cloudflareAug 4, 2026

Introducing: Cloudflare Agents (opens in new tab)

Cloudflare is introducing Agents, a unified platform for deploying, observing, and improving hosted AI agents. Its first major feature is agent tracing, which exposes model calls, tool execution, token usage, approvals, subagents, and underlying Cloudflare infrastructure in one view. The goal is to help developers diagnose agent failures, understand costs and latency, and use operational data to continuously improve agent behavior. ## Agent Tracing Adds Visibility - Traditional telemetry can show that an HTTP request succeeded while hiding agent-level failures, such as: - Choosing the wrong tool - Passing stale context to a subagent - Entering a token-consuming retry loop - Cloudflare’s agent-aware traces capture: - Agent invocations - Model calls and token usage - Tool executions and results - Approval or pause events - Supported subagent calls - These agent spans appear alongside existing Workers telemetry for fetches, KV, D1, Durable Objects, and other infrastructure. - Initial integrations support Think, Flue, and AI SDK through OpenTelemetry-compatible tooling. ## Reviewing Agents in the Cloudflare Dashboard - A new Agents view lists observed agents, traces, sessions, instances, runs, and token usage. - Developers can inspect agent behavior through: - **Session replay**, which reconstructs recorded conversations - **Trace waterfalls**, which show execution timing and nested operations ## Session Replay - The Messages tab displays: - System instructions - User messages - Model reasoning - Tool calls, arguments, and results - Final responses - Replay is based on captured data and does not re-execute the agent. - It can reveal malformed tool arguments, inappropriate tool choices, subagent handoffs, retries, and context that influenced later decisions. - Think, Flue, and AI SDK provide `storeMessages` and `storeTools` controls to determine whether message and tool payloads are recorded. - Payload capture can be disabled when data may contain personal information, secrets, or other sensitive content. ## Trace Waterfalls Connect Agent and Infrastructure Activity - Traces show how much time each part of a turn consumed and how operations relate to one another. - A parent agent can be connected to nested subagents, model calls, tools, and Cloudflare resources. - Example operations include: - A parent `TravelPlanner` invocation lasting 2.72 minutes - An `itinerary_builder` subagent using 1.83 minutes - Model calls with duration and provider-reported token usage - Tool executions - D1 queries and KV writes triggered by those tools - Nested tracing makes it possible to follow work from the original agent through delegated tasks and the infrastructure each task used. ## Enabling Agent Tracing - Enable tracing in `wrangler.jsonc`: ```json { "observability": { "traces": { "enabled": true } } } ``` - Setup then depends on the agent stack: - **Think and Flue:** Emit agent, conversation, turn, model, and tool telemetry through their tracing integrations. - **AI SDK:** Wrap the SDK with Cloudflare’s `wrapAISDK()` adapter. - **Custom harnesses:** Use Cloudflare’s custom spans API and OpenTelemetry’s Generative AI semantic conventions. ## Broader OpenTelemetry Support - Cloudflare plans to support the OpenTelemetry API directly inside Workers. - Frameworks that already emit standard Generative AI spans will eventually work in the Agents view without Cloudflare-specific adapters. - Standard agent and conversation identifiers will allow Cloudflare to group spans into agents and sessions. - This complements Cloudflare’s existing ability to export OpenTelemetry data by allowing Workers to accept standard telemetry directly. ## OpenTelemetry Export - Agent telemetry is not restricted to Cloudflare. - Traces can be exported to OTLP-compatible observability providers by configuring a destination in the Worker’s Wrangler configuration. Cloudflare’s initial Agents release focuses on making AI behavior inspectable rather than treating agents as opaque application requests. Developers should enable tracing, choose payload retention carefully for privacy, and use session replay and nested traces to identify correctness, latency, cost, and orchestration problems.

cloudflare-d1cloudflare-workersdurable-objectsopentelemetry+4

cloudflareJan 27, 2026

Building a serverless, post-quantum Matrix homeserver (opens in new tab)

The post describes a proof-of-concept Matrix homeserver ported from Synapse to Cloudflare Workers. It replaces traditional VPS, PostgreSQL, Redis, and filesystem infrastructure with Workers, Durable Objects, D1, KV, and R2, reducing operational overhead and allowing costs to fall near zero when idle. The design also provides post-quantum TLS automatically while preserving Matrix’s end-to-end encryption, though the homeserver still exposes metadata. ## From Synapse to Cloudflare Workers - Traditional Synapse deployments depend on: - PostgreSQL for persistent state - Redis for caching - Filesystem storage for media - VPS infrastructure and operational maintenance - The proof of concept reimplemented core Matrix functionality in TypeScript with Hono, including: - Event authorization - Room state resolution - Cryptographic verification - Cloudflare services replace the traditional components: - Durable Objects provide strongly consistent, atomic coordination. - D1 replaces PostgreSQL. - KV replaces Redis. - R2 replaces filesystem-based media storage. ## Benefits of a Serverless Homeserver - Deployment becomes a single `wrangler deploy` command. - Cloudflare provides TLS termination, load balancing, DDoS protection, and global distribution. - Request-based pricing means the homeserver can cost almost nothing during periods of inactivity. - Workers execute close to users in more than 300 locations, reducing latency for globally distributed communities. - Built-in security features reduce the need to configure firewalls, rate limiting, WAF rules, and IP reputation systems manually. ## Post-Quantum TLS and Matrix Encryption - Cloudflare’s TLS 1.3 connections use hybrid `X25519MLKEM768`. - This combines: - X25519, a classical elliptic-curve algorithm - ML-KEM, a lattice-based post-quantum algorithm standardized by NIST - The hybrid design requires both cryptographic systems to be broken before the connection is compromised. - Traditional deployments would need to upgrade cryptographic libraries, configure cipher suites, test client compatibility, and monitor negotiation failures. - Workers provide this protection automatically through Cloudflare’s infrastructure. ## How Messages Are Protected - Matrix clients encrypt messages locally using Megolm before sending them. - The encrypted Megolm payload is then transported over TLS using post-quantum hybrid key agreement. - The Worker terminates TLS but receives only ciphertext, which it stores and routes without seeing plaintext. - Recipients download the ciphertext over another protected TLS connection and decrypt it locally. - This creates two independent encryption layers: - TLS protects data in transit. - Megolm end-to-end encryption protects message contents from the homeserver and infrastructure providers. ## Metadata and Privacy Limits - The homeserver operator can still observe metadata, including: - Room membership - Room existence - Message timing - Other routing and account information - Message contents remain inaccessible because they are encrypted before reaching the server. - Encrypted-room media is also encrypted client-side, and private keys remain on user devices. ## Storage Architecture - The design assigns each storage primitive to the consistency model it supports best. - D1 stores durable, queryable Matrix data, including users, rooms, events, and device keys across more than 25 tables. - Durable Objects handle real-time coordination and the strong consistency needed for Matrix state resolution. - KV provides cache-like storage, while R2 handles media and filesystem-style objects. The project demonstrates that a Matrix homeserver can be made substantially easier to operate with serverless infrastructure while gaining globally distributed execution and automatic post-quantum transport security. It remains a personal proof of concept, so production deployments should evaluate feature completeness, scalability, compatibility, and the privacy implications of relying on Cloudflare.

cloudflare-d1typescriptcloudflare-workersserverless+4