The news
On September 28, 2026, Cloudflare (NET) released an open beta of cf, a command-line tool built for AI coding agents as well as developers. The Cloudflare cf CLI covers more than 3,000 API operations and arrived with an open-source code generator and two 1.0 releases.
Cloudflare said cf mirrors its entire API, up from the roughly 280 functions its existing Wrangler tool had accumulated. Agent-oriented features include JSON as the default output to cut token use, a natural-language command search and TypeScript configuration files with language-server support that coding tools can read. The company said agents accounted for a quarter of Wrangler use in March 2026, up from single-digit percentages a year earlier, and 48% in the week before the launch.
When the beta ends, Cloudflare plans a final major Wrangler release that points users to cf, followed by 18 months of maintenance support. An independent review of beta 1.0.0-beta.5 on the developer blog Bokvi found gaps, including no live log streaming, no way to set individual secrets and no rollback. Its author also reported that cf collects search queries verbatim by default and that no beta end date has been announced.
Cloudflare also open-sourced Forge, the pipeline that generates cf, under the Apache 2.0 license. Forge turns API definitions into software development kits in TypeScript, Rust, Python, Go and PHP, as well as command-line tools, documentation, Terraform providers and Model Context Protocol (MCP) servers, the standard connectors AI agents use to reach outside tools. Cloudflare said existing hosted generators could not handle its scale and that some have shut down.
The same day, Cloudflare shipped EmDash 1.0, a free MIT-licensed content management system built on the Astro web framework, which it introduced on April 1, 2026, as a spiritual successor to WordPress. EmDash runs plugins in sandboxes limited to approved capabilities, rather than giving them direct database access as WordPress does. It includes a built-in MCP server so agents can read and update content, and it runs on Cloudflare, on Node.js or self-hosted. Cloudflare said the project has more than 175 contributors and 1,800 commits.
Cloudflare also released vinext 1.0, a Vite plugin that reimplements the Next.js programming interface so Next.js apps can be deployed to the Cloudflare Workers free plan, Netlify or AWS Lambda. Cloudflare said test compatibility now exceeds 99%, excluding cache components. It first launched vinext in February 2026 as a week-long, AI-driven experiment by one engineer, and the project's GitHub page says it is not yet a drop-in replacement for every application.
The numbers
- API operations covered by cf
- More than 3,000 (vs. ~280 Wrangler functions)
- Agent share of Wrangler use (Cloudflare)
- 48% in the week before launch; a quarter in March 2026
- Wrangler maintenance after cf beta ends
- 18 months
- vinext test compatibility with Next.js (Cloudflare)
- More than 99%, excluding cache components
- EmDash contributors / commits
- 175+ / 1,800+
- Licenses
- Forge: Apache 2.0; EmDash and vinext: MIT
Why CEOs should care
For CTOs, Cloudflare's own figure is the headline: agents now account for nearly half of Wrangler usage. A tool that exposes the whole API, including firewall rules, access policies and domain registration, means an agent with a broad token can change security-critical settings. Issue agents narrowly scoped API tokens, log what they do and require human approval for production changes. Start an inventory of build pipelines that call Wrangler now, but hold production migrations until gaps such as log streaming, secrets handling and rollback are closed.
CISOs should review cf's telemetry settings, given the independent report that search queries are collected verbatim by default. EmDash's plugin model is worth a look for teams running content sites: each plugin declares what it wants to do and the runtime limits it to those approved actions, a direct contrast with WordPress plugins' database access. Ask how the decentralized plugin registry handles takedowns and vetting before allowing third-party plugins.
For CFOs and platform owners, vinext and Forge are about reducing lock-in. If Next.js apps can move between Cloudflare, Netlify and AWS with limited changes, you gain leverage in hosting negotiations. Companies with public APIs can also test Forge as an alternative to paid, hosted SDK generators. Treat both as pilots: vinext's own documentation advises testing against your application before adopting it.
The bigger picture
Cloudflare is redesigning its developer platform on the assumption that AI agents, not people, will do much of the typing. The pattern runs across all four releases: a CLI with machine-readable output, a code generator that can produce MCP servers, a CMS with a built-in MCP server and a framework that began as an AI-driven experiment.
The releases also give Cloudflare on-ramps to two large pools of websites: those built with Next.js and those running on WordPress. That puts it in more direct competition with front-end hosting platforms and traditional CMS vendors, while its portability pitch lets it argue customers are not trading one form of lock-in for another.
What’s next
Cloudflare has not set an end date for the cf open beta, which will start Wrangler's 18-month support clock. Watch for the missing beta features, the final Wrangler release, progress on vinext's cache components and whether EmDash's alpha site-building tool for agents moves toward general availability.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
