Cloudflare R2: Zero-Egress Economics
James remembered the cost table from Lesson 3. Next to "Content storage and delivery," the number was $0. He had accepted it at the time, but now it bothered him.
"How can content delivery cost nothing?" he asked. "At my old warehouse, shipping was always the biggest line item. You could get the product for cheap, but getting it to the customer cost real money."
Emma pointed to three numbers on her screen. "Here is what the other warehouses charge for shipping. And here is what ours charges."
You are doing exactly what James is doing. You saw $0 in the cost table and accepted it. Now you need to understand the pricing model that makes it real.
The Egress Price Comparison
When a user downloads data from cloud storage, the provider charges an egress fee: a per-gigabyte cost for data leaving their network. Here is what three providers charge:
| Provider | Egress fee per GB |
|---|---|
| AWS S3 | $0.09 |
| Google Cloud Storage | $0.12 |
| Cloudflare R2 | $0.00 |
Zero. R2 charges nothing for egress (data leaving the network), and reads are free within the generous free tier (10 million Class B operations per month). Beyond the free tier, reads cost $0.36 per million. This is not a promotional rate or a limited-time offer; it is R2's core pricing model. Cloudflare makes money from R2 through storage fees and write operations, not reads.
TutorClaw's Read Volume
TutorClaw's content (30 chapters of structured pedagogical material) totals 5-10 MB. At 16,000 learners fetching 2-3 content chunks daily, the read volume is approximately 1.44 million reads per month.
R2's free tier includes:
| Resource | Free tier limit | TutorClaw usage |
|---|---|---|
| Storage | 10 GB | 5-10 MB (~0.1%) |
| Reads (Class B) | 10M/month | ~1.44M/month (~14%) |
| Writes (Class A) | 1M/month | Minimal (content updates only) |
TutorClaw uses roughly 0.1% of the free storage limit and 14% of the free read limit. The product could grow to over 60,000 learners before approaching the 10M read cap, assuming the same fetch pattern.
Compute What You Would Pay Elsewhere
Each read fetches approximately 50 KB of content. At 1.44 million reads per month:
Total egress: 1,440,000 reads x 50 KB = 72,000,000 KB = 72 GB/month
Now apply each provider's rate:
| Provider | Egress (GB) | Rate per GB | Monthly cost |
|---|---|---|---|
| AWS S3 | 72 | $0.09 | $6.48 |
| Google Cloud Storage | 72 | $0.12 | $8.64 |
| Cloudflare R2 | 72 | $0.00 | $0.00 |
At TutorClaw's current scale, the savings are modest: $6-9/month. But egress fees scale linearly with learners. At 160,000 learners (10x), AWS S3 would cost $64.80/month and Google Cloud $86.40/month. R2 still costs $0. The pricing model means content delivery cost stays flat at zero regardless of growth, which is why the $0 in L3's cost table is structurally sound, not just a lucky break at low volume.
Two Paths to Content
In TutorClaw's MCP-first architecture, R2 content is accessed through two paths:
Path A (primary): MCP server to R2 Worker. When a learner requests chapter content through OpenClaw, the get_chapter_content MCP tool runs server-side. The MCP server calls the Cloudflare Worker with the learner's API key, validates their tier, retrieves the content from R2, and returns it as an MCP tool response. The learner's OpenClaw instance never contacts R2 directly for premium content. Access control is enforced entirely on the server side.
Path B (fallback): Shim skill to R2 Worker directly. When the MCP server is unreachable (network issues, server maintenance), the shim skill instructs the LLM to fetch chapters 1-5 directly from the R2 Worker. This path serves only free-tier content, with no authentication required. It is the offline fallback that keeps the free experience working even when the server is down.
The security principle: premium content flows through Path A only, where the MCP server verifies the learner's tier before returning content. Free content flows through either path. A learner on the free tier who tries to access Chapter 15 through Path B gets nothing; the R2 Worker only serves chapters 1-5 without an authenticated request from the MCP server.
Instant Content Updates
When you fix a typo in Chapter 15 or restructure a lesson's pedagogical flow, you upload the revised file to R2. On the next content fetch, every TutorClaw instance worldwide gets the updated version. There is no skill update to push, no learner action required, and no cache to invalidate (the R2 Worker can set cache headers per your update strategy).
This enables A/B testing: route different learner segments to different R2 paths based on API key metadata. Segment A gets the original lesson; Segment B gets the revised version. Compare completion rates to measure which version teaches more effectively.
Try With AI
Exercise 1: Three-Provider Cost Comparison
Ask your AI assistant to compute the egress cost across all three providers at TutorClaw's scale.
TutorClaw serves 16,000 learners who each fetch 2-3 content chunks
daily. That works out to about 1.44 million reads per month at
approximately 50 KB per read.
Calculate the monthly egress cost on three providers:
- AWS S3 at $0.09/GB
- Google Cloud Storage at $0.12/GB
- Cloudflare R2 at $0/GB
Then calculate the cost at 160,000 learners (10x scale). How much
would each provider cost per year at that scale?
What you are learning: How to convert read counts and chunk sizes into egress volume, then apply per-GB pricing. The calculation is straightforward multiplication, but it reveals a structural difference: R2's cost curve is flat at zero while other providers scale linearly with users.
Exercise 2: Path A vs Path B Security
Ask your AI assistant to explain the security model.
TutorClaw uses two content access paths:
- Path A: MCP server fetches from R2 Worker, validates learner tier,
returns content as MCP tool response.
- Path B: Shim skill fetches directly from R2 Worker for free chapters
only. No authentication needed.
Why is Path A used for premium content instead of Path B with an
access token? What would go wrong if premium content were served
directly through Path B with a token embedded in the shim skill?
What you are learning: The difference between server-side access control (where the gate runs on your server) and client-side access control (where the gate runs on the learner's machine). Client-side tokens can be extracted and shared. Server-side gating means the learner never sees the premium content unless the MCP server approves the request.
Exercise 3: Content Update Workflow
Ask your AI assistant to trace a content fix through the system.
I find a mistake in TutorClaw Chapter 15. Walk me through exactly
what happens from the moment I fix the file to the moment every
learner sees the corrected content. Include:
- Where I upload the fix
- How the R2 Worker serves it
- Whether learners need to do anything
- How this compares to updating a traditional mobile app or
desktop application
What you are learning: The operational advantage of server-side content delivery. Traditional applications require version bumps, app store reviews, and user-initiated updates. R2-backed content updates are instantaneous and universal; the learner's next content fetch returns the corrected version without any action on their part.
James nodded slowly. "So shipping is free. Not discounted, not subsidized. Actually free. And the loading dock has unlimited outbound trucks."
"That is the R2 model," Emma said. "They make money on storage and writes. Reads are free because Cloudflare wants the data on their network; serving it from their edge nodes costs them almost nothing."
"And our total content is 5-10 megabytes," James said. "On a free tier that allows 10 gigabytes. We could fit the entire book a thousand times over."
Emma paused. "I should be transparent about one thing. The free tier is generous today. Cloudflare has kept this pricing stable for years. I cannot guarantee they will not adjust it. But even if they did, look at the numbers: 5-10 MB of storage, 1.44 million reads on a 10 million read allowance. We are using 14% of the free tier. There is a wide buffer before any pricing change would affect us. And the architecture works the same way on R2's paid tier; the paid rates are still dramatically cheaper than S3 or GCS egress."
James looked at the cost table one more time. "Content is free to deliver. The MCP server costs $40-60. The database costs $10. The only real cost left is Stripe's cut of the revenue."
"Which is exactly what the next lesson covers."