250K Violations Caught in 4 Months! Cloudflare's New AI Reviewer 'Codex' Is Wild!

Hey everyone, it's me, Shiichan! Today I found some news from Cloudflare's blog that's making waves in the engineering world. They've rolled out a system that has AI agents enforce internal development rules, and the scale of it is wild!

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's official blog (Cloudflare Blog) introduced a system called Cloudflare Codex. It's a governed body of internal engineering standards, built so AI agents can read and use it across the whole development lifecycle.

By pairing structured RFCs (documents that define standards) with automated AI agent reviews, Cloudflare can now automatically check for consistency across three areas: code, technical specs, and incident reports.

The story so far

Until now, Cloudflare's development guidance was scattered across formal documents, files in repositories, chat threads, and knowledge that lived only in individual engineers' heads.

Engineers had to spend time figuring out whether a rule was still current, and as the organization grew, keeping standards consistent got harder and harder.

What changes

With Codex, humans still review and approve RFCs, but approved rules now get automatically converted into structured JSON statements that AI agents can consume as context. Each statement carries a stable slug ID, so you can trace exactly which rule is being applied where.

Domain owners (frontend, security, TypeScript, Rust, and more) govern their own RFCs, and rules go through "propose → review → approve" before being "enforced" as a separate step.

This means engineers now get automatic feedback on rule violations before merging a pull request, during the design stage, and when writing up incident reports. It cuts down manual review effort while keeping standards consistent.

Dive Deep

Codex splits into three review systems, one for each type of artifact.

• AI code reviewer: checks pull requests against MUST / SHOULD classifications and approval/enforcement status. Over the past four months it flagged nearly 250,000 deviations and blocked 16,000 merges. A single review run usually takes about two minutes
• Linter integration: oxlint gives millisecond-level checks for TypeScript, with linters for Rust and Go in development
• Local CLI: engineers can run the same OpenCode-based agent locally without waiting for CI
• Spec reviewer: evaluates technical designs at the design stage, built on Cloudflare Workers, D1, AI Gateway, and Cron Triggers. Since May 2026 it has reviewed close to 600 unique technical designs across more than 3,200 review invocations. The severity breakdown was 65% Major, 29% Minor, and 6% Critical
• Incident report reviewer: checks incident reports for completeness and quality. Since May 2026 it has evaluated more than 200 incident reports, 93% of which covered low-impact incidents. This review is mandatory for high-severity security incidents

Cloudflare uses the RFC 2119 keywords SHOULD and MUST to express how strictly a standard is enforced, and there are now 60-plus RFCs and counting.

Looking ahead, Cloudflare plans to add metadata that distinguishes SDLC stages like design, implementation, and operations, and wants agents to move beyond flagging violations to proposing fixes that engineers can approve. Other teams, including Product, Security, Compliance, and Trust & Safety, are also starting to add their own standards into Codex.

Wrap-up

• Cloudflare is running Cloudflare Codex, a body of RFC-based standards converted into a form AI agents can read and enforce
• The AI code reviewer flagged nearly 250,000 violations and blocked 16,000 merges in four months
• The spec reviewer ran on close to 600 designs across 3,200-plus invocations, with severity split 65% Major, 29% Minor, 6% Critical
• The incident report reviewer checked over 200 reports, 93% of which were low-impact
• Next up: automated fix suggestions and expansion to teams like Product, Security, and Compliance

This one's especially worth reading for engineering managers wrestling with consistency at scale, and for engineers curious about building internal tools powered by AI agents.