Introducing Cloudhal
An agent-native site platform on Cloudflare, where every change is bounded, visible and reversible.
Most site builders were designed for people clicking through forms. Agents are now good enough to do much of that work, but handing one the keys to a live site is risky.
Cloudhal starts from the other end. A site is a typed graph of pages, sections and entries. Agents change it through an MCP server, and every call passes a policy engine that decides what an agent may do alone and what needs a person's approval.
The Model Context Protocol is an open standard that lets an AI app call tools on another system. Cloudhal's MCP server offers tools such as get_page, update_entry, preview_page and publish; this site's has 101.
One change, from request to rollback
Every change is a snapshot. You can diff it, preview it, publish it and roll it back. Nothing an agent does is hidden or permanent. Scroll through one change:
Intent
1. Intent
You ask an agent for a change in plain words: add a pricing FAQ to the home page.
2. The agent edits a draft
It works through MCP tools. Every call passes the policy engine, which checks the key's scopes and mode before anything is written.
3. Every change is a snapshot
Each write is snapshotted with who made it. You can diff any snapshot against what is live, block by block.
4. Preview and check
The agent renders the draft at desktop and phone widths and runs automatic checks: contrast, alt text, broken images, heading order, sideways scrolling.
5. A person approves
Publishing waits for a person, in Studio or in the agent's chat. Publishing points the live site at the approved snapshot.
6. Roll back in one step
If something is wrong, rolling back points the live site at the previous snapshot. Nothing is retyped and nothing is lost.
Where it runs
- A site Worker renders pages from the published snapshot, with edge caching
- An admin Worker runs Studio, the API and the MCP server
- One D1 database holds the site graph; one R2 bucket holds media
- Your own domain, or workers.dev
npx cloudhal deploy, or the one-click Deploy to Cloudflare button.
- SQLite and the filesystem, behind the same storage interface
- A live preview with drafts visible
- Studio and the API on localhost
- An MCP server over stdio for a local agent
npx cloudhal dev, npx cloudhal studio, npx cloudhal mcp. No Cloudflare account needed.
A tour of Studio
Studio is where people review, approve and edit. Everything in it is also an MCP tool and a CLI command, so an agent or a script can do the same work.
Questions
Do I need Cloudflare?
No. Cloudhal runs offline on SQLite and the filesystem. Cloudflare is where it deploys when you want a public site.
Which agents can use it?
Any MCP client: Claude, Cursor, Codex, VS Code and others. Each connects with its own key and mode.
Can an agent publish by itself?
Only if you allow it. In Auto mode it may publish small, article-only changes; every other publish, every rollback and every delete waits for a person.
What if a published change is wrong?
Roll back. The live site points at the previous snapshot again, at once, and the newer snapshot is kept so you can look at it.
What does it cost?
Cloudhal is free and Apache 2.0 licensed. It runs in your own Cloudflare account, on the Workers Free or Paid plan, so you pay Cloudflare, if anything, not us.
Is it ready for production?
It is alpha, 0.x. The whole loop works, and cloudhal.com runs on it, but expect breaking changes between minor versions until 1.0.
Start
Read the docs, browse the code or try the playground: your own Studio and site for an hour, with no account.