | ○ | ◐ | ● | · | ○ | ○ | · | ◐ | ◐ | ○ | 2 |
| B1. A workspace for all staffAgents, documents and small apps for non-developers. Cloudflare OS is a ready-made start. | ● | ✓ | ◐ | ✓ | ◐ | · | ○ | ✓ | ○ | ○ | ◐ | · | · | 4 |
| B2. Governed agents for engineers and ITAgents with shell, repos and tests, under your rules. | ● | ● | ● | ◐ | ◐ | · | ○ | ● | ● | ○ | ● | · | ◐ | 6 |
| B3. Agents your teams already useClaude Code, opencode, Codex and similar. You secure them, you do not build a loop. | ● | ● | ◐ | ○ | ◐ | · | ◐ | ○ | ○ | ◐ | ◐ | · | · | 2 |
| B4. Your own agent for a processYou build it on Workers and the Agents SDK. | ◐ | ● | ◐ | ◐ | ◐ | ○ | ○ | ◐ | ◐ | · | ◐ | · | ● | 2 |
| You adopt AI | ||||||||||||||
| C. Your staff use third-party AIChatGPT, Claude, Gemini, coding assistants. Nothing to build. | ◐ | ◐ | ○ | · | ● | · | ● | · | · | ● | ◐ | · | · | 3 |
| D. AI visits your sitesCrawlers and agents read your content. Pay per crawl is in private beta. | · | · | · | · | · | · | · | · | · | · | · | ● | · | 1 |
A. AI in your product
Your customers use AI that you built.
Core: put it in place first
- AI Gateway: Put AI Gateway between your app and the model: logs, budgets, caching, fallback, guardrails.
- AI Security for Apps: Detects prompt injection, PII and unsafe topics in requests to your AI endpoints. Needs the WAF.
Recommended: add it when it applies
- DLP: DLP in AI Gateway scans prompts and responses for sensitive data.
- Logs to your SIEM: Send AI Gateway logs to your SIEM with Logpush.
- AI Crawl Control and Bots: Bots and rate limiting protect your AI endpoints. AI Crawl Control covers content scraping.
Optional: only for specific needs: Access and your IdP, MCP server portal, Code Mode, Sandbox or Dynamic Worker, Private network reach, Build on Workers and Agents SDK.
Not needed: Secure Web Gateway, Shadow IT and CASB.
B1. A workspace for all staff
Agents, documents and small apps for non-developers. Cloudflare OS is a ready-made start.
Core: put it in place first
- Access and your IdP: Cloudflare Access controls who can enter. Inside, every agent and app starts with access to nothing.
Included: built into the product
- AI Gateway: All inference runs through AI Gateway, attributed per person or team, with budgets and limits.
- Code Mode: The agent works by writing and running code (Code Mode).
- Sandbox or Dynamic Worker: Server code runs in a Dynamic Worker with outbound internet off. Client code runs in a sandboxed frame.
Recommended: add it when it applies
- MCP server portal: Existing MCP servers connect through MCP server portals. Gatekeepers cover other systems.
- DLP: Not described in the public Cloudflare OS sources. Plan it with your Zero Trust setup.
- Logs to your SIEM: Send Access, Gateway and AI Gateway logs to your SIEM.
Optional: only for specific needs: Secure Web Gateway, Private network reach, Shadow IT and CASB.
Not needed: AI Security for Apps, AI Crawl Control and Bots, Build on Workers and Agents SDK.
B2. Governed agents for engineers and IT
Agents with shell, repos and tests, under your rules.
Core: put it in place first
- Access and your IdP: People sign in with your IdP through Access. Optional device posture checks.
- AI Gateway: Model calls go through AI Gateway behind Access. Provider keys stay in the gateway.
- MCP server portal: Give each role its tools through an MCP server portal. Access logs each tool call.
- Sandbox or Dynamic Worker: Run each session in a Sandbox or Container, removed on exit.
- Private network reach: Mesh or Tunnel routes reach only what the user's group may reach.
- Logs to your SIEM: Send logs to your SIEM as evidence of who reached what.
Recommended: add it when it applies
- Code Mode: Code Mode helps when the tool set is large.
- DLP: Scan prompts and responses.
- Build on Workers and Agents SDK: Build the agent loop on Workers, or use an existing coding agent.
Optional: only for specific needs: Secure Web Gateway, Shadow IT and CASB.
Not needed: AI Security for Apps, AI Crawl Control and Bots.
B3. Agents your teams already use
Claude Code, opencode, Codex and similar. You secure these agents and do not build a loop.
Core: put it in place first
- Access and your IdP: Put Access in front of the gateway domain and the portal.
- AI Gateway: Route the agent's model calls through AI Gateway. The docs have guides for Claude Code, Claude Desktop, Gemini CLI, GitHub Copilot CLI, OpenAI Codex, OpenCode, Pi and VS Code.
Recommended: add it when it applies
- MCP server portal: If the agent uses internal or SaaS tools, add the portal as its remote MCP server.
- DLP: Scan prompts for sensitive data.
- Secure Web Gateway: Gateway policies can block direct provider endpoints so calls cannot bypass the gateway.
- Shadow IT and CASB: See which AI tools are used beyond the approved ones.
- Logs to your SIEM: Send logs to your SIEM.
Optional: only for specific needs: Code Mode, Sandbox or Dynamic Worker, Private network reach.
Not needed: AI Security for Apps, AI Crawl Control and Bots, Build on Workers and Agents SDK.
B4. Your own agent for a process
You build it on Workers and the Agents SDK.
Core: put it in place first
- AI Gateway: Send every model call through AI Gateway.
- Build on Workers and Agents SDK: Choose Project Think, AIChatAgent, the Agent class, a Workflow or a plain Worker.
Recommended: add it when it applies
- Access and your IdP: Put Access in front of your agent's chat page or portal.
- MCP server portal: Expose your tools through a portal, or use tools that the portal offers.
- Code Mode: For many tools or one large API.
- DLP: Scan prompts and responses.
- Sandbox or Dynamic Worker: If the agent runs code that it generates.
- Private network reach: Tunnel, or Workers VPC (beta), if your tools sit on a private network.
- Logs to your SIEM: Send logs to your SIEM.
Optional: only for specific needs: AI Security for Apps, Secure Web Gateway.
Not needed: Shadow IT and CASB, AI Crawl Control and Bots.
C. Your staff use third-party AI
ChatGPT, Claude, Gemini, coding assistants. Nothing to build.
Core: put it in place first
- DLP: DLP profiles on prompts and uploads.
- Secure Web Gateway: Gateway HTTP policies: allow, block, redirect, or limit actions inside AI apps. Needs the root certificate on devices.
- Shadow IT and CASB: Shadow IT dashboard and API CASB. CASB has integrations for ChatGPT, Claude and Gemini.
Recommended: add it when it applies
- Access and your IdP: Put the approved AI path behind Access.
- AI Gateway: Offer an internal AI Gateway as the approved way to use models.
- Logs to your SIEM: Send Gateway logs to your SIEM.
Optional: only for specific needs: MCP server portal.
Not needed: Code Mode, AI Security for Apps, Sandbox or Dynamic Worker, Private network reach, AI Crawl Control and Bots, Build on Workers and Agents SDK.
D. AI visits your sites
Crawlers and agents read your content. Pay per crawl is in private beta.
Core: put it in place first
- AI Crawl Control and Bots: See which AI services access your content, allow or block each one, and check robots.txt compliance.
Not needed: Access and your IdP, AI Gateway, MCP server portal, Code Mode, DLP, AI Security for Apps, Secure Web Gateway, Sandbox or Dynamic Worker, Private network reach, Shadow IT and CASB, Logs to your SIEM, Build on Workers and Agents SDK.
Also decide: where the model runs
This applies to A and B1 to B4.
- Workers AI runs models on Cloudflare with no API keys.
- Hosted providers (OpenAI, Anthropic, Google) are reached through AI Gateway.
- Private inference runs on machines you own. AI Gateway custom providers connect models that have an HTTPS API. Check the network path for your setup.
2. Building an agent: which option gives you what?
This applies to situation B (internal AI you build) and to AI in your product.
| Option | Remembers state | Wakes itself up | Survives crashes and deploys | Chat with history and streaming | Runs the model loop | Exposes tools to other AI apps | What you write |
|---|---|---|---|---|---|---|---|
| Plain Worker with the AI SDKOne prompt in, one answer out. | · | · | · | · | ◐ | · | About 10 lines: the handler, prompt and tools. |
| Workflow with model stepsFixed steps with retries or approval. | ◐ | ◐ | ✓ | · | · | · | The step code, the workflow class and its config. |
| Agent class, your own harnessBackground agents: email, webhooks, cron. | ✓ | ✓ | ✓ | ◐ | · | · | The turn logic, prompts, tool calls and message format. |
| AIChatAgentA chat product where you own the model call. | ✓ | ✓ | ✓ | ✓ | ◐ | · | About 15 lines: streamText, tools, system prompt. |
| Project ThinkExperimentalA stateful chat agent, shipped fast. | ✓ | ✓ | ✓ | ✓ | ✓ | · | 3 lines for a first agent: getModel(). |
| MCP server on a WorkercreateMcpHandlerGiving other AI apps your tools. | · | · | · | · | · | ✓ | Tool definitions with good descriptions. |
| Existing harness, securedClaude Code, opencode, CodexGoverning agents your teams already use. | ◐ | · | · | ◐ | ◐ | · | Policy, not code: gateway, portal, DLP, Access. |
| Cloudflare OSEarly accessA workspace for all staff. | ✓ | ✓ | ? | ✓ | ✓ | · | Configuration, Gatekeepers, skills and context. |
| VibeSDKReference implementationA platform where users build apps with an agent. | ✓ | ? | ? | ✓ | ✓ | · | Deployment and configuration: model providers, domain, templates. |
| Orchestrator with sub-agentsSpecialised roles or many long-lived contexts. | ✓ | ✓ | ✓ | ◐ | ◐ | · | The delegation logic. One class per role. |
"Not stated" means the public sources do not say. For the existing-harness row, the AI Gateway docs have guides for coding agents such as Claude Code, OpenAI Codex and OpenCode.
Plans and status
- DLP and the AI detections in AI Security for Apps are paid add-ons on Enterprise plans.
- Secure Web Gateway HTTP policies need the Cloudflare root certificate or a custom certificate on the device.
- Code Mode and Project Think are experimental. Cloudflare OS is early access. VibeSDK is a reference implementation and builds on experimental and beta features. Dynamic Workers have been in open beta since March 2026.
- Workers VPC is in beta and pay per crawl is in private beta.
- Sandboxes need the Workers Paid plan.
- New MCP servers use
createMcpHandler.McpAgentis deprecated.
I checked this page against the Cloudflare documentation on 7 October 2026.
Sources
The Cloudflare documentation for each product is linked in the items above. Other sources are the Cloudflare OS launch post and the VibeSDK README.