Secure Private Networking for Everyone: Cloudflare Mesh Launches for Users, Nodes, Agents, and Workers

Cloudflare Mesh presents a new approach to private networking that includes AI agents, instead of relying solely on traditional VPN and SSH tunnels designed around people and services. It handles a code agent accessing a staging DB, a personal AI connecting to services on a home network, and Workers and Agents SDK-based agents calling internal APIs, all in the same way.

The core idea is connecting users, nodes, and agents all through a single lightweight connector. Mesh runs on top of Cloudflare One, and automatically applies the Gateway policies, Access rules, and device posture checks you're already using. What used to be called WARP Connector is now called Cloudflare Mesh node, and WARP Client is now called Cloudflare One Client.

Mesh isn't just a remote access tool—it's a bidirectional, many-to-many private network. Each device and node communicates with each other via private IPs, and traffic is routed through Cloudflare's global network across 330+ cities. This means Cloudflare handles NAT traversal issues on your behalf, and provides more reliable connectivity across regions and multi-cloud environments as well.

Three representative scenarios remain particularly challenging.

• Personal agent access from mobile: accessing an agent like OpenClaw running on a Mac mini at home without exposing it to the public Internet.
• Coding agent access to staging: Claude Code, Cursor, and Codex need to query a DB or internal API inside a private VPC.
• Deployed agent access to private services: agents built with Workers and the Agents SDK need to reach internal resources without credential leakage.

Cloudflare also distinguishes the roles of Tunnel and Mesh. Cloudflare Tunnel is suited for one-way connections to a specific private service, such as a web server or a DB, while Mesh is suited for full network connectivity based on private IPs. The key difference with Mesh is that resources within a network can directly discover and access each other.

The operational advantages are also clear. You can start with 50 nodes and 50 users for free, and Mesh nodes with high availability enabled can run multiple connectors in active-passive mode using the same token, supporting automatic failover in case of an outage. Security is included from day one, and you can attach features like DNS filtering, DLP, and Access for Infrastructure one at a time whenever you need them.

Finally, Workers VPC has now been extended to Mesh. By binding a Mesh network with the reserved cf1:network keyword in wrangler.jsonc, a Worker or Durable Objects can access an internal IP or private hostname with a single fetch() call. In other words, Cloudflare is bringing networking and compute together so that agents can securely reach internal DBs, internal APIs, and MCP servers no matter where they run.