Cloudflare Workers AI + Edge + KV

Domain Authenticator

Real-time domain trust scoring for the Cloudflare One browser extension — closing the 21-hour phishing gap that blocklists can't reach.

View on GitHub Try the demo

The white space

Cloudflare One secures two layers today. The browser is the third — and it's where work happens.

SHIPPED
Network layer — Gateway
DNS filtering, HTTP proxy, TLS inspection, DLP at the wire level. Sees URLs and payloads.
SHIPPED
Device layer — WARP + DEX
OS posture, disk encryption, process telemetry, network diagnostics.
THE GAP — THIS PROJECT
Browser layer — Extension
Rendered DOM, clipboard events, installed extensions, form actions, page performance, tab context. None of this is visible to the network or device layer.

How it works

Extension collects signals. Edge scores them. Gateway enforces policy.

01

Browser extension

Hooks webNavigation API at every domain change. Collects domain name, scans rendered DOM for credential forms, detects BITB patterns.

Manifest V3 Chrome/Edge
02

Cloudflare Worker + AI

Hybrid analysis: 6-signal heuristic engine (typosquatting, entropy, TLD risk) plus Workers AI semantic classification. Cached globally via KV.

Workers Workers AI KV
03

Gateway policy

Trust score feeds into admin-configured rules. The extension provides the signal — the admin's policy decides: allow, warn, isolate, or block.

Gateway RBI

Live demo

Type any domain below to see the scoring engine in action.