# Users, agents, and Workers all connect: meet Cloudflare Mesh!

Hey there, it's Shiichan! Today I brought a networking announcement that got me excited. Users, servers, and AI agents can all join one secure network together.

## What was announced?

Cloudflare's Blog announced a new private networking service called **Cloudflare Mesh**. It securely connects everything — personal devices, remote servers (nodes), AI agents, and even [Workers](https://www.cloudflare.com/developer-platform/products/workers/) — into a single private network.

And because it sits on top of [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/)'s SASE / Zero Trust foundation, the security policies you already use keep working as-is.

## Why it matters

Traditional VPNs and SSH tunnels were built for humans. But these days, AI agents want to query staging databases, call internal APIs, and reach services on a home network all by themselves.

With the old tools, exposing a service publicly is risky, and once an agent connects you have no visibility into what it does. Mesh is aimed right at closing that gap.

## What changes

Here is how it changes things for developers.

- Connect personal devices, remote servers, and user endpoints through one lightweight connector
- Give agents scoped, auditable access to private infrastructure
- Reach private resources via private IPs, routed through Cloudflare's global network of 330+ cities
- Cloudflare One policies like [Gateway](https://www.cloudflare.com/sase/products/gateway/), DNS filtering, and device posture checks apply to agent traffic automatically

There's a free tier from the start too — up to 50 nodes and 50 users at no cost.

## Dive Deep

A bit more on how it works. There are two main players.

- Mesh nodes: lightweight connectors that run a headless [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) on servers or VMs, advertising Mesh IPs and routes.
- Mesh devices: laptops and phones running the Cloudflare One Client, authenticating with the user's identity.

From [Workers](https://www.cloudflare.com/developer-platform/products/workers/), you hand agents scoped access through a [Workers VPC](https://blog.cloudflare.com/workers-vpc-open-beta/) Network binding. You point at a Mesh network with the reserved keyword `cf1:network`.

```json
"vpc_networks": [
  { "binding": "MESH", "network_id": "cf1:network", "remote": true }
]
```

And from Worker code you call it like this.

```
env.MESH.fetch("http://10.0.1.50/api/data")
```

All traffic routes through Cloudflare's edge (330+ cities), so NAT traversal is solved without fussy relay infrastructure. If you want redundancy, there's a high-availability mode with active / passive failover.

Want to get hands-on? Check out the [Mesh documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/) and the [Workers VPC quickstart](https://developers.cloudflare.com/workers-vpc/get-started/). You can set things up from the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/mesh).

## Wrap-up

- Cloudflare Mesh is a new service that connects users, nodes, agents, and Workers into one secure private network
- It sits on Cloudflare One's SASE / Zero Trust foundation, so existing Gateway policies apply to agent traffic too
- With Workers VPC integration, you can give agents scoped, auditable access
- The free tier covers 50 nodes and 50 users, and you reach resources by private IP over a 330+ city network

This one really lands for developers who want AI agents to safely touch internal resources, and for infra folks tired of running VPNs!