Capabilities and architecture Model Workers AI (open-weight, on-platform) + frontier models (Opus, GPT), routed by task[Source 1 Harness OpenCode + Windsurf clients; Agents SDK (McpAgent + Durable Objects) for stateful sessions[Source 1 Sandbox Dynamic Workers for sandboxed code execution; Sandbox SDK to clone/build/test[Source 1 Tool access MCP Server Portal; one OAuth point aggregating 182+ tools from 13 servers; AI Gateway for routing, cost, BYOK, ZDR[Source 1 Knowledge Backstage catalog (2,055 services) + AGENTS.md generated across ~3,900 repos[Source 1 Context management Code Mode collapses upstream tool schemas into search + execute, holding token overhead constant at scale[Source 1 Credentials Zero API keys on client machines; a Worker injects keys server-side; Cloudflare Access (Zero Trust) auth[Source 1 Interfaces The capture documents CLI clients and the CI review component; it does not name a web interface for the internal stack.
Mechanisms MCP Server Portal One OAuth aggregation point for all MCP tools[Source 1
Code Mode Searches tool schemas through a portal and exposes a separate execution function[Source 1
AGENTS.md Structured, generated repo context (runtime, nav, conventions, boundaries, deps)[Source 1
Documented uses Merge request → AI Code Reviewer findings and approval decision.
AI Code Reviewer Multi-agent CI review: risk tiering, specialist agents, Codex-rule citations[Source 1
Access and controls See documented credential and access boundaries in the architecture above. Scoped human-review assessments for individual uses remain in research details.
Reliability and validation AGENTS.md staleness flag The AI Code Reviewer flags merge requests whose repository changes suggest the repo's AGENTS.md is outdated[Source 1
Adoption and operating evidence These results come from the sources. Notes below each result explain what it covers and any reported limits.
Headline claim 47.95 million AI requests in 30 days across the internal AI engineering system[Source 1
Reported by Cloudflare Scope Internal AI engineering requests in the 30 days preceding the report Method Company-reported total internal AI request count for the preceding 30 days The source does not report the denominator of this figure.
Observed in 2026
About this result Category Adoption output Evidence type Reported measurement What it covers AI requests across the internal AI engineering system Key observation 3,683 internal users (60% of company, 93% of R&D)[Source 1
Reported by Cloudflare Scope Active internal AI coding-tool users in the preceding 30 days Denominator Approximately 6,100 employees for company share; R&D organization for R&D share Observed in 2026
About this result Category Adoption output Evidence type Reported measurement What it covers Active internal AI coding-tool users Key observation 47.95M AI requests, 20.18M AI Gateway requests per month, and 241.37B tokens routed through AI Gateway[Source 1
Reported by Cloudflare Scope Total internal AI requests in the preceding 30 days; AI Gateway requests reported per month; AI Gateway token volume Method Reported total AI request count, AI Gateway request count, and AI Gateway token count The source does not report the denominator of this figure.
Observed in 2026
About this result Category Runtime capacity Evidence type Reported measurement What it covers Internal AI request, AI Gateway request, and AI Gateway token volume Key observation 10,952 merge requests in the week of March 23, 2026, nearly double the Q4 baseline; four-week average above 8,700[Source 1
Reported by Cloudflare Scope Company merge requests in the week of March 23, 2026, versus Q4 baseline; not agent-authored PRs Method Weekly merge-request count; distinct from the four-week rolling average The source does not report the denominator of this figure.
Observed in March 2026
About this result Category Adoption output Evidence type Reported measurement What it covers Company-wide merge requests during AI tool adoption Key observation 295 teams using agentic AI tools[Source 1
Reported by Cloudflare Scope Teams using agentic AI tools and coding assistants in the reported 30-day snapshot The source does not report the denominator of this figure.
Observed in 2026
About this result Category Adoption output Evidence type Reported measurement What it covers Teams with agentic AI tool activity Lessons Cloudflare added user attribution, model discovery, and permission checks at a shared proxy without changing client configurations.[Source 1
Cloudflare exposes service ownership and dependencies through Backstage and writes repository conventions into AGENTS.md files.[Source 1
Cloudflare replaced upfront tool schemas with portal search and execution functions after measuring their context overhead.[Source 1
Cloudflare uses frontier models for most complex coding work and Workers AI for selected workloads, including documentation review and context-file generation.[Source 1
Back to infrastructure Sources and research details Citations link to the original publisher. Each source also keeps a preserved copy in the repository, so a changed or removed page stays checkable.
The AI engineering stack we built internally https://blog.cloudflare.com/internal-ai-engineering-stack/ Engineering blog · First party · Last source verification: 2026-08-31 Hacker News discussion of Cloudflare's internal AI engineering stack https://news.ycombinator.com/item?id=47837240 Hn thread · Community · Last source verification: 2026-08-31 Orchestrating AI Code Review at scale https://blog.cloudflare.com/ai-code-review/ Engineering blog · First party · Last source verification: 2026-09-17 Question coverage and scope purpose Reported workflow Reported human involvement Not applicable: There is no single platform-wide agent review boundary. Scoped downstream operating-model claims remain in research details; access controls are described separately. implementation Reported validation Reported observations Reported lessons Reported Research details for every claim on this page Summary Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Headline claim Statement type Metric Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Reported by Cloudflare Scope Internal AI engineering requests in the 30 days preceding the report Denominator Not reported Method Company-reported total internal AI request count for the preceding 30 days Observation date 2026 Sandbox Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Harness Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Model Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Interfaces Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Tool access Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Knowledge Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Credentials Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Context management Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. MCP Server Portal Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Code Mode Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. AGENTS.md Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. AI Code Reviewer Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. AGENTS.md staleness flag Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Key observation Statement type Metric Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Reported by Cloudflare Scope Active internal AI coding-tool users in the preceding 30 days Denominator Approximately 6,100 employees for company share; R&D organization for R&D share Method Not reported Observation date 2026 Key observation Statement type Metric Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Reported by Cloudflare Scope Total internal AI requests in the preceding 30 days; AI Gateway requests reported per month; AI Gateway token volume Denominator Not reported Method Reported total AI request count, AI Gateway request count, and AI Gateway token count Observation date 2026 Key observation Statement type Metric Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Reported by Cloudflare Scope Company merge requests in the week of March 23, 2026, versus Q4 baseline; not agent-authored PRs Denominator Not reported Method Weekly merge-request count; distinct from the four-week rolling average Observation date 2026-03 Key observation Statement type Metric Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Reported by Cloudflare Scope Teams using agentic AI tools and coding assistants in the reported 30-day snapshot Denominator Not reported Method Not reported Observation date 2026 Lesson Statement type Fact Provenance Reported Confidence Medium Confidence reason The proxy retrospective names these later additions and explains why the existing Worker provided one place to introduce them. Lesson Statement type Fact Provenance Reported Confidence Medium Confidence reason The report connects missing ownership and repository context to these two mechanisms, including incorrect test commands and local conventions. Lesson Statement type Fact Provenance Reported Confidence Medium Confidence reason The Code Mode section reports 15,000 tokens for 34 GitLab schemas and names the two replacement portal functions; it does not measure an accuracy gain. Lesson Statement type Fact Provenance Reported Confidence Medium Confidence reason The workload breakdown and named Workers AI tasks support this division; future growth of open-model traffic is presented as an expectation. Operating model assessment Unclassified for merge request → AI review that can approve, revoke prior bot approval or block merging; a human can override; human attention boundary: unknown.
Statement type Inference Provenance Catalog judgment Confidence Unverified Confidence reason The reviewer changes approval state and supports human override; this does not establish the required human attention boundary for every successful merge. Observation date 2026-09-17 Operating model assessment Level 3 for AGENTS.md generation → merge request the owning team reviews and refines; human attention boundary: work-product review.
Statement type Inference Provenance Catalog judgment Confidence High Confidence reason The source states the system opens a merge request so the owning team can review and refine the generated AGENTS.md document. Observation date 2026-04-20 