Secure Private Networking for Everyone: Users, Devices, Agents, and Workers — Meet Cloudflare Mesh

The integration between AI agents and private infrastructure has never been more necessary than right now. And Cloudflare just took a massive step in that direction.

For a long time, remote access tools were designed with humans in mind: you log into the VPN, manually configure an SSH tunnel, or — worst case — expose a service publicly and hope you don’t run into a security problem. None of these approaches offer real visibility into what happens on the network after the connection is established.

But autonomous AI agents don’t work that way.

They make requests without waiting for your approval, they need to access private databases, internal APIs, and staging environments in real time, and none of those traditional approaches were designed to handle this securely and at scale. Your coding agent needs to query a staging database. Your production agent needs to call an internal API. Your personal assistant needs to reach a service running on your home network. Network clients are no longer just humans or services — they’re agents running autonomously, making requests against infrastructure you need to keep protected.

This is exactly where Cloudflare Mesh comes in 🎯

Officially announced in April 2026, Cloudflare Mesh arrives as a private networking solution built for a world where your network clients aren’t just developers or services anymore, but also agents running autonomously on your infrastructure. The offering connects your private networks and provides secure access for your agents, while also integrating Mesh with the Cloudflare Developer Platform, allowing Workers, Durable Objects, and agents built with the Agents SDK to reach your private infrastructure directly.

The pitch is simple on the surface, but powerful under the hood: a single bidirectional, secure private network for users, devices, and agents, all integrated with the ecosystem Cloudflare already offers in its SASE and Zero Trust package.

For those already using Cloudflare One, access to Mesh is already available. You don’t need a new technological paradigm to protect agent workloads — you just need a SASE built for the agentic era. Cloudflare Mesh is a new experience with a simpler setup, using the on-ramps you already know: the WARP Connector, now called Cloudflare Mesh node, and the WARP Client, now called Cloudflare One Client. Together, they create a private network for human, developer, and agent traffic.

Want to understand how this works in practice and why it changes the game for anyone building AI-powered products?

Keep reading 👇

The Real Problem Cloudflare Mesh Solves

Before talking about the solution itself, it’s worth stepping back and understanding why the current landscape is so complicated for anyone working with AI agents. When you have an autonomous system that needs to, say, query an internal database, call an API that only exists inside your corporate network, or even deploy to a staging environment, the lingering question is: how does that agent authenticate and access that resource securely, without you having to punch holes in your infrastructure?

The solutions that existed before Cloudflare Mesh were, in practice, forced workarounds. VPNs require interactive login. SSH tunnels require manual setup. Exposing services publicly is an obvious security risk. And none of these approaches offer visibility into what the agent is actually doing once connected. You’d create long-lived tokens, set up specific firewall rules, or rely on VPNs that simply weren’t designed to handle non-human identities making hundreds of requests per minute.

The result was a collection of problems any platform engineer knows all too well: credentials exposed in environment variables, overly broad access policies, no granular audit trail of what each agent was doing on the network, and an attack surface that grew at the same pace as the number of agents in production. Not to mention that scaling this was an operational nightmare, because each new agent or new integration required a manual configuration cycle that ate up time and created inconsistencies.

Traditional private networking simply wasn’t built for this operating model. And this isn’t some theoretical scenario. Just look at the current ecosystem: the explosion of MCP servers (Model Context Protocol) providing access to tools, coding agents that need to read private repositories and databases, personal assistants running on home hardware. Each of these patterns assumes the agent can reach the resources it needs. When those resources are isolated in private networks, the agent just gets stuck.

Three Scenarios That Became Hard to Secure

The Cloudflare Mesh announcement highlights three specific workflows that illustrate the scale of the challenge:

Accessing a personal agent from your phone. Imagine you’re running OpenClaw on a Mac mini at home. You want to access it from your phone, your laptop at a coffee shop, or your work machine. But exposing that service to the public internet, even behind a password, leaves gaps open. That agent has access to the shell, the filesystem, and your home network. One wrong configuration and anyone can reach it.

Letting a coding agent access your staging environment. You’re using Claude Code, Cursor, or Codex on your laptop. You ask the agent to check the status of a deploy, query analytics in a staging database, or read data from an internal object store. But those services live in a private VPC in the cloud, and your agent can’t reach them without exposing them to the internet or tunneling your entire laptop into the VPC.

Connecting production agents to private services. You’re building agents into your product using the Agents SDK on Cloudflare Workers. Those agents need to call internal APIs, query databases, and access services that aren’t on the public internet. They need private access, but with limited permissions, audit trails, and no credential leakage.

How Cloudflare Mesh Works in Practice

Cloudflare Mesh’s architecture is built on top of Cloudflare’s own global network, which has a presence in more than 330 cities around the world. Mesh creates a private connectivity fabric where every entity — whether a developer, a server, or an AI agent — receives an identity and communicates within an isolated, private address space. All of this is routed through Cloudflare’s global backbone, the same infrastructure that serves traffic for some of the biggest websites on the internet.

The core idea is simplicity: one lightweight connector connects everything. Your personal devices, your remote servers, your user endpoints. You don’t need to install separate tools for each access pattern. One connector on your network and all access patterns just work.

Once connected, devices on your private network can communicate with each other via private IPs, routed through Cloudflare’s global network. In practice, this means:

• With the Cloudflare One Client for iOS on your phone, you can connect your mobile devices to your local Mac mini running OpenClaw via the Mesh private network.
• With the Cloudflare One Client for macOS on your laptop, you can connect your laptop to your private network so your coding agents can reach staging databases or APIs and run queries.
• With Mesh nodes on your Linux servers, you can connect VPCs across external clouds, allowing agents to access resources and MCP servers on external private networks.

Because Mesh is powered by the Cloudflare One Client, every connection inherits the security controls of the Cloudflare One platform. Gateway policies apply to Mesh traffic. Device posture checks validate connected devices. DNS filtering catches suspicious queries. You get all of this without additional configuration: the same policies that protect your human traffic protect your agent traffic.

Mesh vs. Tunnel: When to Use Each

A question that naturally comes up is: when should I use Mesh instead of Tunnel? Both connect external networks privately to Cloudflare, but they serve different purposes.

Cloudflare Tunnel is the ideal solution for unidirectional traffic, where Cloudflare proxies traffic from the edge to specific private services, like a web server or a database.

Cloudflare Mesh, on the other hand, offers a full bidirectional, many-to-many network. Every device and node in your Mesh can access any other using their private IPs. An application or agent running on your network can discover and access any other resource in the Mesh without each resource needing its own Tunnel.

The Power of Cloudflare’s Global Network in Mesh

Cloudflare Mesh delivers the benefits of a mesh network — resilience, high scalability, low latency, and high performance — but by routing everything through Cloudflare, it solves a classic mesh networking challenge: NAT traversal.

Most of the internet sits behind NAT (Network Address Translation). This mechanism lets an entire local network share a single public IP address. When two devices are behind NAT, direct connections can fail and traffic has to fall back to relay servers. If your relay infrastructure has limited points of presence, a significant portion of traffic goes through those relays, adding latency and reducing reliability.

Cloudflare Mesh takes a different approach. All Mesh traffic flows through Cloudflare’s global network. For cross-region or multi-cloud traffic, this consistently outperforms routing over the public internet. There’s no degraded fallback path, because Cloudflare’s edge is the path.

Routing through Cloudflare also means every packet passes through the company’s security stack. This is the core advantage of building Mesh on top of the Cloudflare One platform: security isn’t a separate product you bolt on later.

Leveraging this global backbone, Mesh delivers important pillars from day one:

• 50 nodes and 50 users for free. Your entire team and your full staging environment on a private network, included with every Cloudflare account.
• Global edge routing. Over 330 cities, optimized backbone routing. No limited relay servers. No degraded fallback paths.
• Security controls from day one. Mesh runs on Cloudflare One. Gateway policies, DNS filtering, DLP, traffic inspection, and device posture checks are all available on the same platform.
• High availability. Create a Mesh node with high availability enabled and launch multiple connectors using the same token in active-passive mode. They advertise the same IP routes, so if one goes down, traffic fails over automatically.

Integration with the Developer Platform via Workers VPC

Mesh connects your agents and resources across external clouds, but you also need to connect your agents built on Workers with the Agents SDK. To make this possible, Cloudflare extended Workers VPC to make the entire Mesh network accessible to Workers and Durable Objects.

This means you can connect to your Cloudflare Mesh network directly from a Worker, making the entire network reachable from a single fetch() call on a binding. This functionality complements Workers VPC’s existing support for Cloudflare Tunnel, giving you more options for how to secure your networks.

In your wrangler.jsonc file, you can specify entire networks you want to connect to. To bind to your Mesh network, use the reserved keyword cf1:network, which binds to your account’s Mesh network. Then you can use the binding inside your Worker or agent code to reach any internal host on the Mesh, with no pre-registration required.

By connecting the Developer Platform to your Mesh networks, you can build Workers with secure access to your private databases, internal APIs, and MCP servers, enabling you to create cross-cloud agents and MCPs that deliver agentic capabilities to your application. But it also opens up a scenario where agents can autonomously observe your entire stack end-to-end, cross-reference logs, and suggest optimizations in real time.

How All the Pieces Fit Together

Together, Cloudflare Mesh, Workers VPC, and the Agents SDK provide a unified private network for your agents that spans both Cloudflare and your external clouds. Cloudflare has integrated connectivity and compute so your agents can securely reach the resources they need, wherever they are around the globe.

Mesh nodes are your servers, VMs, and containers. They run a headless version of the Cloudflare One Client and receive a Mesh IP. Services talk to services via private IPs, bidirectionally, routed through Cloudflare’s edge.

Devices are your laptops and phones. They run the Cloudflare One Client and reach Mesh nodes directly — SSH, database queries, API calls — all via private IPs. Your local coding agents use this connection to access private resources.

Agents on Workers reach private services through Workers VPC network bindings. They get scoped access to entire networks, mediated by MCP. The network controls what the agent can reach. The MCP server controls what the agent can do.

What’s Coming Next on the Mesh Roadmap

The current version of Mesh provides the foundation for secure, unified connectivity. But as agentic workflows grow more complex, Cloudflare is focused on going beyond simple connectivity, toward a network that’s more intuitive to manage and more granularly aware of who, or what, is talking to your services.

Hostname Routing

This summer, Cloudflare will extend Tunnel’s hostname routing to Mesh. Your Mesh nodes will be able to attract traffic for private hostnames like wiki.local or api.staging.internal, without you having to manage IP lists or worry about name resolution at Cloudflare’s edge. Routing traffic to services by name instead of by IP solves an entire class of routing headaches for anyone using dynamic IPs, auto-scaling groups, or ephemeral containers.

Tools we use daily

Translation

Text Inspection & Clipping

Social Media

Search & Research

Recruitment

Programming

Productivity & Organization

Operations

Marketing & Sales

Finance & Investment

Education

Design & Media

Data & Analytics

Content & Writing

Automation

Mesh DNS

Today, you reach Mesh nodes by their Mesh IPs. It works, but that’s not how you think about your infrastructure. You think in names: postgres-staging, api-prod, nikitas-openclaw.

Later this year, Cloudflare will launch Mesh DNS, where every node and device that joins the Mesh automatically gets a routable internal hostname. No DNS configuration, no manual records. Add a node called postgres-staging and postgres-staging.mesh resolves to the correct Mesh IP from any device on your network.

Identity-Aware Routing

Today, Mesh nodes authenticate at Cloudflare’s edge but share a single identity at the network layer. The goal is to implement identity-aware routing for Mesh, where each node, each device, and eventually each agent has a distinct identity that policies can evaluate.

This matters especially for agents. When an agent running on Workers calls a tool through a VPC binding, the destination service just sees a Worker making a request. It doesn’t know which agent is calling, who authorized it, or what scope was granted.

Cloudflare is working on a model where agents carry their own identity across the network, including the human principal or sponsor who authorized the action, the AI agent executing it, and the scope of what the agent is permitted to do. This would let you write policies like: reads from a given user’s agents are allowed, but writes require the user themselves directly.

Mesh in Containers

Today, Mesh nodes run on VMs and bare-metal Linux servers. But modern infrastructure increasingly runs in containers: Kubernetes pods, Docker Compose stacks, ephemeral CI/CD runners. Cloudflare is building a Mesh Docker image that lets you add a Mesh node to any containerized environment.

This means you’ll be able to include a Mesh sidecar in your Docker Compose stack and give every service in that stack access to the private network. A microservice running in a container in your staging cluster could reach a database in your production VPC via Mesh, without either service needing a public endpoint. It’s also useful for CI/CD pipelines: your GitHub Actions runner pulls the Mesh container image, joins the network, runs integration tests against your staging environment, and shuts down. All without VPN credentials to manage or persistent tunnels to maintain.

The Mesh Docker image is expected to be available later this year.

What Changes with the Arrival of Cloudflare Mesh

The launch of Cloudflare Mesh represents a major turning point in how the industry thinks about infrastructure for AI. For a long time, security and networking discussions in AI projects took a back seat, treated as problems to solve later, once the product was already up and running. Cloudflare Mesh flips that logic by offering a solution that is both easy to adopt and technically robust, removing the excuse that setting up a secure private network for agents is too complicated or too expensive to justify at the start of a project.

Cloudflare Mesh’s positioning within the company’s broader portfolio is a clear signal that Cloudflare is betting big on the AI infrastructure segment. In recent years, the company had already launched Workers AI, AI Gateway, and several other initiatives aimed at developers working with language models and intelligent automation. Mesh completes that story by solving the private connectivity problem, which is, in practice, one of the last major hurdles for anyone who wants to put agents into production responsibly and at scale.

For those already in the Cloudflare One ecosystem, Mesh works with your existing setup. Gateway policies, device posture checks, and access rules apply to Mesh traffic automatically. The service is free for up to 50 nodes and 50 users, and it’s available in the Cloudflare dashboard under Networking > Mesh.

At the end of the day, what Cloudflare Mesh does is raise the bar for what you should expect from modern infrastructure for AI agents. It’s not enough for the agent to be smart — it also needs to operate within a network that is secure, auditable, and manageable. And with Mesh, that requirement stops being a luxury reserved for large enterprises with dedicated infrastructure teams and becomes something accessible to any team already using Cloudflare, regardless of size or product stage. That’s what makes this launch relevant, not just as a product, but as a signal of what’s coming next in the AI ecosystem. 🚀