AI teammates that each get their own computer and browser. Built entirely on Cloudflare.

You create bots, give each one a job, and they work for you, even when you're away. They ask before doing anything risky. When one needs a login, it hands you its browser.

One Worker runs everything. There are three kinds of Durable Objects:

flowchart LR
  UI["Web app<br/>TanStack Start + Kumo"]
  W["Worker<br/>src/server.ts"]
  Hub["UserHub<br/>1 per user"]
  Bot["BotAgent<br/>1 per bot"]
  Live["AppLive<br/>1 per bot-built app"]

  UI -- "WebSocket" --> W
  W --> Hub
  W --> Bot
  W -- "/apps/*" --> Live
  Hub <-- "RPC" --> Bot

  Bot --> AI["Workers AI /<br/>AI Gateway"]
  Bot --> BR["Browser Run"]
  Bot --> DW["Dynamic Workers"]
  Hub --> MCP["Your apps<br/>(MCP / Executor)"]

• Each bot keeps everything in its own SQLite. There's no separate database.
• You sign in to an app once, on the hub. Every bot uses that connection.
• The Worker only lets you reach your own hub and your own bots.

sequenceDiagram
  participant You
  participant Bot as BotAgent
  participant Model
  participant Tools

  You->>Bot: "Pull this week's leads"
  Bot->>Bot: load memory, rules, open items, app tools
  loop up to 40 steps
    Bot->>Model: messages + tools
    Model-->>Bot: tool call
    alt rule is "ask first"
      Bot-->>You: approval card
      You->>Bot: approve
    end
    Bot->>Tools: run it
    Tools-->>Bot: result
  end
  Bot-->>You: answer

• A loop guard stops the bot from repeating the same call over and over.
• Unanswered approvals get a push reminder after 4 hours and close after 24.
• Background turns (routines, check-ins, email, webhooks) can use a cheaper model via BACKGROUND_MODEL.

Each bot has one setting per action type:

Nobody is around to approve a background turn. So by default it can only use app tools that are read-only.

flowchart LR
  Chat["You type"] --> Bot["BotAgent"]
  Cron["Routine / check-in"] --> Bot
  Mail["Email to user.bot@domain"] --> Bot
  Hook["POST /api/hooks/..."] --> Bot
  Other["Another bot"] --> Bot
  AppEdit["Someone edits a shared app"] --> Bot
  Bot --> Push["Push notification to you"]

npm i -g cf

pnpm install

npx wrangler login

pnpm dev

Then open http://localhost:3000.

• Why Wrangler login? Workers AI and Browser Run can't run locally, so dev calls your real account for those two. Everything else runs on disk under .cloudflare/state/.
• More than one account? Prefix with CLOUDFLARE_ACCOUNT_ID=<id>.
• Secrets: copy .dev.vars.example to .dev.vars. All of them are optional.

You need a Cloudflare account on the Workers Paid plan (Browser Run and Dynamic Workers require it).

Sign in with Cloudflare, pick a name, who can sign in and a model, and the installer builds Coworkers into your account: the Worker, an AI Gateway, and Cloudflare Access in front. Re-running it with the same name updates Coworkers and keeps your bots. How it works and how to host it: installer/.

git clone https://github.com/fayazara/coworkers && cd coworkers
pnpm install
cf auth login
pnpm run setup

scripts/setup.ts asks for the account, a name, who can sign in and a model, then does what the installer does with the cf CLI:

1. creates the AI Gateway and Web Push keys
2. deploys once with Access required but not yet set up, so the new URL refuses every request instead of being open
3. sets up Cloudflare Access: your allow list, plus a bypass for shared app links (/apps) and webhooks (/api/hooks), which carry their own tokens
4. deploys again with the Access application's AUD

Your choices go in coworkers.deploy.json and secrets in .dev.vars.production. Both are git-ignored. To update later: git pull, then pnpm run setup again. It remembers your answers, and bots and their data are kept.

Use pnpm run setup, not pnpm setup (a pnpm built-in). Add -- --yes to skip the questions and reuse your saved answers, e.g. in CI.

cf ai-gateway gateways create --id coworkers --authentication --collect-logs \
  --cache-invalidate-on-update --cache-ttl 0 \
  --rate-limiting-interval 0 --rate-limiting-limit 0

{
  "name": "coworkers",
  "gateway": "coworkers",
  "accessTeamDomain": "locked.invalid",
  "accessAud": "locked"
}

npx web-push generate-vapid-keys
cp .dev.vars.example .dev.vars.production   # paste both keys in
pnpm run deploy --secrets-file .dev.vars.production

  "accessTeamDomain": "<team>.cloudflareaccess.com",
  "accessAud": "<aud tag>"

pnpm run deploy --secrets-file .dev.vars.production

Either way, Coworkers then checks the Access token on every request and answers 401 without a valid one, so it stays closed even if Access is turned off by mistake. Each email gets its own bots.

Open Models (the brain icon at the bottom of the sidebar). Workers AI models need nothing more. For Anthropic, OpenAI, Google or xAI, add Unified Billing credits or your own provider key to the gateway, then press Test.

Set in cloudflare.config.ts. Everything has a working default. coworkers.deploy.json, if present, overrides the name, MODEL, AI_GATEWAY_ID and the two ACCESS_* values.

The Models page overrides MODEL and BACKGROUND_MODEL for your account, and each bot can pick its own chat model in its settings.

src/
  server.ts           Worker entry: auth, /agents/*, /apps/*, inbound email
  agents/
    user-hub.ts       one per user: bot list, connections, shared memory, push
    bot-agent.ts      one per bot: tools, rules, routines, computer, browser
    prompt.ts         the bot's system prompt
    web-tools.ts      quick web read tools
    apps-runtime.ts   serves bot-built apps + AppLive
    app-store.ts      app data and share links
    teach.ts          records a demo in the browser
    secrets.ts        credentials the bot never sees
    guards.ts         stops runaway loops
    memory.ts         memory helpers
    models.ts         model factory: AI Gateway, fallback, log metadata
  routes/
    _app/             bot thread, computer + settings panels, connections, models
    api/hooks.*.ts    webhook endpoint
  components/         thread, Computer card, sidebar, panels
  lib/                shared types, server functions, React contexts
installer/            "Deploy to Cloudflare" wizard (its own Worker)
scripts/setup.ts      the same deploy, from your terminal with cf
cloudflare.config.ts  Worker config and bindings
AGENTS.md             read this first if you're an AI coding agent