boxd vs Cloudflare (2026)

Agents on a machine act in outside systems through 128 integrations, including GitHub, Linear, Slack, Notion, Jira, Salesforce, HubSpot, Stripe and Zendesk, each with typed tools such as creating an issue or sending a message.

A person connects an account once through the provider's consent screen, personally or as a shared connection for the whole organization, and the platform then makes each call on the machine's behalf, so the credential never enters the machine.

The in machine run CLI and the @boxd/run SDK call these tools, and scripts reach any other API, database or cloud account with ordinary libraries.

Sourcedocs.boxd.sh/guides/integrations/connectionsread 2026-11-05

Agents act in outside systems through several routes. The MCP client connects an agent to remote MCP servers with OAuth, elicitation and reconnection after restarts, and Code Mode turns MCP servers and OpenAPI services into typed connectors that model written code calls while authentication stays in the host Worker. Agents also send and receive email, answer Slack and voice, receive webhooks, and can pay for HTTP services or MCP tools over x402 and the Machine Payments Protocol. Custom tools are ordinary functions handed to the model through the AI SDK, TanStack AI or a harness.

Sourcedevelopers.cloudflare.com/agents/tools/mcpread 2026-11-05

Background jobs give automations a managed lifecycle.

A script that registers a schedule or trigger runs as a job that survives reboots, waits for a missing connection instead of failing, and restarts with exponential backoff for up to five attempts before it is marked failed. boxd's fan out pattern has a coordinator create one machine per worker, run a coding agent headless in each and let a lead agent merge the reports, and a fork brings a machine's jobs along paused so nothing runs twice.

The sequencing, branching and hand offs in that pattern are code the customer writes against the SDK, and boxd has no workflow graph, step model or multi agent runtime of its own.

Sourcedocs.boxd.sh/guides/automations/jobsread 2026-11-05

Multistep and multi agent work has its own runtimes. Workflows run durable steps with automatic retries and can wait months for an event or an approval, and the Agents SDK comes with patterns for prompt chaining, routing, parallelization and orchestrator and worker setups. Sub agents run as child Durable Objects with isolated storage and typed RPC, or as streaming tools of a parent agent, and a durable job queue and fibers keep long work alive through eviction and crashes.

Sourcedevelopers.cloudflare.com/agents/concepts/workflowsread 2026-11-05

Work reaches a machine on schedules, events and inbound requests. An automation registers durations or cron expressions with every() and subscribes to integration events with .on(), such as a new Linear issue or a pull request through the boxd GitHub App, and 36 integrations emit triggers.

The platform holds the next due time and wakes a hibernated machine shortly before it, holds events that arrive while a machine wakes for up to 15 minutes, and fires a missed cron slot once on wake. A hibernated machine also wakes on the next HTTPS request, so an agent served from it answers webhooks at its own address.

Sourcedocs.boxd.sh/guides/automations/scriptsread 2026-11-05

Work reaches an agent from schedules, messages and events. The scheduler runs callbacks after a delay, at a date, on a cron expression or on an interval, and Think adds timezone aware recurring tasks. Agents receive email, Slack messages and mentions, voice over WebSocket, Chat SDK messenger webhooks such as Telegram, and webhook events routed to a dedicated agent instance, while a built in queue works through background tasks in order.

Sourcedevelopers.cloudflare.com/agents/agent-class/schedule-tasksread 2026-11-05

No retrieval index, vector store or knowledge base over the customer's content comes with the platform. Files on a machine's disk, standalone disks that outlive a machine and data sets saved into a snapshot are storage the agent's code reads, not an index a query returns. Tools such as Notion, Confluence or Google Drive are searched through their own integrations, and any grounding layer is something the customer installs on the machine.

Sourcedocs.boxd.sh/llms.txtread 2026-11-05

Retrieval runs on maintained indexes. AI Search builds and manages indexes over R2 buckets, websites and uploaded files and returns relevant chunks, or a generated answer, to the agent, and Vectorize stores embeddings for custom retrieval. A searchable context block also gives each agent a full text index in its own Durable Object storage that it can query and add entries to.

Sourcedevelopers.cloudflare.com/agents/tools/ai-searchread 2026-11-05

Machines keep their working state between sessions. A machine on standby resumes in under a millisecond and a hibernated one wakes with its memory and processes intact, and coding agent sessions live on the persistent disk, so a job delegated in the morning can be resumed interactively later. Forks, checkpoints and snapshots copy or rewind that state.

Automations also get object(name), a named JSON store written on every assignment and restored on the next run, meant for cursors, dedup sets and counters. All of it is machine and script state the developer manages, with no memory layer of stated scope and lifetime that a buyer can review, edit or delete as memory.

Sourcedocs.boxd.sh/guides/automations/scriptsread 2026-11-05

The Session API is a memory layer kept in each agent's own Durable Object SQLite database. Conversation history persists as a branching message tree with full text search and compaction that summarizes older messages without deleting them, and chosen messages or a whole session can be deleted.

Writable memory blocks, such as learned facts or a task list, are injected into every turn and updated by the agent itself through a set_context tool within a token budget. Memory belongs to the agent instance, usually one per user or conversation, and survives hibernation and eviction. These memory APIs are still marked experimental.

Sourcedevelopers.cloudflare.com/agents/concepts/conversation-state-and-memoryread 2026-11-05

A person can step into an agent's work while it runs. Every machine has a live desktop in the browser where its owner watches the agent's browser, takes over the keyboard to enter a password, solve a captcha or fix a form, and hands control back without stopping the agent. The preinstalled coding agents are told to share that desktop link whenever they need someone, so a login or approval happens in the browser the agent already opened. There is no approval gate, pause primitive or policy that holds an agent's action until a person reviews it.

Sourcedocs.boxd.sh/guides/desktopread 2026-11-05

Approvals are part of the runtime. A Workflow can wait with waitForApproval() for minutes or months and resumes when the agent's approve or reject method is called, and durable Code Mode marks chosen connector calls with requiresApproval, so model written code pauses before the tool runs and replays once someone approves. MCP elicitation asks the user for input or an out of band step in the middle of a call, and a browser run can pause while a person logs in or solves a captcha through a Live View link.

Sourcedevelopers.cloudflare.com/agents/concepts/agentic-patterns/human-in-the-loopread 2026-11-05

Organizations have three roles. Members use shared machines and create org billed ones, admins also invite and remove members, change roles, set defaults, create teams and revoke org API keys, and the single owner can demote admins. Admin invites need an interactive login, so an API key or a token minted inside a machine cannot send one.

People sign in with GitHub or Google, with SAML single sign on offered to enterprise customers on request. A DPA is available, and SOC 2 Type II and ISO 27001 are both in progress, not held. Each machine is a KVM microVM with its own kernel, and egress allowlists and host bound secrets are enforced on the host, outside the machine.

Sourcedocs.boxd.sh/guides/organizationsread 2026-11-05

Cloudflare provides SOC 2, ISO and PCI reports to an account's Super Administrators and operates FedRAMP Moderate data centers. Access to the developer platform runs through account, domain and resource scoped roles, including Workers Platform Admin and its read only counterpart, Audit Logs Viewer and the Secrets Store roles, with dashboard single sign on, SCIM provisioning and audit logs. Agents check callers in the Worker before routing a request to them, and MCP servers built on Cloudflare can require OAuth 2.1 with scopes.

Sourcedevelopers.cloudflare.com/fundamentals/manage-members/rolesread 2026-11-05

Automations are visible and the agent's own steps are not. The console's Automations page lists every background job with its triggers in plain English, the integrations it uses, its state, last run and last error, plus a generated write up and flow diagram for each script, and run logs prints or follows a job's log from inside the machine. Regional uptime and incidents appear on a public status page. A coding agent's prompts, tool calls and outputs are not traced by the platform, and no audit trail of member actions is offered.

Sourcedocs.boxd.sh/guides/automations/jobsread 2026-11-05

Agent activity is traced turn by turn. The Agents tab lists each agent's model, sessions, runs and token use, session replay shows messages, reasoning, tool calls and sub agent activity, and each trace is a waterfall of model calls, tool runs and approvals that exports through OpenTelemetry. Diagnostics channels emit structured events for schedules, jobs, workflows and MCP connections, and account audit logs record who changed what. Traces are kept for seven days, and recording message and tool payloads is opt in.

Sourcedevelopers.cloudflare.com/agents/runtime/observability/tracingread 2026-11-05

Each machine runs in Frankfurt or New York, picked per machine from the CLI, console or SDK or set as an organization default, and its disk, memory, snapshots, checkpoints and backups stay in that region on Latitude.sh bare metal. Scale customers can have boxd operate the cluster inside their own cloud account, and the same release self hosts on AWS, Google Cloud or any KVM host, free up to 16 worker vCPUs and licensed above that, with air gapped installs supported. boxd gives conflicting accounts of its US region, with New York live in some places and coming soon with a waitlist in others.

Sourcedocs.boxd.sh/guides/regionsread 2026-11-05

Agent state can be pinned to a jurisdiction. Durable Objects created in the EU, US or FedRAMP jurisdiction run and store data only there, location hints place new objects near one of eleven regions from western North America to Oceania, and Regional Services control where requests are answered. Agents run on Cloudflare's global network, and the routing helper passes jurisdiction and location hints straight to the agent's Durable Object.

Sourcedevelopers.cloudflare.com/durable-objects/reference/data-locationread 2026-11-05

Machines arrive with Claude Code, Codex and OpenCode installed and configured through an instructions file that teaches each agent the platform, plus three preinstalled skills covering the in machine CLI, automations and the desktop, and a CLI skill for the laptop.

Guides walk through development workspaces, preview environments, CI runners, personal assistants, sandboxes, agentic SaaS, RL environments and agent swarms, and connectors exist for open source tools such as TanStack AI, Pydantic AI, Harbor and Scale AI AgentEnv. These are configured third party agents and recipes a developer builds from, not prebuilt agents of boxd's own.

Sourcedocs.boxd.sh/use-cases/coding-agentsread 2026-11-05

Starting points come as harnesses, examples and skills. Think is an opinionated chat agent framework with built in tools, memory, messengers and scheduled tasks, Pi and OpenCode harnesses run inside a Durable Object, examples cover browser, chat, email, Slack and voice agents, and the agents starter template ships ready to deploy, alongside Agent Skills for coding agents. These are frameworks and examples a developer builds on, not finished agents a business adopts as they are.

Sourcedevelopers.cloudflare.com/agents/harnessesread 2026-11-05

The customer decides which agents and models run. Claude Code and Codex use the customer's own subscription, signed in once and served to every private machine in the organization, or an API key stored as a secret, OpenCode signs in on each machine, and any other agent or model that runs on Linux can be installed. boxd adds no model of its own and does not route between providers, and it does not use customer data to train or improve any model.

Sourcedocs.boxd.sh/use-cases/coding-agentsread 2026-11-05

The developer chooses the model for each call. One createAI provider reaches Workers AI models hosted on Cloudflare, AI Gateway catalog models, dynamic routes and vendor SDK models from the AI SDK or Pi AI, with AI Gateway in front of outside providers, and harnesses such as OpenCode and Pi accept the same choices.

Sourcedevelopers.cloudflare.com/agents/modelsread 2026-11-05

Outside code drives the platform through TypeScript and Python SDKs, a gRPC API whose full api.proto service definition is public for generating stubs in any language, and a CLI that returns JSON from its commands. Each region has its own API endpoint, and organization API keys keep working after the person who created them leaves. The SDKs cover machines, forks, snapshots, checkpoints, disks, egress, secrets, domains, organizations and teams, and a filesystem API reads and writes files inside a machine from code.

Sourcedocs.boxd.sh/reference/grpc-apiread 2026-11-05

Developers drive the platform through the Cloudflare REST API, Wrangler and SDKs, and each agent exposes its own methods to browsers and servers through callable methods, a typed client SDK and HTTP or WebSocket routes. Cloudflare's managed remote MCP servers let an assistant read configuration and manage services across an account, and the Agents SDK builds stateless remote MCP servers on Workers.

Sourcedevelopers.cloudflare.com/agents/agent-class/callable-methodsread 2026-11-05

There are no test cases, scoring or quality gates for an agent's behavior. The platform is where evaluations run, not how they are scored. Forks give every reinforcement learning rollout or benchmark trial a byte identical starting state, Moyai ran 279,577 Harbor benchmark machines on it, and a reproducibility check compares two forks run with the same seed, but rewards, datasets and scoring belong to the customer's own framework.

Sourcedocs.boxd.sh/use-cases/reproducible-rl-environmentsread 2026-11-05

Agents can be tested before release. The Workers Vitest integration runs tests against an agent in the real runtime, checking its responses, methods and state, the agents starter template ships with it configured, and wrangler dev runs the agent locally. Nothing scores model output or compares an agent's behavior across versions.

Sourcedevelopers.cloudflare.com/agents/getting-started/testing-your-agentread 2026-11-05

Agents drive a real browser on the machine's own desktop. Every machine ships a browser automation CLI built for agents, backed by Chromium with anti bot fingerprinting and a persistent profile so logins stick, and scripts get the same browser through Playwright. A machine can also drive a Chrome window on the user's laptop over the DevTools protocol, for sites that only accept the user's own network, and the preinstalled agents get a browser tool for it automatically. Any GUI app installed on the machine opens on the same desktop.

Sourcedocs.boxd.sh/guides/launch-a-browserread 2026-11-05

Agents drive a real Chrome through Browser Run, which runs on the Workers Free and Paid plans. Model written code sends any Chrome DevTools Protocol command to a live session to navigate, run JavaScript, read the DOM and capture screenshots, and the agent can return to the same browser on later turns with its tabs, cookies and login intact while the session stays alive, up to 10 minutes idle by default. Quick actions return a page as Markdown, extracted data, its links or scraped elements. Live View and session recording, which let a person watch or replay a session, are in beta.

Sourcedevelopers.cloudflare.com/agents/tools/browserread 2026-11-05