Moltworker: Running a Self-Hosted AI Agent on Cloudflare Workers 2026 Guide

This updated guide reframes Moltworker: Running a Self-Hosted AI Agent on Cloudflare Workers 2026 Guide around practical search intent: what readers need to compare, choose, install, secure, or operationalize in 2026. It focuses on decision criteria, workflow fit, and the trade-offs that matter once an AI agent, skill, marketplace, or automation moves from curiosity to daily use.

The article also broadens the semantic coverage around AI worker, digital employee, agentic automation. That gives readers a clearer path from high-level research to implementation planning, while keeping the content useful for teams evaluating AI workers and digital employees.

Quick Answer

The strongest AI worker use cases start as bounded jobs with clear handoffs, measurable output quality, and escalation paths for exceptions.

This week the Internet saw a wave of people purchasing Mac minis to run Moltbot (formerly Clawdbot), an open-source, self-hosted AI agent built to serve as a personal assistant. Moltbot operates in the background on your own hardware, offers a growing catalog of integrations for chat platforms, AI models, and other widely used tools, and can be managed remotely. It can handle your finances, manage social media, and organize your schedule — all through your preferred messaging application.

But what if you prefer not to buy dedicated hardware? And what if you could still run Moltbot efficiently and securely in the cloud? Enter Moltworker — a middleware Worker paired with adapted scripts that enables running Moltbot on Cloudflare's Sandbox SDK and Developer Platform APIs.

How Does a Personal Assistant on Cloudflare Actually Work?

Cloudflare Workers has reached an unprecedented level of Node.js compatibility. In the past, mocking APIs was necessary to get certain packages working, but now those APIs are natively supported by the Workers Runtime.

This evolution has transformed how tools are built on Cloudflare Workers. When Playwright — a widely used framework for web testing and automation running on Browser Rendering — was first implemented, the team had to rely on memfs. That approach was problematic: memfs is essentially a workaround and an external dependency, and it forced the implementation to diverge from the official Playwright codebase. Thanks to improved Node.js compatibility, node:fs can now be used natively, cutting down complexity and maintenance overhead, which makes upgrading to the latest Playwright versions straightforward.

The roster of natively supported Node.js APIs continues to expand. The blog post "A year of improving Node.js compatibility in Cloudflare Workers" provides a comprehensive overview of current progress and upcoming plans.

This progress is measured quantitatively as well. A recent experiment took the 1,000 most popular NPM packages, installed them, and used AI to attempt running them in Cloudflare Workers — Ralph Wiggum as a "software engineer" style — and the results turned out surprisingly positive. After excluding packages that are build tools, CLI utilities, or browser-only packages that don't apply, only 15 packages genuinely failed. That's just 1.5%.

Here's a visual showing Node.js API support growth over time:

The full results of this internal NPM package compatibility experiment are published here for anyone to review.

While Moltbot doesn't necessarily demand extensive Workers Node.js compatibility since most code runs inside a container, it's worth highlighting how far native API support has advanced. When starting a new AI agent application from the ground up, much of the logic can actually execute in Workers, closer to the end user.

The other crucial piece of this story is that Cloudflare's products and APIs on the Developer Platform have expanded to a point where anyone can build and run virtually any application — even the most complex and resource-intensive ones — on Cloudflare. Once deployed, every application on the Developer Platform immediately benefits from the secure and scalable global network.

These products and services provided the essential building blocks. First, there are now Sandboxes, which allow running untrusted code securely in isolated environments, giving the service a place to execute. Next, Browser Rendering enables programmatic control and interaction with headless browser instances. And finally, R2 provides persistent object storage. With these components in place, adapting Moltbot could begin.

Adapting Moltbot to Run on Cloudflare

Moltbot on Workers — known as Moltworker — combines an entrypoint Worker that functions as an API router and proxy between Cloudflare APIs and the isolated environment, all secured by Cloudflare Access. It also delivers an administration UI and connects to the Sandbox container where the standard Moltbot Gateway runtime and its integrations operate, utilizing R2 for persistent storage.

High-level architecture diagram of Moltworker.

Let's explore the details.

Cloudflare AI Gateway functions as a proxy between your AI applications and any popular AI provider, providing customers with centralized visibility and control over outgoing requests.

Recently, support for Bring Your Own Key (BYOK) was announced, letting users centrally manage provider secrets rather than passing them in plain text with every request through gateway configuration.

An even more convenient option — eliminating the need to manage AI provider secrets entirely — is Unified Billing. Here you top up your account with credits and use AI Gateway with any supported provider directly. Cloudflare gets billed, and credits are deducted from your account.

To route Moltbot through AI Gateway, the process involves creating a new gateway instance, enabling the Anthropic provider, adding a Claude key or purchasing credits for Unified Billing, and then setting the ANTHROPIC_BASE_URL environment variable so Moltbot points to the AI Gateway endpoint. That's all — no code modifications needed.

Once Moltbot routes through AI Gateway, you gain full cost visibility along with access to logs and analytics that reveal how your AI agent interacts with AI providers.

Note that Anthropic is just one option; Moltbot supports other AI providers and so does AI Gateway. The benefit of using AI Gateway is that when a superior model arrives from any provider, you don't need to swap keys in your AI agent configuration and redeploy — simply switch the model in your gateway settings. Additionally, you can specify model or provider fallbacks to handle request failures and maintain reliability.

Anticipating the growing need for AI agents to execute untrusted code securely in isolated environments, Cloudflare announced the Sandbox SDK last year. This SDK is built atop Cloudflare Containers and provides a straightforward API for running commands, managing files, executing background processes, and exposing services — all from your Workers applications.

In practical terms, rather than wrestling with lower-level Container APIs, the Sandbox SDK offers developer-friendly APIs for secure code execution while managing container lifecycle, networking, file systems, and process management behind the scenes — letting you concentrate on application logic with just a few lines of TypeScript. Here's an example:

import { getSandbox } from '@cloudflare/sandbox';
export { Sandbox } from '@cloudflare/sandbox';
export default {
async fetch(request: Request, env: Env): Promise<Response> {
const sandbox = getSandbox(env.Sandbox, 'user-123');
// Create a project structure
await sandbox.mkdir('/workspace/project/src', { recursive: true });
// Check node version
const version = await sandbox.exec('node -v');
// Run some python code
const ctx = await sandbox.createCodeContext({ language: 'python' });
await sandbox.runCode('import math; radius = 5', { context: ctx });
const result = await sandbox.runCode('math.pi * radius ** 2', { context: ctx });
return Response.json({ version, result });
}
};

This is a perfect fit for Moltbot. Instead of running Docker on a local Mac mini, Docker runs on Containers, and the Sandbox SDK issues commands into the isolated environment while using callbacks to the entrypoint Worker, effectively creating a bidirectional communication channel between the two systems.

Persistent Storage with R2

Running things on a local computer or VPS gives you persistent storage by default. Containers, however, are inherently ephemeral — data generated within them disappears upon deletion. Fortunately, the Sandbox SDK provides sandbox.mountBucket(), which automatically mounts an R2 bucket as a filesystem partition when the container launches.

With a local directory guaranteed to survive beyond the container lifecycle, Moltbot can store session memory files, conversations, and other assets that need to persist.

Browser Automation via Browser Rendering

AI agents depend heavily on navigating the sometimes poorly structured web. Moltbot uses dedicated Chromium instances to perform actions, browse websites, fill forms, capture snapshots, and handle tasks requiring a web browser. While Chromium can run in Sandboxes too, an API-based approach offers simpler integration.

With Cloudflare's Browser Rendering, you can programmatically control and interact with headless browser instances running at scale across the edge network. Support includes Puppeteer, Stagehand, Playwright, and other popular packages, enabling developers to onboard with minimal code changes. MCP for AI is supported as well.

Getting Browser Rendering working with Moltbot requires two steps:

First, a thin CDP proxy is created (CDP is the protocol for instrumenting Chromium-based browsers) from the Sandbox container to the Moltbot Worker, then back to Browser Rendering using the Puppeteer APIs.

Second, a Browser Rendering skill is injected into the runtime when the Sandbox starts.

From the Moltbot runtime's perspective, it simply has a local CDP port available for browser tasks.

Authentication Policies with Zero Trust Access

The next step is protecting APIs and the Admin UI from unauthorized access. Building authentication from scratch is difficult, and it's exactly the kind of wheel you don't want to reinvent. Zero Trust Access makes it remarkably simple to secure your application by defining specific policies and login methods for each endpoint.

Zero Trust Access Login methods configuration for the Moltworker application.

Once endpoints are protected, Cloudflare handles authentication automatically and includes a JWT token with every request to your origin endpoints. You can then validate that JWT for additional protection, ensuring requests originated from Access rather than a malicious third party.

As with AI Gateway, once all APIs are behind Access you gain excellent observability into who the users are and how they interact with your Moltbot instance.

Demo time. A Slack instance was set up to experiment with a dedicated Moltbot on Workers instance. Here are some highlights.

We hate bad news.

Here's a chat session requesting Moltbot to find the shortest route between Cloudflare in London and Cloudflare in Lisbon using Google Maps and take a screenshot in a Slack channel. It goes through a sequence of steps using Browser Rendering to navigate Google Maps and delivers impressive results. Notice Moltbot's memory in action during the second request.

We're in the mood for some Asian food today, so let's put Moltbot to work.

We eat with our eyes too.

Taking it further, Moltbot was asked to create a video of it browsing the developer documentation. As shown, it downloads and runs ffmpeg to generate the video from frames captured in the browser.

The implementation has been open-sourced and is available at https://github.com/cloudflare/moltworker, so you can deploy and run your own Moltbot on Workers today.

The README walks through the required setup steps. You'll need a Cloudflare account and a Workers Paid plan for Sandbox Containers access; however, all other products are either completely free (like AI Gateway) or include generous free tiers that let you get started and scale within reasonable limits.

Note that Moltworker is a proof of concept, not a Cloudflare product. The goal is to demonstrate some of the most compelling features of the Developer Platform that can power AI agents and run unsupervised code efficiently and securely, while delivering excellent observability backed by the global network.

Feel free to contribute to or fork the GitHub repository; the team will monitor it for support. Contributing upstream to the official project with Cloudflare skills is also under consideration.

We hope this experiment was enjoyable, and that it demonstrated why Cloudflare is an ideal platform for running AI applications and agents. Features like the Agents SDK for building your first agent in minutes, Sandboxes for running arbitrary code in isolated environments without container lifecycle headaches, and AI Search — Cloudflare's managed vector-based search service — are just a few examples of what's been released with the future in mind.

Cloudflare now delivers a complete AI development toolkit: inference, storage APIs, databases, durable execution for stateful workflows, and built-in AI capabilities. Together, these building blocks make it possible to build and operate even the most demanding AI applications on the global edge network.

If you're passionate about AI and want to help build the next generation of products and APIs, we're hiring.

Related Reading

• 10 Best AI Agent Hosting Platforms Compared (2026)
• Best Agent Cloud Platforms in 2026
• Best Cloud Platforms for Enterprise AI Deployment in 2026