Brolly

Cloudflare cost control, self-hosted

Cloudflare moves fast. Your bill can too.

Brolly catches runaway Workers, Durable Objects, storage, and AI usage before it becomes an invoice—then gives your team audited, reversible controls to contain it.

Deploy to CloudflareSee how it works

One account per installation. Your policies, credentials, incidents, and audit history stay in your Cloudflare account.

Cloudflare account · BrollyMonitoring
Projected spend today$8,241.37↑ 2,480%
!Emergency · Durable ObjectsRows read exceeded the emergency limit807.6M rows in 5 minutes
Exact object fuseReadyApprove & stop
Reversible action prepared · data preserved
1 minute bounded monitor cadence

Every billable Cloudflare service. One safety net.

Durable ObjectsWorkersD1R2KVQueuesWorkers AIAI Gateway

How it works

Know. Decide. Stop. Recover.

Brolly separates measurement from enforcement, so missing telemetry can never masquerade as a healthy account.

01

Measure

Bounded collectors scan fast telemetry every minute and reconcile authoritative billing daily.

02

Explain

Every incident names the asset, observed window, configured limit, evidence source, and freshness.

03

Contain

Prepare, approve, and roll back controls. Automatic mode acts only on classified, fuse-ready resources.

04

Recover

Resume restores saved state. Quarantine preserves resources, storage, messages, and history.

Install

Deploy Brolly into one Cloudflare account

The Deploy button creates your own Git repository, provisions Brolly's D1 database, builds the guard Worker, and opens your private dashboard. The universal site you are reading is not copied into your account.

Cloudflare-native installationReview every binding and secret before Cloudflare deploys your copy.Deploy to Cloudflare
  1. 1Create your deployment.

    Choose a Git account, give the Worker a name, and let Cloudflare provision its private D1 database.

  2. 2Add the encryption secret.

    BROLLY_CREDENTIAL_KEY protects OAuth and notification credentials stored in your D1 database.

  3. 3Sign in with Cloudflare.

    Authorize exactly one account, review the requested scopes, and define limits for discovered products, Workers, and namespaces.

Billing reconciliation is optional. Fast telemetry works with OAuth. A separate Billing Read token enables authoritative invoice comparison because Cloudflare does not expose that permission through its OAuth scope catalog.

Limits and modes

Start broad. Narrow the blast radius.

Define warning, critical, and emergency limits at the account, product, Worker, Durable Object namespace, and exact-object levels. More specific policies override broad defaults.

ObserveDetect and notify. Never prepare or execute a stop.
ApprovalPrepare a reversible action; a person explicitly executes it.
AutomaticAct after two fresh raw-usage emergencies on verified, eligible targets.

Precise shutdown

A zero-I/O deployment fuse

Monitoring works without application changes. Exact Worker and Durable Object quarantine uses the tiny @standardagents/brolly-runtime package. Its hot path only parses a deployment binding and compares IDs—no HTTP, KV, D1, or Durable Object storage operation.

Install
pnpm add @standardagents/brolly-runtime

One line in a Durable Object constructor

TypeScript
constructor(ctx: DurableObjectState, env: Env) {
  super(ctx, env)
  brollyDurableObject(ctx, env)
}

Stop ingress before waking the object

TypeScript
brollyWorker(env)
const id = env.ROOMS.idFromName(name)
brollyWorker(env, { durableObjectId: id.toString() })
return env.ROOMS.get(id).fetch(request)
Preserved

Object SQLite rows, messages, queues, and history remain intact.

Isolated

Only the named target ejects; unrelated object IDs continue serving.

Reversible

Resume removes the fuse target through a new audited deployment.

Notifications

Wake the people who can respond

Configure Discord, Slack, or Twilio SMS with independent minimum severity, pause controls, deduplication, and delivery-rate limits.

DiscordStructured incident webhooks
SlackIncoming webhook summaries
Twilio SMSHigh-urgency text alerts

Safety model

The monitor must not become the runaway workload

Every pass has hard limits: 150 Cloudflare API calls, 25,000 Brolly D1 row operations, 20,000 samples, and 45 seconds. Brolly never wakes every object or reads customer-object SQLite to monitor it.

  • Unknown telemetry is a coverage incident, never a zero or healthy reading.
  • Brolly and its notification path are protected from automatic shutdown.
  • Projected dollars never authorize a stop; automatic action requires fresh raw usage.
  • Controls preserve resources and data and record rollback state before execution.

Put up the umbrella

See the spike before the invoice.

Deploy one self-hosted Brolly per Cloudflare account.

 Deploy to Cloudflare