Cloudflare makes a specific bet: the hardest part of enterprise AI is no longer finding a model, but stopping teams from creating an expensive, leaky mess. This position is more interesting than the usual model-chasing circus because it treats AI like network traffic, not magic. A company with traffic proxying and control in its DNA then looks less like an internet utility and more like a necessary layer of governance.
Dane Knecht, Cloudflare’s CTO, has been unusually blunt about the problem he spent the past year dealing with internally. The goal was simple on paper: get AI into the hands of everyone in the company. The reality was a corporate slipstream of half a dozen model providers, API keys stuffed into scripts, token invoices nobody could explain, and agents wandering towards tools and data with very little oversight. This mess was not theoretical; it happened the moment teams were allowed to move fast without a shared control plane.
Cloudflare is selling the boring part of AI
The company’s pitch is not that it has built the smartest model or the prettiest demo. It has built the thing organizations forget they need until the bill arrives or a prompt leaks something embarrassing. Cloudflare says the same internal stack it uses is now available to customers, and that is the right framing. This is not a toy add-on. It is the plumbing that decides who can call what, how much they can spend, and what data can move through the stack.
That matters because AI usage inside a business tends to explode in all directions. One team wants OpenAI. Another prefers Anthropic. A third has a side script pointing at Google, while somebody else experiments with Kimi, GLM, or Workers AI. No one plans for a grand central system. They simply start shipping. Then the company wakes up to a dozen disconnected workflows, each with its own keys, permissions, spend profile, and failure modes.
Cloudflare’s answer is to pull that traffic through two products already sitting in the dashboard: AI Gateway and MCP portals. The company says every AI call and agent now runs through those layers. This is the part worth paying attention to. It is one thing to say AI governance matters; it is another to ship the exact machinery that makes governance possible.
One endpoint is better than six billing nightmares
AI Gateway gives teams a single place to front their model traffic. Instead of every app speaking directly to every provider, requests go through one endpoint. This means the organization can standardize access without rewriting every workflow whenever a provider changes an API or a team wants to test a new model.
Here is the practical shape of it:
| Problem | Cloudflare control |
|---|---|
| Too many model providers | One gateway in front of OpenAI, Anthropic, Google, Kimi, GLM, and Workers AI |
| Key sprawl | Use Cloudflare billing or bring your own keys |
| No common access pattern | One endpoint for model calls |
| Team-specific experimentation | Central routing without losing flexibility |
That may sound mundane. It is. Mundane is good here. Every enterprise AI rollout eventually hits the same wall: too many moving parts and too little standardization. A gateway turns model access into a managed workflow instead of a set of tribal habits stored in Slack threads and shell scripts.
Cloudflare says teams can either pay through its billing path or continue using their own keys. This flexibility matters because plenty of companies are not ready to rip out existing contracts, but they do want a central point of control. The point is not to force a single commercial model. The point is to stop every app from acting like its own little kingdom.
Spend needs a ceiling before the agent starts freelancing
The company is also trying to solve the AI finance problem, which usually means nobody wants to explain a surprise invoice. Cloudflare says its gateway and portals show every request, every token, and every dollar in one view. More important, limits can be applied by model, provider, team, user, or application.
That is the difference between a useful AI rollout and an expensive science project. Once agents start iterating, retrying, branching, and chaining, the spend curve gets ugly fast. A human gets bored before the cloud bill does. A model does not. Left alone, it will happily burn through tokens until something breaks or somebody in finance asks a very direct question.
Cloudflare is also previewing a cost-control dashboard, which suggests the company knows this is not a solved problem. Good. It should not be treated like one. Most organizations need far better visibility before they need more clever prompts.
The useful part of this setup is that it records usage and lets an admin draw boundaries in the same place the traffic passes through. That is how you avoid the usual postmortem, where everyone swears they thought another team was handling it and nobody realized the agent had turned a small experiment into a recurring line item.
Keys and prompts should not wander around the stack
Security failures in AI systems rarely begin with cinematic breaches. They usually begin with lazy implementation. Someone hardcodes a key into a script. Someone pastes confidential text into a prompt. Someone connects a tool without checking who can reach it. Then the organization acts surprised when the whole thing behaves like an open tap.
Cloudflare’s answer is to keep API keys behind the gateway instead of scattered through applications. That is a sane default. Keys should live in one protected layer, not as a collection of forgotten strings inside random repos and utility scripts.
The other piece is Data Loss Prevention. Cloudflare says it scans prompts, responses, and tool calls for sensitive material. That matters because the leak does not always happen on the way in. Sometimes it slips out when a model answers, or when an agent hands data to an external service without anyone noticing. If a system is allowed to see confidential inputs and then route them through tools with no inspection, you have not built an AI platform. You have built a quiet exposure machine.
The controls stack up in a logical order:
- Keep keys out of application code.
- Inspect prompts before they reach the model.
- Inspect responses before they leave the system.
- Watch tool calls, because agents often leak through the side door.
- Make the access path the choke point, not an afterthought.
That is where Cloudflare’s background really shows. The company understands that policy is worthless unless it sits on top of traffic. A rule buried in documentation does nothing. A rule sitting in the path of requests can actually stop something.
Agents need permissions, not confidence
MCP portals are the other half of the picture. They decide which servers and tools an agent can use, and the access is explicit. Give it permission, it can use the tool. Remove the permission, it stops. That sounds obvious, but a lot of AI stacks still behave as if every agent should be trusted until it proves otherwise. That is backwards.
Agents are only as safe as the tools they can reach. If an assistant can query a CRM, touch a file store, and talk to a deployment system, then its permissions need to be treated like production access, not like a browser extension you clicked through too quickly. Cloudflare is making the case that model access and tool access belong in the same governance story.
That is also where the “agent era” language stops sounding like marketing fluff and starts sounding like a real operating problem. Once software can decide which steps to take, the company has to decide which steps it is allowed to take. There is no shortcut around that.
Cloudflare says its portals are already part of its own daily workflow, which is the right kind of proof. Internal use is not a guarantee of perfection, but it is stronger than a slide deck. Knecht is not talking about a concept he watched from a distance. He is describing the toolchain his own organization depended on while trying to make AI usable without making it wild.
Code Mode is the piece that saves tokens by the bucket
The most technical part of the stack is Code Mode, and it is also the easiest to underestimate. The basic idea is to stop forcing the model to ingest every tool definition into context before it can do useful work. Instead, Cloudflare turns approved MCP tools into an API that the agent can chain across in a more direct way.
That changes the economics. If the model does not have to do a round-trip for every little tool decision, and if it can filter and chain across dozens of tools in one pass, token usage drops hard. Cloudflare says the result has been about a 93% cut in token costs.
That figure is doing real work in this story. A 10% savings is nice. A 93% reduction says the old workflow was bloated in ways most teams probably have not yet measured properly. It also explains why a lot of AI agent pilots look cheap at first and then get awkward at scale. The hidden cost is often in the orchestration, not the model prompt itself.
Code Mode is basically a reminder that good infrastructure work is often about removing unnecessary chatter. Fewer context loads, fewer model hops, less wasted compute, faster work, lower cost, cleaner logs, better control. None of that is glamorous, but all of it is useful.
The real lesson is about governance, not just AI
Cloudflare’s move is bigger than a product launch. It is an argument about where the AI market is headed. The companies that matter most in the next phase may not be the ones with the loudest model announcements. They may be the ones that can make AI safe enough, cheap enough, and legible enough for a business to live with.
That is why Cloudflare’s position is interesting. It already sits in the middle of internet traffic. It already knows how to proxy, filter, meter, and control requests at scale. Those are exactly the muscles a company needs when AI stops being a demo and starts being infrastructure.
The practical takeaway for teams is simple. If your AI usage is already scattered across providers, keys, scripts, and agents, the problem is not just model choice. The problem is control. You need one place to route calls, one place to see spend, one place to enforce data rules, and one place to decide which tools an agent can touch. Cloudflare is now selling that bundle, and unlike most AI chatter, this one looks built for the mess people actually have.
