Token Observe vs Cloudflare AI Gateway
Cloudflare’s gateway decides what the payload contains. Token Observe decides whether the agent that sent it was allowed to.
2 September 2026
- Cloudflare AI Gateway product page
- AI Gateway documentation overview
- AI Gateway: Guardrails
- AI Gateway: Guardrails usage considerations
- AI Gateway: Data Loss Prevention
- AI Gateway: Caching
- AI Gateway: Dynamic routing
- AI Gateway: Unified Billing
- AI Gateway: Authenticated gateway
- AI Gateway: Bring your own keys
- AI Gateway: Rate limiting
- AI Gateway: Logging
- AI Gateway: Pricing
- AI Gateway: Limits
- Cloudflare Enterprise Customer Support and Service Level Agreement
- Cloudflare Self-Serve Subscription Agreement
Their claims, not our testing. Verify anything that decides it for you.
On this page
For most teams putting a first control in front of model traffic, Cloudflare is the better purchase, and it is not close
The pricing page is the shortest version of the argument. Cloudflare states that “AI Gateway’s core features available today are offered for free” — dashboard analytics, caching and rate limiting — and that DLP scanning is free on all plans, with Guardrails billed as Workers AI token-based inference and Logpush on the Workers Paid plan. Against a self-hosted product you have to deploy, back up, upgrade and keep running yourself, a free control that Cloudflare operates is the right answer for a great many estates, and a team whose actual requirement is to see what its applications are spending on models and to stop the obvious abuse should read no further than that sentence.
The second advantage is operational and Token Observe has no equivalent of it at all. Cloudflare runs the gateway on its own network: requests go to Cloudflare-operated endpoints, the caching page describes serving responses “directly from Cloudflare’s cache for identical requests”, and Cloudflare’s published Enterprise Customer Support and Service Level Agreement commits that “The Service will serve Customer Content globally 100% of the time” with Service Credits as the sole and exclusive remedy. Token Observe is a single-writer SQLite process on one host at its current target scale, with no replica, no clustering and no vendor-operated uptime commitment — and the reason none is offered is that the vendor does not operate your deployment and has no telemetry from it, so any uptime number would be unmeasurable by either party. If the control has to be highly available in every region you serve on the day it goes in, choose differently.
Third, and most specific: on content detection, including the one Token Observe is most often bought for, Cloudflare’s published mechanism is stronger than Token Observe’s. Guardrails are evaluated by a model — the usage-considerations page states they “currently use Llama Guard 3 8B on Workers AI to perform content evaluations”, named as @cf/meta/llama-guard-3-8b on the pricing page — over a published list of fourteen categories that includes P1 Prompt Injection. Token Observe’s injection scoring is nine weighted regular expressions, and a novel phrasing that matches none of them scores zero, so on prompt injection specifically the honest reading is that a generalising classifier beats a fixed pattern set. DLP reuses “the same detection profiles as Cloudflare One’s DLP solution”, which for an estate that already maintains those profiles is a saving Token Observe cannot offer and would be foolish to argue against. Its own detection is eleven data classes with three checksum-validated, and it is heuristic.
Everything said here about Cloudflare AI Gateway comes from Cloudflare’s own published pages, read on 2 September 2026 and listed in the sources. Nothing has been independently tested, there has been no witnessed bake-off, and these pages change. Where a row below reads as an absence, treat it as a question to put to Cloudflare in writing rather than as a finding.
Token Observe and Cloudflare AI Gateway, capability by capability
The Cloudflare AI Gateway column paraphrases Cloudflare’s own published material as it stood on 2 September 2026. None of it has been independently tested here, products in this category ship quickly, and a capability that is absent from a vendor’s documentation is not the same thing as a capability the product lacks. Check anything that decides it for you against their own current documentation.
Where it sits in the request path
Documented as a proxy “sitting between the user and the AI model”, served from Cloudflare’s network. The authentication page recommends “using the REST API at api.cloudflare.com” for new integrations and documents provider-native endpoints at gateway.ai.cloudflare.com alongside it.
A self-hosted process inside your network. Change OPENAI_BASE_URL or ANTHROPIC_BASE_URL and one key; for supported OpenAI-compatible, Anthropic and Gemini ingress that is normally the whole integration.
Guardrails evaluate user prompts before they reach the model and model responses before delivery. DLP inspects prompts and responses, including tool-call arguments and results where they appear in the JSON payload and the text portions of a multipart body. Its page states that it inspects “only the raw text of the request and response body”, so base64-encoded content is not scanned and external URLs are not followed.
Unicode is sanitised at step 4 so smuggled invisible characters are stripped before any detector reads the payload, scanning runs at step 5, and a tool call the model proposes on the way back is governed at step 10 against tool_call policies.
Governing the proposal is defence in depth rather than a guarantee: Token Observe can only refuse a tool call it is shown.
Documented, and different for the two controls. With response scanning enabled, “AI Gateway buffers the complete provider response before running DLP inspection”, which increases latency, while request-only scanning “does not buffer the response and has no impact on streaming latency”. Guardrails “does not support streaming (stream: true) requests”: on the REST API it “evaluates the response and logs the result, but does not enforce it — the client receives the full streaming response regardless”, and on the gateway endpoints it “buffers the full response, evaluates it, and returns a single non-streamed payload — the request no longer streams”.
A hold-back buffer with a 64-character floor and a separate buffer per tool-call argument channel, so a card number split across two chunks cannot escape output redaction. A blocking class ends the stream with an in-band ACP_POLICY_BLOCKED frame; what a stream cannot do is answer 403, because the status line is spent on the first byte.
The DLP page states that cache hits skip DLP scanning entirely.
Semantic caching is designed for in the data model and deliberately not implemented, so every governed request runs the same eleven steps and reaches the decision point at step 6.
The two positions are a real trade rather than a scoreboard: their cache is a latency and cost win that a scan would undo, and Token Observe pays full price on every request to keep one decision point.
Request retry and model fallbacks are documented for provider errors, and a dynamic route can carry rate-limit and budget-limit branches that switch to a fallback. What a caller should expect when the gateway itself is unavailable is not described in their published documentation as of 2026-09-02.
Fails closed by design: if Token Observe stops, governed agents cannot call models. The onboarding checklist requires a named owner for that emergency decision before a design-partner gate passes.
The DLP page states that there are no per-request DLP controls or bypass headers, and that different DLP policies require separate gateways.
Policies carry a scope, so one deployment holds rules that apply to one agent, one team, one tool or everything, and the same evaluator resolves them into a single verdict.
What it enforces
Content is evaluated in real time against “predefined safety parameters”, and you “specify which categories to monitor and choose between flagging or outright blocking” — flagged content is logged for review, blocked content is prevented from proceeding. Fourteen categories are published, S1 to S13 plus P1 Prompt Injection, evaluated by Llama Guard 3 8B on Workers AI — named as @cf/meta/llama-guard-3-8b on the pricing page — at roughly 500 ms added per request.
Seven trigger kinds — the tool being called and its argument values, the model and its estimated input size, accumulated spend, request and token rate, detected data classes, injection score and source, and the hour of day in UTC — and five actions resolved to one verdict, in which a block beats an approval and an approval beats a redaction.
DLP has three outcomes — pass, flag, or block, where a block replaces the response with a 400 — using “the same detection profiles as Cloudflare One’s DLP solution”, shared at account level across Gateway HTTP policies and AI Gateway policies.
Eleven data classes, three of them checksum-validated — Luhn, IBAN mod-97, NHS mod-11 — tokenised or blocked before the payload leaves your network. Detection is heuristic, and secrets are never tokenised reversibly.
Covered, and named as a category. The usage-considerations page publishes the full hazard list Guardrails evaluates — S1 Violent Crimes through S13 Elections, plus P1 Prompt Injection — and you select which of those categories to monitor or block. The evaluation is model-backed: “Guardrails currently uses Llama Guard 3 8B on Workers AI to perform content evaluations.”
Nine weighted patterns scored over prompts and over tool results, with tool results scored 1.25× because that is the channel that actually hijacks agents. Nine fixed patterns, not a classifier.
This is the row where their published mechanism is the stronger one. A model that generalises will catch phrasings nine fixed regular expressions were never written for, and a novel phrasing that matches none of Token Observe’s patterns scores zero.
An Authenticated Gateway requires a Cloudflare API token carrying Run permissions, sent in a cf-aig-authorization header on provider-native endpoints, which the page describes as preventing unauthorised access and invalid requests “that can inflate log storage usage”. The same page states that “the AI Gateway Read, Run, and Edit permissions cannot be restricted to a single gateway” and points at separate accounts or Worker-side bindings for tenant isolation. Per-agent, action-level permissions are not described in their published documentation as of 2026-09-02.
Deny-by-default action-level RBAC over resources such as model:gpt-5o-mini and tool:orderdb/*, where an explicit deny beats every allow in any role, and a delegation chain intersects rather than unions, so agent A cannot escalate by asking agent B.
Not described in their published documentation as of 2026-09-02. Dynamic routing describes automated node types — start, conditional, percentage, model, rate limit, budget limit and end — rather than parking a request on a person.
A 403 carrying an approval id, bound to the SHA-256 of the canonical action plus its execution context, single-use by compare-and-set, expiring at 60 minutes by default and from one minute to seven days by policy.
Approving pushes nothing to the agent. Token Observe has no way to call an agent back; the agent redeems the approval by repeating the identical request with its id.
Dynamic routing builds “a named, versioned flow (for example, dynamic/support)” from start, conditional, percentage, model, rate limit, budget limit and end nodes in an editor where “each change produces a new draft” that you deploy “with instant rollback”, called by putting the route name in place of the model. Conditionals branch on expressions that reference “request body, headers, or metadata (for example, user_plan == ‘paid’)”.
Seven typed failure classes, of which three fail over and four deliberately do not: a 429, a timeout and a 5xx move on, while a content-policy refusal, an auth failure, an over-long context and a malformed request stop where they are. Routing honours the agent’s data policy — retention, training and region — on every fallback.
Whether a provider actually honours a zero-retention or no-training claim is operator-asserted in Token Observe: nothing verifies it.
Spend limit rules on individual gateways cap spend, “scoped by model, provider, or custom metadata dimensions like user or team”, and Budget Limit nodes in a dynamic route switch to a fallback when exceeded.
USD ceilings per request, per hour, per UTC day and per UTC month for each agent, plus request, tool-call and token rate ceilings per minute, projected and reserved in one per-agent transaction; a budgeted agent whose resolved target or fallback has no price row is refused before egress rather than metered after.
What it records
Logs, “which include metrics as well as request and response data, are enabled by default for each gateway” and hold the user prompt, model response, provider, timestamp, request status, token usage, cost, duration and user agent, plus DLP action, policy and profile details where policies are enabled. You can opt out in settings or override logging per request with a cf-aig-collect-log header.
A trc_ trace id is minted at step 3, before the verdict, so a blocked request is recorded rather than merely refused, and it is returned in x-acp-trace-id on every response.
Not described in their published documentation as of 2026-09-02. The logging page documents three ways to delete logs: an Automatic Log Deletion setting that “automatically delete[s] the oldest logs once the storage limit for your account is reached”, filtering and deleting in the dashboard, or the API.
A hash-chained audit log in which each row’s digest covers its canonical content plus the previous row’s. Configure an audit key and those digests become MACs sealed at every boot by a checkpoint; configure an anchor key and the chain head is Ed25519-signed on a schedule and published to a sink outside the database administrator’s control. Both are off until you set a key: the shipped default is unkeyed, where a rewrite that re-hashes everything downstream verifies clean. Tamper-evident, not tamper-proof.
Storage is a cap rather than a clock: 10 million logs per gateway on the Paid plan and 100,000 per account on Free, 10 MB per log, and when the limit is reached “new logs will stop being saved” until older ones are deleted.
Trace retention is unset by default, and unset means keep forever. Setting a window is a decision you have to take rather than one the product takes for you.
The two failure modes point in opposite directions. Theirs stops recording when the cap is hit; Token Observe keeps everything until an operator says otherwise, which is a storage-growth and data-minimisation problem rather than an evidence-loss one.
Logs are filtered in the dashboard and read through the API. Logpush exports them on the Workers Paid plan, limited to four jobs per account and 1 MB per log.
A plain-English question is translated into a validated TraceFilter object over fourteen allow-listed fields — never into SQL — and shown back as editable chips. It degrades to a deterministic keyword parser whenever the translation does not come back — no model configured, a timeout, an unreachable provider, or output that fails validation — so a failed translator narrows the search rather than breaking it.
Logpush and the API are the documented export paths; a sealed evidence bundle or an offline verifier is not described in their published documentation as of 2026-09-02.
An export sealed with a SHA-256 digest over canonical JSON that carries the audit-chain verdict, verifiable by one Node script with no install, no database and no network: exit 0 trusted, exit 1 not. Digest-sealed, not signed.
How it deploys and who operates it
Cloudflare operates it. Requests go to Cloudflare-operated endpoints — api.cloudflare.com for new integrations, gateway.ai.cloudflare.com for provider-native ones — and the caching page describes serving responses “directly from Cloudflare’s cache for identical requests”. A self-hosted or on-premises deployment is not described in their published documentation as of 2026-09-02.
Self-hosted only, in your network, on your infrastructure. One Node process, one SQLite file in WAL mode, five surfaces. PostgreSQL sits behind the store ports as an evaluation alternative rather than as a supported high-availability topology.
Bring your own keys stores provider API keys in the Cloudflare dashboard “securely with Secrets Store”, selected per request with a cf-aig-byok-alias header and falling back to the key aliased default; rotation is editing the entry, with no code change.
Bring-your-own-key, held in your deployment. The vendor receives no product telemetry, no phone-home data, no prompts, no keys and no trace database, and the runtime data flow is documented so you can verify that rather than take it on assurance.
The docs overview names “Workers AI, Anthropic, Google Gemini, OpenAI, Replicate, and more”. Unified Billing lists six: OpenAI, Anthropic, Google AI Studio, Google Vertex AI, xAI and Groq.
OpenAI, Anthropic, Gemini, OpenRouter, Amazon Bedrock and Azure OpenAI as first-class upstreams, plus any OpenAI-compatible endpoint you register — including a gateway you already run. A table-driven test asserts that policies, redaction, budgets and tracing behave identically across every provider kind.
Published per account and per gateway: 10 gateways on Free and 20 on Paid, 500 logs per second per gateway, 25 MB per cacheable request, a one-month cache TTL, five custom metadata entries per request, and 200 Unified Billing requests per 60 seconds per gateway.
One reproducible laboratory baseline, travelling with its conditions: 206.2 successful requests per second, 71.2 ms p50, 163.8 ms p95 and 223.4 ms p99 over 30.143 seconds at concurrency 16, from an immutable commit, on an Apple M1 Max with 64 GB against a mock upstream on Node 20. Not a throughput commitment, and thirty seconds is not a soak.
Cloudflare operates the service on its own network, and publishes an Enterprise Customer Support and Service Level Agreement under which “The Service will serve Customer Content globally 100% of the time”, with Service Credits as the customer’s “sole and exclusive remedy” and beta and trial services excluded. An AI-Gateway-specific availability commitment is not described in their published documentation as of 2026-09-02.
One writer, one host, no replica, no clustering and no vendor-operated uptime SLA — stated rather than buried, because a fail-closed component in the path makes its own availability a governance property of your estate.
What it costs and what you sign
“AI Gateway’s core features available today are offered for free”, named as dashboard analytics, caching and rate limiting, and DLP scanning is free on all plans.
No published price list. Token Observe is sold through a conversation, and this page does not pretend otherwise.
Guardrails usage “is billed as Workers AI token-based inference — cost scales with the length of the prompts and responses being evaluated”. Logpush is on the Workers Paid plan at 10 million per month, plus $0.05 per million.
Self-hosted, so the cost is your compute and your storage. Detection and policy evaluation run in-process with no per-token inference charge, which is the flip side of the concession above: the reason it costs nothing per token is that it is regular expressions rather than a model.
Unified Billing applies “a 5% fee … to all credits purchased”, with provider inference pricing “passed through with no markup”, after you load credits into your Cloudflare account.
You keep your own provider contracts and your own keys. Fifty shipped price rows are loaded additively on every boot to price usage, and provider usage is normalised into mutually exclusive buckets before any arithmetic, because Anthropic reports cache reads and writes outside the input total while OpenAI and Gemini report them inside it.
Cloudflare publishes a Self-Serve Subscription Agreement that “governs your use of our Services” for accounts on its subscription plans, and an Enterprise Customer Support and Service Level Agreement for enterprise customers. An AI-Gateway-specific licence or evaluation grant is not described in their published documentation as of 2026-09-02.
A licence granting a 30-day evaluation written so a prospective customer’s security team can read, run and attack the software before a purchase order is raised, with no gag clause and no pre-approval of results. The published text is a template pending review by counsel in England and Wales, so read it as the intended terms rather than as an executed grant.
What a request looks like after it has been governed
Cloudflare’s logging page describes a thorough record: prompt, response, provider, timestamp, status, token usage, cost, duration, user agent and DLP action, enabled by default on each gateway and filterable in the dashboard or exported through Logpush. If your requirement is to see what happened and query it later, that record answers it, and it answers it without you running anything.
The requirement Token Observe is built for is narrower and harder: to be able to show a party who does not trust you that the record has not been edited since. That is why the audit log is hash-chained — each row’s digest covers its canonical content plus the previous row’s, so an edit or a deletion breaks verification at a known sequence number — why appends take the chain tip inside the same transaction so concurrent writers cannot fork it, and why, once an audit key is configured, entry digests become MACs sealed at every boot by a checkpoint and, once an anchor key is configured, the head is Ed25519-signed on a schedule and published off-box. The party who can rewrite a row is then not the party who can sign over the rewrite.
Three limits belong in the same breath as that claim, because a governance product that overstates its own evidence is worse than one that does not have any. The chain is tamper-evident rather than tamper-proof: it detects a rewrite, it does not prevent one. Unkeyed — which is the default — an attacker who re-hashes every subsequent row produces a chain that verifies clean, so the MAC key is the control that matters. And evidence exports are sealed with a SHA-256 digest that carries the chain verdict; they are not themselves signed, and durable origin evidence comes from the keyed audit plus the anchor rather than from the export.
The arrangement that usually makes sense: Cloudflare in front, Token Observe for the agents that act
Token Observe can route to any OpenAI-compatible endpoint you register, and an existing gateway is one of those, so the two compose in either order without anything being ripped out. The arrangement that costs least is to leave Cloudflare where it is for the whole estate and put Token Observe only in front of the agents that take consequential actions — the ones that can issue a refund, merge a pull request, send an email or write a row.
Two proxies in series is a second failure domain and a second hop of latency, so this is a decision to take deliberately rather than by default. The blunt version of the advice: a chat assistant does not need both, and a refund agent might. Token Observe’s own pilot boundary is roughly five to fifty agents owned by one platform team, which is a sensible shape for the second hop as well.
If you need another enforcement point to be shown to agree with the first, scope and trigger matching can be compiled to digest-locked OPA Rego with reproducible positive and negative witnesses. The artifact deliberately excludes permissions, budgets, approval consumption, kill switches, action precedence and side effects — Token Observe stays authoritative for those — so treat it as a way to prove two points agree on matching, not as a way to move the decision.
- Cloudflare in front
- Keep the edge, the cache, the account-wide rate limits and the DLP profiles. Route the consequential agents onward to Token Observe as their base URL.
- Token Observe in front
- Hold the agent credential and take the policy verdict first, then route to your Cloudflare gateway as an OpenAI-compatible upstream so key custody and caching stay where they are.
- What not to duplicate
- Two sensitive-data scanners in series double the false-positive surface. Pick one as authoritative for egress redaction and run the other in observe-only — Token Observe’s shadow mode records what a rule would have done without stopping anything.
What sits outside both products
A gateway of either kind governs the traffic that goes through it, which is exactly as much as the traffic that goes through it. An agent holding a provider key that points straight at the provider is invisible to Cloudflare’s gateway and to Token Observe alike, and no amount of inline enforcement changes that.
Token Observe’s answer is a separate mechanism rather than a stronger claim about the path: five evidence sources for activity outside the gateway — vendor bill reconciliation, network egress analysis, service-account key audit, IDE and CLI telemetry, and its own caller and price consistency checks. That is detection after the fact, it produces findings rather than blocks, and a source may only clear a finding when its run actually completed, so a failed or truncated pass leaves every existing finding standing rather than quietly resolving your estate.
The equivalent question is worth putting to Cloudflare in writing, because an organisation already running Cloudflare One has network-level visibility that Token Observe would have to reconstruct, and the answer may well be that the coverage you need already exists one layer down.
Where each one is the right answer
Choose Cloudflare AI Gateway when
- Your requirement is visibility and traffic control in front of model calls — analytics, caching, rate limits and fallbacks — and nobody has yet asked you to prove what a particular agent was authorised to do.
- You need the gateway operated for you, in every region you serve, starting on the day you switch it on. Token Observe is a single-writer process on one host at this scale, with no replica and no vendor-operated uptime SLA.
- You already run Cloudflare One and maintain DLP detection profiles there, since AI Gateway’s DLP is documented as using the same account-level profiles.
- Budget is the constraint. Cloudflare documents the core features as free on all plans, and a free control that exists beats a paid one that is still being procured.
- The traffic is chat or drafting, where a human reads every output before anything happens, so a fail-closed dependency in the path buys less than the outage risk it introduces.
Choose Token Observe when
- The agents take actions somebody has to answer for — a refund, a deployment, an email, a ticket transition, a database write — and a 200 response is not acceptable proof that the right thing happened.
- You need a human decision bound to one exact payload rather than to an action type: single-use, expiring, with the approver recorded against the trace and a changed argument refused as a mismatch.
- Each agent needs its own identity, owner, purpose, risk tier and deny-by-default permission set, and delegation between agents must narrow authority rather than widen it.
- Somebody will eventually ask who says this record has not been edited, and a queryable log is not an answer to that question.
- Prompts and payloads must not leave your network for a third party at all, including for the control itself — Token Observe is self-hosted and the vendor receives no prompts, keys or traces.
When you would run both
Running both is the normal answer, and the split follows the two questions rather than the two vendors. Cloudflare AI Gateway stays where it is for the whole estate: the edge position, the cache, the account-wide rate limits, the Unified Billing credits and the DLP profiles you already maintain in Cloudflare One. Token Observe goes in front of the subset of agents that take actions somebody has to answer for, holding the agent identity, the deny-by-default permission set, the payload-bound approval and the hash-chained record, and routing onward to your Cloudflare gateway as an OpenAI-compatible upstream so key custody and caching do not move. Start with the agents that can spend money or change state, leave everything else pointing where it points now, and pick one of the two sensitive-data scanners as authoritative for egress while the other runs in observe-only, because two redaction engines in series double the false-positive surface without doubling the protection.
The category argument sits above this one: Token Observe and llm gateways covers what the whole category does and does not do, which is the better page to read if you have not yet shortlisted a product.
The others in the same slot
LiteLLM
If you already run LiteLLM, keep it. The question that decides whether you need anything more is about the actions your agents take, not about the proxy.
Portkey
Both hold the payload before it reaches a provider. One is built to carry it to more than 250 models; the other is built to refuse it and prove afterwards who said it could go.
Kong AI Gateway
Kong governs the traffic. Token Observe governs the action. If you already run Kong, the first one is nearly free and the second one is the only reason to read further.
Envoy AI Gateway
Both hold the request. One charges the token budget once the response completes; the other reserves the money before the request leaves your network.
MuleSoft AI Gateway
Both refuse the call inline. One refuses on behalf of an endpoint, the other on behalf of an agent that has an owner.
Is this a replacement decision?
Usually not. Cloudflare AI Gateway occupies the edge and prices its core features at zero, and Token Observe has no edge topology and does not claim one; the two sit at different points in the same path and answer different questions about the same request. The replacement case exists only where the requirement is that no payload leaves your network for any third party including the control itself, in which case a gateway operated by a vendor on its own network is ruled out by the requirement rather than by the comparison.
Cloudflare Guardrails already block unsafe prompts and responses. What does Token Observe add?
A different verdict about the same request. Guardrails, on Cloudflare’s published description, evaluate content against a published list of fourteen hazard categories using Llama Guard 3 8B and let you flag or block — a judgement about the bytes, and one that covers prompt injection as category P1. Token Observe evaluates whether the named agent that sent the request held an action-level grant for this exact call, whether the delegation chain that reached it narrowed authority correctly, whether spend and rate ceilings are intact, and whether policy requires a named person to approve this specific payload before it proceeds. On content detection, prompt injection included, Cloudflare’s mechanism is the stronger one: theirs is model-backed, and Token Observe’s injection scoring is nine weighted regular expressions that a novel phrasing can miss entirely. If Guardrails already meets your content requirement, keep it and let Token Observe answer the authority question.
Can Token Observe run behind Cloudflare AI Gateway?
Yes, in either order. Token Observe routes to any OpenAI-compatible endpoint you register, so a Cloudflare gateway can be an upstream; equally, an agent can point at Token Observe first and Token Observe can forward onward. Both arrangements add a hop and a second failure domain, so the usual starting shape is narrow: route only the agents that take consequential actions through Token Observe, and leave the rest pointing where they point now. The one thing worth deciding explicitly is which of the two sensitive-data scanners is authoritative, because running both in enforcing mode doubles your false-positive rate.
Has Token Observe been tested against Cloudflare AI Gateway?
No. Every claim on this page about Cloudflare AI Gateway is taken from Cloudflare’s own published pages, read on 2 September 2026 and listed in the sources, and none of it has been independently tested. There has been no witnessed bake-off against any product, and no reference deployment of either against the other. Where a cell reads as an absence it says so in the words “not described in their published documentation”, because an undocumented capability and a missing one look identical from outside, and Cloudflare ships quickly enough that any of these pages may have moved since.
What are the real limits of Token Observe against a product like this one?
Four, stated plainly. It is a single-writer process on one host at this target scale, with no replica, no clustering and no vendor-operated uptime SLA, and it fails closed, so its availability becomes a property of your agents’ availability. Its detection is heuristic — eleven data classes and nine injection patterns rather than a model. Its audit chain is tamper-evident rather than tamper-proof, unkeyed by default, and its evidence exports are digest-sealed rather than signed. And it has not had an independent penetration test; the licence permits a pre-purchase test with no gag clause, which is offered precisely because the test does not yet exist.
Prefer to ask a person? Write to us →
Tell us which one you are already running.
If Cloudflare AI Gateway is already in your stack, the useful question is not which to buy but what each is for, and where the seam between them sits. Say what you have and you will get a straight answer — including when the answer is that you do not need a second thing.
no form · no qualification step · no sales desk · the other three ways in