Cloudflare Agents builds green at our pin. Our edge checklist checks shape only.

cloudflare/agents is Cloudflare's SDK for building and deploying AI agents on its network. We pinned it at b1e3614bb0ad, ran the keyless commands from its pull-request CI workflow verbatim, and wrote a least-privilege checklist that an agent must pass before deploy. Upstream install, build and check passed locally, the upstream tests passed in CI on Ubuntu, and our 6 lab tests passed. The catch is that the checklist validator checks the shape of a JSON file and enforces nothing at runtime.

The catch

validate:policy requires four keys: secretsFromEnv, toolAllowlist and egressAllowlist as non-empty string arrays, and noLocalLooseAgent set to true. That is all it checks. Our own fixture shows the gap, because its secretsFromEnv list includes DISABLE_TELEMETRY and DO_NOT_TRACK, which are opt-out flags, and the validator accepts them. It never compares the allowlists with what your Worker does at runtime. Treat a pass as proof that someone wrote the policy down, and enforce the allowlists inside the Worker itself.

The upstream test step has a narrower scope than it looks. nx affected -t test runs tests only for projects touched between NX_BASE and NX_HEAD, and our script defaults NX_BASE to the commit before the pin. Widen the range if you want the whole suite. That step also flaked on macOS, where the workerd pool hit performance timeouts and ECONNRESET under load, so its green result comes from the upstream CI job on ubuntu-24.04.

What we ran (keyless)

Lab checks:

cp .env.example .env
bun install
bun run test
bun run typecheck
bun run check:skills
bun run validate:policy

Upstream, inside vendor/agents at the pin, through bash scripts/upstream-agents.sh:

pnpm install --frozen-lockfile
pnpm run build
pnpm run check
pnpm exec playwright install --with-deps chromium
CI=true pnpm exec nx affected -t test

From reports/gate.json, run on October 14, 2026:

The fixture allowlists six tools (workers.ai, durable_objects, kv_get, kv_put, r2_get, fetch_allowlisted) and two egress hosts (api.cloudflare.com, ai.cloudflare.com). The lab tests confirm the validator rejects a missing secretsFromEnv, an empty toolAllowlist and noLocalLooseAgent: false.

How it is wired

The checklist sits between your agent code and the deploy. You keep secrets in environment bindings, list the tools and outbound hosts the agent may use, and set noLocalLooseAgent so the long-running agent lives on Cloudflare instead of a process on a laptop. The edge-agent-policy skill walks an agent through filling each key before it ships.

Minilab (open source)

Upstream is cloudflare/agents (5,833 stars, MIT, TypeScript, as of October 14, 2026). Run the lab checks above anywhere, and run bash scripts/upstream-agents.sh on Linux with Node 24 and pnpm 11.19.0 to rebuild the upstream at the pin. CLOUDFLARE_API_TOKEN is only needed for a live deploy.

bun install && bun run test && bun run validate:policy