Cloudflare Autonomous Agent — Goal-Following AI Agent on the Free Tier

An open-source AI agent that runs entirely on Cloudflare's free tier. Send a goal in Telegram; it plans, works through 53 tools, checks its own output, and reports back — on durable Cloudflare Workflows runs.

Cloudflare Autonomous Agent is an open-source, goal-following AI agent that runs entirely on Cloudflare's free tier. You send a task in Telegram; it classifies the goal, runs a tool loop across 53 tools, verifies its own output, and reports back. It uses Cloudflare Workers and Workflows for durable runs.

Tech stack: Cloudflare Workers, Cloudflare Workflows, JavaScript, Telegram Bot, GitHub API

Repo: https://github.com/basavarajpatil660/cloudflare-autonomous-agent

Problem

Most AI agent demos assume paid infrastructure and a model that behaves. This project explores how far a goal-following agent can get on Cloudflare's free plan, with Telegram as the only interface. That means working inside a hard ceiling of 50 external subrequests per Workflow instance, and dealing with language models that report a task as finished when they only described it.

How do you use it?

You send a plain sentence in Telegram, such as "build a three page site for a bakery and push it to a repo called corner-bakery". The agent classifies the goal, runs a tool loop, checks its own work, and reports back in the same chat. There are no slash commands; everything is triggered by ordinary sentences.

What is Cloudflare Autonomous Agent?

It is an open-source (MIT) agent built from two Cloudflare Workers. agent-router holds all the reasoning: it classifies the goal as coding or general, runs up to 30 tool-loop iterations, calls model providers through fallback chains, verifies its own output, and talks to Telegram. agent-deployer is a small single-purpose worker with no model access that pushes finished multi-file projects to GitHub. Runs execute on Cloudflare Workflows, so they are durable and are not bound by the roughly 30-second limit of a normal request.

What can it do?

53 tools, all triggered by plain sentences in Telegram:

  • Files: write a file and send it to you as a document, or bundle several files into a real .zip.
  • GitHub: create and manage repos, issues, pull requests, merges, releases and collaborators, or push a whole multi-file project in one go.
  • Research: web and news search, page reading, and current date lookups.
  • Code sandbox: run code in Judge0 (Python, JavaScript, TypeScript, Bash, Java, C, C++, Go, Rust) and fix it if it fails.
  • Design check: scans the HTML and CSS it wrote for generic template patterns and rewrites them.
  • Integrations: Spotify playback, Discord messages, YouTube search and transcripts, and read-only Gmail and Calendar.
  • Memory: notes you ask it to keep, plus recent run history that resets after an idle gap.

Can an AI agent really run on Cloudflare's free plan?

Yes, with one hard constraint that shapes the whole design. On the free plan, a Worker or Workflow gets 50 external subrequests per invocation, and the limit applies per Workflow instance, not per step. Every model call, GitHub request, Telegram message and web search shares that pool. The project handles this by counting every external call, holding a reserve back so a run can still report what happened, batching tool-call logging, filtering tool definitions by goal, and moving the most subrequest-heavy job, deploying to GitHub, into a separate worker with its own fresh budget. A very large multi-file build can still exceed the ceiling, and when it does the run fails with a message naming the real limit.

How does it avoid claiming it finished when it didn't?

Language models will report success on work they only described, so several checks exist purely to catch that. It detects answers that announce a plan but wrote no files, counts the real rows in a file against what the goal asked for, confirms that a GitHub push actually succeeded, and refuses to present code as working when it failed sandbox verification. Each check throws a visible error instead of delivering a confident but false result. A second, smaller model also reviews the answer against the goal before it is delivered.

Is it safe to give an agent a GitHub token?

The design assumes the risk and limits it. Telegram requests are rejected unless the sender's chat ID is on an allowlist, and the HTTP API stays disabled until a secret is set. Deleting a repo or file needs the exact name in the current message, real deletion wording, and a tap on a Telegram Confirm button. A blocked-repos list stops writes and deletes on repositories you can't afford to lose. Merging a pull request, closing an issue and adding a collaborator run without a confirm button, so scope the token down if that worries you.

Is this the same as Cloudflare's Agents SDK?

No. This is an independent open-source project built on Cloudflare Workers, Workflows and KV. It is not made by, affiliated with or endorsed by Cloudflare, and it doesn't use the Agents SDK. It is also a separate project from my earlier Telegram-native Multi-Agent AI System.

What are its limits?

It is designed and tested for a single user, with no multi-tenancy. Free-tier model providers are rate-limited and sometimes unavailable, and fallback chains reduce that but don't remove it. The code sandbox has no third-party packages, Spotify plays single tracks only, and the deployer makes one commit per file. The full setup guide and source are on GitHub.

Results

Open-sourced under the MIT license. Two Workers, 53 tools across GitHub, web research, a code sandbox, Spotify, Discord, YouTube, Gmail/Calendar and memory, all running on Cloudflare's free plan. Deploys straight from GitHub through Cloudflare Builds, with no local CLI needed.

Challenges

  • The free plan allows 50 external subrequests per Workflow instance, shared across every step. Every model call, GitHub request, Telegram message and web search draws from that one pool. The fix was explicit accounting of every external fetch, 8 subrequests held in reserve to report results, batched logging, goal-based tool filtering, and moving GitHub deploys into a separate worker with its own fresh budget.
  • Language models claim success on work they only described. Four checks now throw a visible error instead of delivering a confident false result: intent-only detection, row-count verification, a deploy-success check, and sandbox verification of generated code.
  • An early version deleted a repository that only appeared in replayed conversation context. Destructive tools now require the target to be named in the current message, real deletion wording, and a Confirm tap in Telegram, and stored memory is stripped before any goal detection runs.
  • Telegram caps message length, so long answers are split at newlines, and when a split lands inside a code fence the fence is closed and reopened with the same language tag so every chunk is valid on its own.

Architecture

The system is two Cloudflare Workers. agent-router holds all reasoning: it classifies the goal as coding or general, runs a tool loop of up to 30 iterations, calls model providers through fallback chains (at most three attempted per call), runs its verification passes, and talks to Telegram. It runs on Cloudflare Workflows, so a run is durable and not bound by the roughly 30-second limit of a normal request. Memory, stats and the file index live in Workers KV.

agent-deployer has no model access, no memory and no Telegram integration. It receives exact file paths and exact bytes and pushes them to GitHub, counting its own subrequests and stopping with budget left to report which files landed. Keeping the component with write access to your repositories this small means it can be audited in one sitting.