Current limits and product boundaries

These are universal security limits, not billing-plan quotas.

Program and data

• TypeScript source: 128 KiB.
• Normalized bundle: 512 KiB.
• Run input: 256 KiB.
• Complete signed signal or final-output envelope: 960 KiB.
• Aggregate canonical effect outcomes per run: 8 MiB.
• Aggregate txcast-controlled persisted Cloudflare payloads per run: 64 MiB.
• Individual HTTP body: 896 KiB.

Every effect declares a positive maxResultBytes, reserved before registration.

Run activity

• 10,000 effects and 256 simultaneously unresolved effects.
• 1,000 HTTP effects, 100 authored notifications, and 100 manual source refresh requests.
• 25,000 Cloudflare Workflow steps.
• No age-only expiry; long waits are deterministically renewed.
• No authored transaction-count limit inside one bounded evm.transactions request.

A command is rejected before it crosses a product or provider ceiling.

Cloudflare execution

Dynamic Workers use Cloudflare’s 128 MiB memory boundary and a 30,000 ms paid CPU ceiling. Artifacts freeze formula-derived subrequest ceilings. Authored code has no direct networking, secrets, filesystem, environment, clock, randomness, dynamic import, eval, or arbitrary package installation.

Deferred

Durable v1 excludes CoW-specific effects, authenticated HTTP/connectors, secret bindings, arbitrary npm packages, pull requests and collaborator merges, direct graph editing, delegatecall, autonomous signing or broadcasting, continue-as-new, billing-tier workflow quotas, and a non-Cloudflare production backend.

The Agent API is /agent/v2 and MCP is /mcp/v2. Legacy credentials and contracts are not backward compatible.