Cloudflare vs Daytona (2026)

Agents act in outside systems through several routes. The MCP client connects an agent to remote MCP servers with OAuth, elicitation and reconnection after restarts, and Code Mode turns MCP servers and OpenAPI services into typed connectors that model written code calls while authentication stays in the host Worker. Agents also send and receive email, answer Slack and voice, receive webhooks, and can pay for HTTP services or MCP tools over x402 and the Machine Payments Protocol. Custom tools are ordinary functions handed to the model through the AI SDK, TanStack AI or a harness.

Sourcedevelopers.cloudflare.com/agents/tools/mcpread 2026-11-05

An agent in a Daytona sandbox reaches outside systems through what runs inside it. Git operations clone and push repositories, secrets hold credentials and external storage can be mounted. Firewall allow lists decide which hosts the agent may reach. Daytona has no catalog of connectors, OAuth actions or tool gateway of its own. The tools are the customer's code.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Multistep and multi agent work has its own runtimes. Workflows run durable steps with automatic retries and can wait months for an event or an approval, and the Agents SDK comes with patterns for prompt chaining, routing, parallelization and orchestrator and worker setups. Sub agents run as child Durable Objects with isolated storage and typed RPC, or as streaming tools of a parent agent, and a durable job queue and fibers keep long work alive through eviction and crashes.

Sourcedevelopers.cloudflare.com/agents/concepts/workflowsread 2026-11-05

The platform manages sandboxes. It creates and resizes them, applies lifecycle rules and runs warm pools and fleet scaling. It does not sequence, branch, retry or route an agent's steps. In Daytona's guides, agents built in LangGraph, the OpenAI Agents SDK and other frameworks do that, and Daytona has no workflow logic that mixes fixed steps with agent steps.

Sourcedaytona.io/docs/en/sandboxesread 2026-09-22

Work reaches an agent from schedules, messages and events. The scheduler runs callbacks after a delay, at a date, on a cron expression or on an interval, and Think adds timezone aware recurring tasks. Agents receive email, Slack messages and mentions, voice over WebSocket, Chat SDK messenger webhooks such as Telegram, and webhook events routed to a dedicated agent instance, while a built in queue works through background tasks in order.

Sourcedevelopers.cloudflare.com/agents/agent-class/schedule-tasksread 2026-11-05

Events go outward. Webhooks notify the customer's endpoint when sandboxes are created or change state and when snapshots and volumes change. Automated lifecycle rules stop, pause, archive or delete idle sandboxes. An agent's work starts only when the customer's code starts it. There is no schedule, and a stopped sandbox does not wake on an inbound request.

Sourcedaytona.io/docs/en/webhooksread 2026-09-22

Retrieval runs on maintained indexes. AI Search builds and manages indexes over R2 buckets, websites and uploaded files and returns relevant chunks, or a generated answer, to the agent, and Vectorize stores embeddings for custom retrieval. A searchable context block also gives each agent a full text index in its own Durable Object storage that it can query and add entries to.

Sourcedevelopers.cloudflare.com/agents/tools/ai-searchread 2026-11-05

The agent's code runs on Daytona, but there is no retrieval structure over the customer's content. Volumes and mounted external storage hold files the agent's code reads, and there is no index to query. The language server in a sandbox serves code intelligence for the files there. Nothing in Daytona indexes, refreshes or sets permissions on the customer's sources.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

The Session API is a memory layer kept in each agent's own Durable Object SQLite database. Conversation history persists as a branching message tree with full text search and compaction that summarizes older messages without deleting them, and chosen messages or a whole session can be deleted.

Writable memory blocks, such as learned facts or a task list, are injected into every turn and updated by the agent itself through a set_context tool within a token budget. Memory belongs to the agent instance, usually one per user or conversation, and survives hibernation and eviction. These memory APIs are still marked experimental.

Sourcedevelopers.cloudflare.com/agents/concepts/conversation-state-and-memoryread 2026-11-05

Persistence is on by default at three layers. The filesystem survives stop, start and archive. On VM sandboxes, memory (running processes and loaded state) survives pause and resume and hot snapshots. Volumes and mounted external storage outlive any one sandbox. Sandboxes can also be forked, and the agent's code reads the restored state to carry on. Paused process state belongs to the machine, so the customer can resume or delete it but cannot review or edit it. There is no separate memory layer that sets what an agent keeps or for how long.

Sourcedaytona.io/docs/en/persistenceread 2026-09-22

Approvals are part of the runtime. A Workflow can wait with waitForApproval() for minutes or months and resumes when the agent's approve or reject method is called, and durable Code Mode marks chosen connector calls with requiresApproval, so model written code pauses before the tool runs and replays once someone approves. MCP elicitation asks the user for input or an out of band step in the middle of a call, and a browser run can pause while a person logs in or solves a captcha through a Live View link.

Sourcedevelopers.cloudflare.com/agents/concepts/agentic-patterns/human-in-the-loopread 2026-11-05

Work in a sandbox has no approval step, consent checkpoint or escalation to a person. VNC, a web terminal and SSH let a person watch a sandbox and step in by hand. A firewall on each sandbox (allow lists or block all, with organization tiers that sandbox settings cannot override) restricts what an agent's code can reach. Nothing holds an agent's action for a person to review.

Sourcedaytona.io/docs/en/network-limitsread 2026-09-22

Cloudflare provides SOC 2, ISO and PCI reports to an account's Super Administrators and operates FedRAMP Moderate data centers. Access to the developer platform runs through account, domain and resource scoped roles, including Workers Platform Admin and its read only counterpart, Audit Logs Viewer and the Secrets Store roles, with dashboard single sign on, SCIM provisioning and audit logs. Agents check callers in the Worker before routing a request to them, and MCP servers built on Cloudflare can require OAuth 2.1 with scopes.

Sourcedevelopers.cloudflare.com/fundamentals/manage-members/rolesread 2026-11-05

Organizations sign in through OpenID Connect providers such as Google Workspace, Microsoft Entra ID and Okta, with provisioning and membership handled at sign in on the Enterprise plan. Collaborative organizations have owner and member roles plus granular assignments by resource, such as SSO Admin and access to the audit log.

API keys carry permissions and scopes, with managed child keys. An audit log covers user and system activity, and each sandbox has firewall allow lists or block all. Daytona says it meets HIPAA, SOC 2 and GDPR standards and has a Trust Center, but it names no report type or auditor.

Sourcedaytona.io/docs/en/ssoread 2026-09-22

Agent activity is traced turn by turn. The Agents tab lists each agent's model, sessions, runs and token use, session replay shows messages, reasoning, tool calls and sub agent activity, and each trace is a waterfall of model calls, tool runs and approvals that exports through OpenTelemetry. Diagnostics channels emit structured events for schedules, jobs, workflows and MCP connections, and account audit logs record who changed what. Traces are kept for seven days, and recording message and tool payloads is opt in.

Sourcedevelopers.cloudflare.com/agents/runtime/observability/tracingread 2026-11-05

Each step an agent takes in the sandbox is recorded. SDK tracing instruments every Daytona API operation and SDK call from the customer's application, such as each command run, file written or process started. Sandbox telemetry collects traces, logs and metrics from inside the sandbox.

Both export over OpenTelemetry to the customer's own collector, and Daytona keeps sandbox telemetry for three days. A separate audit log records user and system activity with the user, action and time, and logs can be streamed. The model's reasoning runs outside Daytona. Audit export is not available yet, and Daytona says it is coming soon.

Sourcedaytona.io/docs/en/observability/otel-collectionread 2026-09-22

Agent state can be pinned to a jurisdiction. Durable Objects created in the EU, US or FedRAMP jurisdiction run and store data only there, location hints place new objects near one of eleven regions from western North America to Oceania, and Regional Services control where requests are answered. Agents run on Cloudflare's global network, and the routing helper passes jurisdiction and location hints straight to the agent's Durable Object.

Sourcedevelopers.cloudflare.com/durable-objects/reference/data-locationread 2026-11-05

Sandboxes run in two shared regions, the United States and Europe, chosen per sandbox. Under Bring Your Own Compute, an organization instead creates custom regions and attaches its own runner nodes, with an optional proxy and snapshot manager for each region, for control over data locality and compliance.

Daytona's control plane manages them, and BYOC is sold on the Enterprise plan. The platform sold today cannot be self hosted from open source. Core development has moved to a private codebase, and the public github.com/daytonaio/daytona repository gets no further updates. Its last release, v0.190.0, stays public under AGPL 3.0.

Sourcedaytona.io/docs/en/bring-your-own-computeread 2026-09-22

Starting points come as harnesses, examples and skills. Think is an opinionated chat agent framework with built in tools, memory, messengers and scheduled tasks, Pi and OpenCode harnesses run inside a Durable Object, examples cover browser, chat, email, Slack and voice agents, and the agents starter template ships ready to deploy, alongside Agent Skills for coding agents. These are frameworks and examples a developer builds on, not finished agents a business adopts as they are.

Sourcedevelopers.cloudflare.com/agents/harnessesread 2026-11-05

Ready made starting points for running agents include default sandbox snapshots in several sizes, a Declarative Builder for images and an agent skill for coding agents. More than forty guides run coding agents (Claude Code, Codex, Devin, Gemini CLI, OpenClaw, OpenCode), as well as framework agents and reinforcement learning setups, in sandboxes, and a reference implementation runs Cursor's Cloud Agents on self hosted Daytona sandboxes. Developers build from these environments and walkthroughs. There is no browsable catalog of agents a customer can adopt.

Sourcedaytona.io/docs/en/agent-skillsread 2026-10-23

The developer chooses the model for each call. One createAI provider reaches Workers AI models hosted on Cloudflare, AI Gateway catalog models, dynamic routes and vendor SDK models from the AI SDK or Pi AI, with AI Gateway in front of outside providers, and harnesses such as OpenCode and Pi accept the same choices.

Sourcedevelopers.cloudflare.com/agents/modelsread 2026-11-05

The customer chooses the model. Guides run agents on Claude, OpenAI Codex and the Agents SDK, Gemini, Kimi and AWS Kiro, and on open models through OpenCode and other frameworks. GPU sandboxes serve the customer's own LLMs with vLLM or SGLang. Daytona imposes no model, and customers bring their own providers and keys, with guides on setting them up.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Developers drive the platform through the Cloudflare REST API, Wrangler and SDKs, and each agent exposes its own methods to browsers and servers through callable methods, a typed client SDK and HTTP or WebSocket routes. Cloudflare's managed remote MCP servers let an assistant read configuration and manage services across an account, and the Agents SDK builds stateless remote MCP servers on Workers.

Sourcedevelopers.cloudflare.com/agents/agent-class/callable-methodsread 2026-11-05

Outside callers reach Daytona through SDKs in five languages (Python, TypeScript, Ruby, Go and Java), a REST API with published OpenAPI specifications, and a CLI. The specifications cover the Daytona API, the Toolbox API inside the sandbox and an Analytics API. An MCP server lets Claude, Cursor and Windsurf manage sandboxes, and an agent skill serves coding agents.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Agents can be tested before release. The Workers Vitest integration runs tests against an agent in the real runtime, checking its responses, methods and state, the agents starter template ships with it configured, and wrangler dev runs the agent locally. Nothing scores model output or compares an agent's behavior across versions.

Sourcedevelopers.cloudflare.com/agents/getting-started/testing-your-agentread 2026-11-05

Evaluations and reinforcement learning run on Daytona, but it does not score them. Its guides run training with HUD, TRL, veRL and OpenEnv in sandboxes, along with a benchmark agent across several languages. The datasets, reward functions and scoring belong to those frameworks. Daytona offers no fixtures, scoring or quality gates for a customer's agent workflows, and no way to compare agent runs.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Agents drive a real Chrome through Browser Run, which runs on the Workers Free and Paid plans. Model written code sends any Chrome DevTools Protocol command to a live session to navigate, run JavaScript, read the DOM and capture screenshots, and the agent can return to the same browser on later turns with its tabs, cookies and login intact while the session stays alive, up to 10 minutes idle by default. Quick actions return a page as Markdown, extracted data, its links or scraped elements. Live View and session recording, which let a person watch or replay a session, are in beta.

Sourcedevelopers.cloudflare.com/agents/tools/browserread 2026-11-05

The Computer Use API gives an agent programmatic control of a desktop in the sandbox, from mouse and keyboard to screenshots, screen recording and display operations, on Linux and Windows. VNC lets a person watch or take over. The desktop runs remotely on Daytona's infrastructure. macOS sandboxes run on Mac hardware reserved for the customer through use.computer, with their own API key, and the Daytona SDKs, CLI and API do not manage them.

Sourcedaytona.io/docs/en/computer-useread 2026-10-23