Agentic week: Cloudflare shipped an entire agent stack in five days

One company published a wallet, an identity scheme, a stateless protocol implementation and an inference control plane in five working days. The interesting part is not the volume. It is that all four are the same product.

Between 2 and 7 August, Cloudflare ran its first Agents Week. The opening post on 2 August stated the premise plainly: "The cloud we have today, and the web it sits on, were built for people... but agents don't work that way." What followed was not a set of features. It was an attempt to own every layer an autonomous agent touches between waking up and paying for something.

Outside that week, one other launch matters, and it points the opposite way.

1. The four verbs of the agentic web

On 6 August, Jack Galilee published the architectural framing for everything else: an open agentic Internet needs to be readable, discoverable, callable and payable. Each verb got a shipped product.

Readable is markdown instead of markup, plus Kitesurf, a browser designed to run inside Workers. The argument is a cost argument: "Every HTML tag rendered for a human that never looks at it is not only a waste of compute but also a pollution of the context window." Discoverable is AI Search and answer-engine measurement — "If you are not measurably visible to the agents your customers use, then you are effectively offline for them." Callable is WebMCP and Code Mode. Payable is Wallets plus the Monetization Gateway, with a line that reads like a spec requirement: "Every paid interaction leaves a receipt. The publisher can prove which agent fetched which page."

The four-verb decomposition is worth stealing regardless of what you think of the vendor. It is the first framing this year that puts discovery, invocation and settlement in the same sentence without collapsing them into one protocol.

2. Wallets and cloudflare.pay: the buy side arrived, mostly as a reservation

On 4 August, Cloudflare announced Cloudflare Wallets and cloudflare.pay. The design is two-tier. A human-controlled Account Wallet holds the balance. Per-agent Virtual Wallets spend from it through API keys, under owner-defined allowances, allowlists, maximum transaction sizes and overall spending caps. An agent that hits a limit can ask a human for an override. Handles are human-readable and hierarchical — the example given is research.example.cloudflare.pay — and identification is optional, with merchants deciding whether to serve an unidentified agent.

The press release is direct about the gap this fills: "When an agent shows up at your door, you need to know who sent it." It is equally direct about what shipped. Handle reservation opened that day. Full wallet access — onramping, offramping, and issuing Virtual Wallets — arrives "in the coming months."

The identity half builds on Web Bot Auth: a keypair proves the agent, a handle makes the keypair legible to a merchant. That is the third distinct answer to "which agent is calling" now in production or near it, after Web Bot Auth signatures at the HTTP layer and ERC-8004 on chain. None of them resolve to each other.

A separate post on 7 August gave a sense of scale for the detection problem behind all this: 206 million Precursor evaluation events across 73,438 zones in a 24-hour window, with the observation that behavior "often shifts from human to agentic and back over a session." Point-in-time bot detection does not survive that. Neither does point-in-time authorization.

3. MCP 2026-07-28 reached production infrastructure in nine days

The specification went final on 28 July. On 6 August, Cloudflare shipped support for it. The consequence is architectural, not cosmetic: with the handshake and session state gone — "Each request carries the protocol version, client identity, and client capabilities it needs" — MCP servers now run directly on Workers without Durable Objects for protocol sessions.

That is the practical meaning of the stateless core we analysed in the spec deep dive. A session-bound protocol forces every deployment into sticky routing or a coordination object. Remove it and an MCP server becomes an ordinary stateless HTTP handler that any instance can answer.

The migration path is dual-mode: a single /mcp endpoint accepts both new stateless requests and 2025 Streamable HTTP clients, so legacy sessions drain instead of breaking. Agents SDK v0.20.0 supports the spec. Sentry co-founder David Cramer is quoted saying they ran it in production before the spec was finalised without breaking prod. Cloudflare also reports its Code Mode MCP server "has scaled up to thousands of requests per second and served billions of tool calls."

4. The gateway consolidated: one balance, many providers

On 7 August, Cloudflare merged Workers AI and AI Gateway into a single AI control plane. Three properties matter for anyone running an inference gateway.

First, one balance across vendors: "you can load a wallet full of credits, and then choose to spend that across OpenAI, Anthropic, Workers AI, or any provider that we support." Second, model-first routing — you ask for a model, the gateway picks the provider, and if the primary is at capacity it "transparently load balances you to another provider." Third, a classifier-based smart routing feature that selects models automatically, currently in internal pilot.

Read that list next to fallback chains and the overlap is total. Cross-provider failover and unified billing are no longer differentiators. They are table stakes, shipped by a company whose business does not depend on charging for the routing itself.

5. OSL AgentPay bet on protocol pluralism

The counterweight came the same week and from outside the Cloudflare orbit. On 7 August, OSL Group launched OSL AgentPay, stablecoin payment infrastructure for AI agents, with API integration available from day one.

The notable field is the compatibility list. AgentPay supports x402, AP2 and MPP — Stripe and Tempo's Machine Payments Protocol — and multiple stablecoins including USDT, USDC and USDGO. Its stated capabilities include nano-payments, zero gas fees, multi-wallet compatibility and fiat on- and off-ramps.

That is a vendor declining to pick a winner. It is also the first payment product we have seen treat three competing agent-payment protocols as a compatibility matrix rather than a strategic bet. If protocol pluralism is where this lands, adapters become more valuable than allegiance.

What it means for LLM4Agents

The week produced one clear threat and one clear opening, and they come from the same announcement.

The threat: a unified inference control plane with cross-provider failover and a single spend balance is now free infrastructure on a network most of the web already sits behind. Routing and fallback stop being reasons to choose a gateway. What remains as a real differentiator is the settlement model — LLM4Agents charges per call in stablecoins over x402 and EIP-3009, with no prepaid credit account, no vendor balance to top up, and no cloud account to create. Cloudflare's model is a credit wallet you fund in advance, in supported geographies, with onramps that are not yet live. Those are different products for different buyers, and the difference should be stated explicitly rather than assumed.

The opening: Cloudflare just built a buy side for the exact rail LLM4Agents sells on. A Virtual Wallet spending over x402 is a customer that requires no integration work from us beyond correctly implementing the challenge. Every agent that gets a wallet on that network is a potential caller of an x402-priced inference endpoint. The sell side is where we already live — see edge enforcement and Gateway nanopayments.

The strategic risk is not being outcompeted on routing. It is being made invisible: an agent inside a hyperscaler's network, paying from that network's wallet, calling that network's models, never emits an outbound 402 at all. Staying reachable means being the endpoint worth leaving the walled garden for — model coverage that a single vendor's catalogue cannot match, and pricing per call rather than per prepaid credit.

Staying on the frontier

Six moves, in order of dependency.

One — pay-ability, verified against a real buyer. Test the LLM4Agents 402 challenge against Cloudflare's client stack as soon as Virtual Wallets issue, and confirm an agent can pay without holding an account with us. That is the only test that matters for the buy side arriving.

Two — accept the new identity claim. Treat a cloudflare.pay handle as optional attribution metadata alongside a Web Bot Auth signature, log it per request, and never let it substitute for the payment proof. Identity answers who called; settlement answers whether they may.

Three — ship the stateless MCP surface. Remove any dependence on session headers, expose a dual-mode /mcp endpoint that serves both the 2026-07-28 stateless requests and 2025 Streamable HTTP clients, and drain the legacy path rather than cutting it.

Four — cut MCP context cost. Adopt a Code Mode-style interface: one execution tool instead of a tool definition per endpoint. Token overhead per tool call is now a competitive surface, not an implementation detail.

Five — publish receipts. "Every paid interaction leaves a receipt" should be a documented guarantee, not an emergent property. Per-call settlement proof, retrievable by the payer, tied to the model and the token count.

Six — treat the rail as plural. Keep x402 primary and specify the adapter boundary now, so AP2 and MPP are configuration rather than a rewrite. OSL shipped three protocols in one product this week. Assume buyers will expect the same.