JA EN
shiichan

Users, agents, and Workers all connect: meet Cloudflare Mesh!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security#infrastructure#serverless

Hey there, it's Shiichan! Today I brought a networking announcement that got me excited. Users, servers, and AI agents can all join one secure network together.

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog announced a new private networking service called Cloudflare Mesh. It securely connects everything — personal devices, remote servers (nodes), AI agents, and even Workers — into a single private network.

And because it sits on top of Cloudflare One's SASE / Zero Trust foundation, the security policies you already use keep working as-is.

Why it matters

Traditional VPNs and SSH tunnels were built for humans. But these days, AI agents want to query staging databases, call internal APIs, and reach services on a home network all by themselves.

With the old tools, exposing a service publicly is risky, and once an agent connects you have no visibility into what it does. Mesh is aimed right at closing that gap.

What changes

Here is how it changes things for developers.

  • Connect personal devices, remote servers, and user endpoints through one lightweight connector
  • Give agents scoped, auditable access to private infrastructure
  • Reach private resources via private IPs, routed through Cloudflare's global network of 330+ cities
  • Cloudflare One policies like Gateway, DNS filtering, and device posture checks apply to agent traffic automatically

There's a free tier from the start too — up to 50 nodes and 50 users at no cost.

Dive Deep

A bit more on how it works. There are two main players.

  • Mesh nodes: lightweight connectors that run a headless Cloudflare One Client on servers or VMs, advertising Mesh IPs and routes.
  • Mesh devices: laptops and phones running the Cloudflare One Client, authenticating with the user's identity.

From Workers, you hand agents scoped access through a Workers VPC Network binding. You point at a Mesh network with the reserved keyword cf1:network.

"vpc_networks": [
  { "binding": "MESH", "network_id": "cf1:network", "remote": true }
]

And from Worker code you call it like this.

env.MESH.fetch("http://10.0.1.50/api/data")

All traffic routes through Cloudflare's edge (330+ cities), so NAT traversal is solved without fussy relay infrastructure. If you want redundancy, there's a high-availability mode with active / passive failover.

Want to get hands-on? Check out the Mesh documentation and the Workers VPC quickstart. You can set things up from the Cloudflare dashboard.

Wrap-up

  • Cloudflare Mesh is a new service that connects users, nodes, agents, and Workers into one secure private network
  • It sits on Cloudflare One's SASE / Zero Trust foundation, so existing Gateway policies apply to agent traffic too
  • With Workers VPC integration, you can give agents scoped, auditable access
  • The free tier covers 50 nodes and 50 users, and you reach resources by private IP over a 330+ city network

This one really lands for developers who want AI agents to safely touch internal resources, and for infra folks tired of running VPNs!

Related posts