Grep can’t run a cryptography migration. That’s the concrete problem behind Cloudflare’s CryptoLabe, an internal tool described in a post on the Cloudflare blog published September 29, 2026. Cloudflare has set a 2029 deadline for full post-quantum (PQ) readiness, and while many products already use PQ encryption over TLS 1.3, post-quantum authentication is still early. The gap between “we know where RSA appears as a string” and “we know how this ECDSA signature is actually used” is exactly where AI earns its keep here.
Why pattern matching fails on crypto
Cryptography rarely announces itself. According to Cloudflare’s write-up, it hides in shared libraries a repo imports but never calls, in protocol defaults like a TLS 1.3 listener still negotiating X25519 instead of X25519MLKEM768, in YAML files pinned in a different repository, and in dead or test-only code paths. Grepping for “RSA” both overcounts (unused code) and undercounts (defaults and dependency-level uses), and it can’t distinguish a classical signature in a JWT from one in IPsec, TLS, or SSH — each with a different migration path.
CryptoLabe handles this in two stages. A discovery stage maps a repository and searches source, config, manifests, lockfiles, tests, and docs for key agreement, signatures, tokens, PKI, HSM integrations, and more. Each raw observation then goes through an analysis stage that re-checks it against source code, investigates runtime usage and dependencies, and reviews its own conclusions for conflicts like config overrides or test-only code. When evidence runs out, the model classifies the finding as “More evidence needed,” “External dependency,” or “Unknown” instead of guessing. That refusal-to-guess is the part worth copying in any AI-assisted audit tool.
The infrastructure decisions worth stealing
Cloudflare built this on its own developer platform, and the choices read like a checklist for anyone shipping agentic tooling. Two Workers — a scanner and an inventory service with a D1 database — talk over Service Bindings. Per-repository coordinators built on Durable Objects track progress, cancellations, and retries, while Cloudflare Workflows persist each scan through discovery, deep analysis, merge, and publish stages.
The isolation model is the standout. CryptoLabe downloads each repository once at an exact commit, snapshots it into R2, and restores that snapshot into a short-lived, isolated Sandbox where the model only gets read-only tools. The scan can’t damage the codebase, and results stay consistent even if the repo changes mid-scan. This echoes a pattern I’ve written about before around giving every agent branch its own isolated runtime: immutability makes agent output trustworthy.
The scaling fix is equally practical. Concurrent scans triggered bursts of HTTP 429s from AI Gateway, and independent retries made it worse. Cloudflare’s answer was a single global Durable Object that paces every model request across all scans, so a shared cooldown makes everyone back off together. Model calls go through AI Gateway to cost-effective open-weight models on Workers AI, keeping future model swaps cheap.
What this means for your roadmap
Cloudflare’s third goal may matter most for planners: surfacing prerequisites early — protocols, standards, or libraries with no PQ migration path at all — so stakeholders and standards bodies can be engaged years before a deadline. The tool also feeds per-repository and per-product metrics to both PMs and engineers.
Two honest caveats from the source: CryptoLabe is deeply specialized to Cloudflare’s internal systems and isn’t available to customers, and the team states it does not yet have a ground-truth dataset for reproducibly comparing prompt versions — so accuracy claims are still being validated iteratively with engineers. The transferable takeaway isn’t the tool itself; it’s the shape: evidence-checked two-stage analysis, honest “unknown” classifications, immutable snapshots, and shared rate-limit pacing.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.