Cloudflare Workers can now receive inbound TCP connections, ending an eight-year limitation that restricted the platform to serving only HTTP traffic. The capability arrived through a new connect(socket) handler announced during the company's Agents Week, though it launched in private beta rather than general availability. Since Workers debuted in 2017, developers could open outbound sockets to databases or services but couldn't use the platform as a server for anything beyond HTTP.
The new handler accepts raw inbound sockets routed through Spectrum, Cloudflare's existing ingress proxy for non-HTTP traffic. A Worker can read and write the socket directly, hand it to another Worker, or pass it to a Durable Object, which can then connect it to a Container through getTcpPort(). Cloudflare's examples include a Go gRPC echo server and a Python socketserver, both running without modifications. Workers themselves support unary and server-streaming gRPC without a container, but not bidirectional streaming—the mechanism translates between gRPC-web in developer code and standard gRPC on the wire. The limitation stems from HTTP/2's frame-level stream control, which gRPC depends on for streaming, cancellation, flow control, and trailers, but which Web platform APIs like fetch() don't expose.
The company explained its decision to ship the feature in private beta rather than making it broadly available by noting that it doesn't use gRPC internally. "At Cloudflare, we use Cap'n Proto and Cap'n Web and the JavaScript-native RPC system that is built into Cloudflare Workers instead of gRPC," the announcement states. According to the post, Cloudflare wants to collaborate with a smaller group of gRPC developers first to ensure the implementation is correct before enabling it for everyone. The report describes this as an unusual admission for a vendor to publish alongside a launch, setting an honest expectation about maturity.
The underlying socket capability enables workloads that have been impossible on Workers for eight years: message brokers, database proxies, custom binary protocols, and anything expecting a socket. Passing a socket from Worker to Durable Object to Container turns the edge into a termination point for arbitrary TCP, with routing logic in JavaScript positioned ahead of it. A Worker sees the connection before deciding where it goes, mirroring the shape of an API gateway making decisions before forwarding a request but applied to raw sockets rather than HTTP. The announcement notes that gRPC continues to emerge as the answer for machine-to-machine traffic, including in systems originally designed around HTTP, with the protocol—released by Google nearly ten years ago—appearing in recent specifications like MCP's addition of gRPC as an optional transport alongside its HTTP one. Cloudflare says UDP-based protocols are next. For platform teams weighing whether serverless edge infrastructure can handle protocol-level routing decisions that once required dedicated proxies, the question turns on whether translation layers and beta-stage maturity align with production risk tolerance—or whether waiting for broader adoption makes more strategic sense.