Cloudflare AI Capabilities

Teams building AI features into products who need low-latency inference globally

Companies embedding AI features — real-time personalization, content moderation, recommendation engines — into their products face latency and cost pressure when inference routes to centralized GPU regions. Workers AI runs serverless GPU inference across 337+ cities, executing at the location nearest the user. No cold starts. No idle billing. No capacity planning. You call a model via API; Cloudflare handles everything else.

Supported models include Llama 3, Mistral, Whisper (speech-to-text), Stable Diffusion XL, and embedding models. Full catalog linked below.

Workers AI docs  |  Model catalog

Teams running multiple LLM providers who've lost control of spend and visibility

AI Gateway is a forward proxy between your application and any LLM provider — OpenAI, Anthropic, Google AI Studio, AWS Bedrock, Hugging Face, Workers AI, and others. Change one line (the API base URL) and every model call passes through Cloudflare. All capabilities apply automatically.

AI Gateway docs  |  Spend limits

Teams building knowledge-intensive products who need a RAG pipeline without the engineering burden

Building retrieval-augmented generation from scratch means connecting ingestion → chunking → embedding → vector storage → retrieval → prompt construction. That's weeks of engineering before a single query runs.

AutoRAG is a fully managed RAG pipeline. Point it at an R2 bucket containing your documents. It handles chunking, embedding generation via Workers AI, indexing into Vectorize, retrieval, and response generation. The result is a query API — ask a question, get a grounded answer with source citations.

Vectorize is the vector database underneath, running natively within Cloudflare's network inside a Worker — no external database host, no egress fees, no third-party round-trip.

Fits: Developer documentation Q&A, internal knowledge bases, customer support grounding, enterprise search, contract retrieval.

AutoRAG docs  |  Vectorize docs

Teams building autonomous agents that need persistent state, long-running tasks, and tool access

Most AI agent frameworks assume stateless execution. Real agents need memory across sessions, the ability to run tasks in the background, and the ability to wake up and act at a future time without polling infrastructure.

Agents SDK is Cloudflare's framework for building agents with persistent state. Each agent session has a durable identity, local SQL storage, live WebSocket connections, and scheduled execution. Agents connect to chat, email, voice, Slack, and webhooks out of the box.

Durable Objects is the execution layer underneath — a persistent, single-threaded context with its own SQLite database per agent. State doesn't need to be externalized or reconstructed between requests.

Hibernation means agents sleep when idle with no compute charge. When a message arrives, the agent wakes automatically. No polling required. Available on all plans including free.

Tools available to agents: Browser, Sandbox, AI Search, MCP client, Payments, and any MCP server you connect.

Agents SDK docs

Teams who need to govern what AI agents can do when they call internal tools

Model Context Protocol (MCP) is the open standard for how AI agents connect to external tools — internal APIs, databases, SaaS products, code repositories. Without access controls, an agent handed a set of MCP tools has unconstrained access to everything those tools expose.

MCP Server Portals (part of Cloudflare Access / Zero Trust) puts identity-based access controls in front of every tool call an agent makes:

• Multiple MCP servers consolidated onto a single HTTP endpoint
• Users and agents authenticate through Cloudflare Access before any tool is reachable
• Each server can require its own OAuth flow — users authenticate separately per server
• Admins choose which specific tools and prompt templates are available in each portal, reducing model context and blast radius of any misuse
• Every individual tool call is logged in Access audit logs

Cloudflare also runs managed MCP servers covering 2,500+ Cloudflare API endpoints — accessible via two tools, consuming ~1,000 tokens regardless of API surface size (vs. 1.17M tokens for a naive implementation). Available in open beta, all plans.

MCP Server Portals docs

Security teams who need to govern how employees use AI tools — and what data leaves through them

Shadow AI adoption is accelerating. BCG found a 3x increase in shadow AI tool usage among financial services employees year-over-year. Ungoverned AI tool access cascades into real data exposure.

Cloudflare's Zero Trust Gateway policies give security teams precise control without blanket bans. A working policy set deployable in about 10 minutes:

Gateway natively recognizes Google Gemini, ChatGPT, Claude, and Perplexity as distinct AI applications — applying topic classification to prompts and enforcing policy per application, not per category.

DLP docs

Teams whose AI-powered applications are being attacked with prompt injection and jailbreak attempts

Prompt injection, jailbreak attempts, and PII extraction attacks targeting AI applications are different from traditional web attacks. The payload is natural language. Standard WAF rules don't catch it.

AI Security for Apps (Firewall for AI) runs on Cloudflare's WAF in front of AI-powered applications, scoring every inbound request for LLM-specific threats before it reaches the application server.

These fields are available in Firewall Events, HTTP Requests Logpush, and Security Analytics. You write rules that act on scores — block, challenge, log, or rate-limit. You set the threshold. Requires Enterprise plan.

AI Security for Apps docs

Teams who need to prevent sensitive data from appearing in LLM responses

AI Gateway bi-directional DLP scans both sides of the model conversation:

• Outbound prompts — inspected before reaching the model. PII, credentials, and sensitive patterns caught before they're processed.
• Inbound responses — inspected before reaching the user. Sensitive data a model might echo back, reconstruct, or generate can be blocked or redacted before it's seen.

No separate TLS decryption or HTTP filtering pipeline required. Attach DLP profiles to your AI Gateway — applies automatically to all traffic through that gateway.

AI Gateway DLP docs